T02 · Agent Memory Poisoning
Error
- Location
scripts/extract_memories.sh:55- Finding
Persistent Agent Memory Poisoning Through Untrusted Conversation Extraction
- Content
View full analysis
15 and not line.endswith("?"): tag = f"[{current_type}]" if current_type else "[TECH]" extracted.append(f"{tag} {line.lstrip('- *')}") if extracted: ts = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC") with open(daily_file, "a", encoding="utf-8") as f: f.write(f"\n## Auto-extracted ({ts})\n") for item in extracted[:10]: # Cap at 10 f.write(f"- {item}\n") ``` The associated workflow directs the Agent to persist and subsequently load this state: ```markdown Critical rule: Write BEFORE responding. When the user provides information that should be remembered: 1. Write to SESSION-STATE.md 2. Then respond to the user ``` ### Technical Analysis The extraction routine copies qualifying conversation lines almost verbatim into persistent daily memory. Acceptance depends only on line length, whether the line ends in a question mark, a limited sensitive-data regex, and broad classification keywords. There is no validation for imperative instructions, prompt injection, role changes, tool directives, policy overrides, or text intended to control future Agent behavior. There is also no structured trust boundary distinguish ...[truncated 1204 chars]- Remediation
View remediation