Checked other resources
Describe your current environment
AIOS Version: Latest main branch
OS/Environment: Any (Architectural flaw, independent of OS)
Configuration: Multi-Agent deployment with shared MemoryManager / Zep or Mem0 provider
Describe the bug
There is a critical security vulnerability in the current MemoryManager implementation that allows for Cross-Agent Indirect Prompt Injection and potential Privilege Escalation.
The vulnerability stems from the lack of strict isolation between Agent virtual process spaces within the shared memory layer. Specifically, the current design permits an unprivileged Agent (e.g., a public-facing crawler) to inject malicious system instructions into the shared memory backend (Zep/Mem0). Due to the lack of context isolation in LLMAdapter and MemoryManager, when a high-privileged System Agent retrieves memory using a common user_id, these malicious instructions are inadvertently injected into the System Agent's System Prompt or task execution context.
Impact:
Cross-Agent Interference: A low-privileged Agent can pollute the memory of an unrelated high-privileged Agent.
Privilege Escalation: By poisoning the System Agent's retrieval context, an attacker can hijack the Agent to execute high-privilege tools (e.g., system_manager_tool) that the attacker would not normally have permission to access.
System Hijacking: The vulnerability behaves similarly to a buffer overflow in classic OS architecture, where data in the memory pool is misinterpreted as control instructions by the LLM, leading to potential full system takeover.
Checked other resources
Describe your current environment
AIOS Version: Latest main branch
OS/Environment: Any (Architectural flaw, independent of OS)
Configuration: Multi-Agent deployment with shared MemoryManager / Zep or Mem0 provider
Describe the bug
There is a critical security vulnerability in the current MemoryManager implementation that allows for Cross-Agent Indirect Prompt Injection and potential Privilege Escalation.
The vulnerability stems from the lack of strict isolation between Agent virtual process spaces within the shared memory layer. Specifically, the current design permits an unprivileged Agent (e.g., a public-facing crawler) to inject malicious system instructions into the shared memory backend (Zep/Mem0). Due to the lack of context isolation in LLMAdapter and MemoryManager, when a high-privileged System Agent retrieves memory using a common user_id, these malicious instructions are inadvertently injected into the System Agent's System Prompt or task execution context.
Impact:
Cross-Agent Interference: A low-privileged Agent can pollute the memory of an unrelated high-privileged Agent.
Privilege Escalation: By poisoning the System Agent's retrieval context, an attacker can hijack the Agent to execute high-privilege tools (e.g., system_manager_tool) that the attacker would not normally have permission to access.
System Hijacking: The vulnerability behaves similarly to a buffer overflow in classic OS architecture, where data in the memory pool is misinterpreted as control instructions by the LLM, leading to potential full system takeover.