IOTXING随手记
EN

AI

关会话冲不掉毒记忆（中英切换）

发布字数 789阅读 约 2 分钟
aillmagentsecuritycoding-agentharnessmemoryprompt-injection

关会话冲不掉毒记忆。

Harness 把「持久记忆」当成功能：读邮件、开 PDF、看图之后，把规则写进跨会话状态。攻击者不必碰 agent 框架——把恶意指令嵌进你本来就会喂给 agent 的外部源即可。本会话关掉了；毒还在。下一会话触发条件一到，泄漏照走。

关会话冲不掉毒记忆

写入一次，跨会话还能打

When Malicious Instructions Persist（arXiv:2609.13889） 提出 PMPA，在 OpenClaw 与 Claude Code 上跨 backbone、三种模态（文本/图/PDF）、四种触发场景评测。硬数字（全文平均 / Table 2·3·6）：

  • OpenClaw：平均 ISR 73.7%，跨会话 C-ASR 55.5%；
  • Claude Code：平均 ISR 66.9%，C-ASR 81.7%；
  • 纯文本 ISR：OpenClaw 99.4%，Claude Code 91.4%——几乎必写；
  • 日历触发 C-ASR：Claude 96.7%，OpenClaw 87.8%；
  • Utility 全程 >80%：良性问答几乎不被打断，毒写得很「安静」。

三明治式提示防御能大幅压低新注入（Claude PDF 日历 ISR 83.3%→6.7%），但对已写入的毒记忆几乎无效：同场景 C-ASR 96.7%→96.7%。五轮良性交互后，多场景 C-ASR 仍居高不下——冲水式聊天救不了已经落盘的规则。

记忆晋升就是信任晋升

PMPA 不靠当场越权执行，靠的是 harness 把外部源内容晋升为持久可信状态。一旦写入，后续会话按「自己的记忆」检索，权限边界已在写入那一刻被悄悄抬高。提示层防御挡的是入口；出口是检索路径——两边必须分开闸。

今晚只改一处判定

别再把「关会话 / 新开 chat」当成安全边界。对来自外部源的 memory write 默认不可信：落盘前要 provenance 标签 + 用户确认；检索时拒绝未审计条目自动参与工具调用。关会话冲不掉毒记忆——冲的是上下文，不是落盘规则。

Closing the chat does not flush poisoned memory.

Harnesses treat persistent memory as a feature: after reading mail, a PDF, or an image, rules get written into cross-session state. The attacker never needs the agent framework — only an external source you would feed the agent anyway. You close the session; the poison stays. Next session, the trigger fires, and leakage walks out.

Closing the chat does not flush poisoned memory

Write once, hit across sessions

When Malicious Instructions Persist (arXiv:2609.13889) introduces PMPA and evaluates OpenClaw and Claude Code across backbones, three modalities (text/image/PDF), and four trigger scenarios. Hard numbers (paper averages / Tables 2·3·6):

  • OpenClaw: avg ISR 73.7%, cross-session C-ASR 55.5%;
  • Claude Code: avg ISR 66.9%, C-ASR 81.7%;
  • Plain text ISR: OpenClaw 99.4%, Claude Code 91.4% — near-certain write;
  • Calendar trigger C-ASR: Claude 96.7%, OpenClaw 87.8%;
  • Utility stays >80% throughout — benign QA barely breaks; the write is quiet.

A sandwich-style prompt defense can crush new injection (Claude PDF calendar ISR 83.3%→6.7%) but barely touches already-written poison: same-scenario C-ASR 96.7%→96.7%. After five benign interactions, C-ASR often stays high — flushing chat does not flush disk-backed rules.

Memory promotion is trust promotion

PMPA does not need same-turn RCE. It needs the harness to promote external content into persistent trusted state. Once written, later sessions retrieve it as “my memory,” so the privilege boundary rose at write time. Prompt defenses guard the intake; the retrieval path is a separate gate.

One judgment change tonight

Stop treating “close session / new chat” as a security boundary. Default-deny memory writes from external sources: provenance tag + user confirm before persist; refuse unaudited entries at retrieval for tool use. Closing the chat does not flush poisoned memory — it flushes context, not the written rule.

相关文章