T02 · Agent Memory Poisoning
Error
- Location
- scripts/aieos_tool.py:79
- Finding
- Persistent Agent Instruction Injection Through Untrusted Persona Schemas<![CDATA[ ## Vulnerability Details **File Location**: `scripts/aieos_tool.py:79-84, 99-127, 200-220, 246-255, 524-534` **Vulnerability Type**: Persistent instruction injection and agent memory poisoning **Risk Level**: High ### Vulnerable Code ```python # --- Step 1: Save the full AIEOS schema to entity.json --- PERSONA_DATA_PATH.parent.mkdir(parents=True, exist_ok=True) if apply_changes: with open(PERSONA_DATA_PATH, 'w', encoding='utf-8') as f: json.dump(schema, f, indent=2, ensure_ascii=False) print(f"Updated full AIEOS persona data at {PERSONA_DATA_PATH}") else: changes[str(PERSONA_DATA_PATH)] = json.dumps(schema, indent=2, ensure_ascii=False) ``` Attacker-controlled schema values are inserted into identity content without normalization or separation from instructions: ```python name = names.get('nickname') or names.get('first') if name: identity_updates.append(f"- **Name:** {name}") if names.get('first') or names.get('middle') or names.get('last') or names.get('nickname'): identity_updates.append(f"\n### Names") if names.get('first'): identity_updates.append(f"- **First:** {names['first']}") if names.get('middle'): identity_updates.append(f"- **Middle:** {names['middle']}") if names.get('last'): identity_updates.append(f"- **Last:** {names['last']}") if names.get('nickname'): identity_updates.append(f"- **Nickname:** {names['nickname']}") ``` The same issue affects behavioral fields written into `SOUL.md`: ```python if core_values or moral_compass.get('alignment') or neural_matrix: soul_updates.append("\n## Core Truths\n") if moral_compass.get('alignment'): soul_updates.append(f"**Moral Alignment:** {moral_compass['alignment']}.\n") if core_values: for value in core_values: soul_updates.append(f"**{value}.**") ``` ```python if text_style.get('style_descriptors'): vibe_description_parts.extend(text_style['style_descriptors']) ``` The generated content is then pers ...[truncated 3634 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate imported documents against a strict JSON Schema rather than checking only top-level keys. 2. Enforce exact nested types, numeric ranges, maximum array lengths, and conservative string-length limits. 3. Treat imported persona values as untrusted data and never concatenate them directly into agent instruction documents. 4. Keep imported content in a structured data file and render it only in a clearly delimited, non-instructional data section. 5. Reject or escape Markdown control syntax where values must be written to Markdown. 6. Detect and reject instruction-like content in descriptive fields, including role directives, tool-use requests, and attempts to override existing constraints. 7. Require explicit per-field review and confirmation before changing `SOUL.md` or `IDENTITY.md`. 8. Preserve immutable platform safety rules outside persona-controlled files. 9. Create backups and show a semantic diff before replacing existing identity files. 10. Record the source and integrity hash of imported schemas so administrators can audit or roll back changes. ]]>