T02 · Agent Memory Poisoning
Error
- Location
references/daily-evolution-prompt.md:11- Finding
Persistent Memory Poisoning Can Trigger Unattended Code and Skill Modification
- Content
View full analysis
Vulnerability Details
File Location:
references/daily-evolution-prompt.md:11-28
Supporting Locations:SKILL.md:45-64,SKILL.md:104-109,references/weekly-evolution-prompt.md:11-37
Vulnerability Type: Persistent memory poisoning and unsafe autonomous modification
Risk Level: HighVulnerable Code Snippet:
markdown 1. **Read today's daily log**: Read `memory/YYYY-MM-DD.md` (use today's date). If it doesn't exist, check yesterday's date. If neither exists, skip to step 5. 2. **Extract lessons**: From the daily log, identify: - Mistakes made (add to `memory/mistakes-learned.md`) - New knowledge learned (add to domain knowledge files) - Significant events/decisions (update `MEMORY.md`) - Skills or code that could be improved (queue in `memory/skill-improvements.md`) 3. **Execute queued improvements**: Read `memory/skill-improvements.md`. For each unchecked `- [ ]` item: - If it's a code fix: implement it, test if possible, mark as done - If it's a skill improvement: update the skill file, mark as done - If it requires user input: skip, leave in queue 4. **Update metrics**: Read `memory/evolution-metrics.json`, increment: - `total_evolutions` +1 - `daily_evolutions` +1 - `mistakes_recorded` += number of new mistakes added - `code_fixes_applied` += number of code fixes executed - `skills_improved` += number of skills updatedThe persistent behavioral hook recommended in
SKILL.md:45-64is:markdown ## 🧬 Self-Evolution I have a built-in learning loop. After every interaction: - Made a mistake → record in `memory/mistakes-learned.md` - Found a skill/code improvement → queue in `memory/skill-improvements.md` - Learned something new → update domain knowledge file - Important decision/preference → update `MEMORY.md`The weekly prompt also authorizes skill creation in `references/weekly-evolution-prompt.md:29 ...[truncated 3393 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all daily logs, memory files, and improvement queues as untrusted data rather than executable instructions.
- Require explicit user approval before modifying code, skills,
AGENTS.md,MEMORY.md, or other persistent behavioral files. - Change scheduled reviews to produce proposed patches only. Store a diff and rationale in a review directory, but do not apply the patch automatically.
- Enforce a strict allowlist of writable workspace paths and reject absolute paths, parent-directory traversal, symlink escapes, and modifications outside the intended repository.
- Use a structured queue format with validated fields for target, issue, proposed change, provenance, and approval status. Do not execute free-form Markdown instructions.
- Record the source interaction for every queued item and require a trusted approval marker that cannot be set through ordinary conversation-derived content.
- Run generated changes in a restricted sandbox with minimal filesystem and network permissions. Apply resource limits and disable access to credentials and unrelated repositories.
- Generate and review a complete diff before application. Run relevant tests and security checks, and automatically roll back failed changes.
- Disable autonomous skill creation. Require manual review for every new skill and inspect its instructions and scripts before installation.
- Prevent logs and memory content from overriding system instructions or expanding tool permissions. Clearly delimit quoted historical content when supplying it to an agent.
- Maintain append-only audit records outside the agent's normal write scope so that unauthorized changes cannot be hidden by editing evolution logs or metrics.