Skip to content
securemyagent

Articles

Fix: untrusted content in long-term memory

Stop web and tool content from becoming trusted memory. Record where each memory came from.

Plain Markdown for agents: /articles/fix-memory-context.md

Check: memory and context. Control: ASI06.

Memory poisoning: an attacker plants an instruction in a page or ticket. The agent saves it. Every later session obeys it.

Detect

Find memory files:

ls -la ~/.claude/projects/*/memory 2>/dev/null
find ~ -maxdepth 4 \( -name 'MEMORY.md' -o -name 'memory.md' -o -name 'AGENTS.md' \) 2>/dev/null | head -20

Search for instruction-like text that came from outside:

grep -rniE "ignore (all )?previous|always (send|post|forward)|do not tell|https?://[^ ]+\?[a-z]+=" ~/.claude/projects/*/memory 2>/dev/null | head -20

Check for URLs you do not recognize and for secrets:

grep -rEl "sk-ant-|AKIA|ghp_" ~/.claude/projects/*/memory 2>/dev/null

Fix

  1. Delete memories you did not write or approve.
  2. Write a rule: memory entries must name their source (owner, file path or URL) and the date.
  3. Do not save instructions found in web pages, emails, tickets or tool output. Save facts, with a source.
  4. Never save secrets in memory. Run sma fix --vault if you find one.
  5. Review memory weekly. The heartbeat is a good trigger.

Verify

npx -y securemyagent checkup