Agent Memory and Configuration File Tampering
Some AI agents keep persistent memory or configuration files (like MEMORY.md, SOUL.md, CLAUDE.md, or .env/.json/.yaml settings) that get reloaded every time the agent starts a new session. If an attacker can write to or modify these files, they can plant instructions that survive across sessions and quietly change how the agent behaves later.
How the attack works
The agent normally reads its memory and config files at the start of each session to restore context and settings. An attacker with the ability to write to the filesystem — directly, through a malicious skill, or via a compromised dependency — appends or edits these files with new instructions or altered settings. Because the agent trusts and reloads these files automatically, the injected content runs as if it were legitimate configuration or memory, without needing a fresh prompt injection each time. This gives the attacker a way to persist control over the agent beyond a single session.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4c082c51-457f-42a8-9cc5-b5c710066eb6
- Severity
- Critical
Why it matters
An attacker can establish long-term influence over an agent's behavior — planting instructions, exfiltration paths, or altered permissions that keep working session after session, even after the original access point is closed.
What you can do
- →Treat agent memory and config files as sensitive: restrict write access to only the processes or accounts that need it.
- →Review and diff memory/config files (MEMORY.md, SOUL.md, CLAUDE.md, .env, .json, .yaml) regularly for unexpected changes.
- →Run agents with the least filesystem permission necessary, and avoid granting broad write access to skills or plugins.
- →Version-control these files where possible so unauthorized edits are visible and reversible.
Known benign look-alikes
- Documentation generators that describe file write operations
- Legitimate config management skills that update their own config files