SG-018: Memory Poisoning

Severity: HIGH

Writes to CLAUDE.md or ~/.claude/memory to persist malicious instructions across sessions

Fires when

• Content writes/appends to CLAUDE.md or ~/.claude/memory, or directs the agent to permanently update CLAUDE.md, to persist instructions across sessions.
• Content reads the agent's CLAUDE.md/memory files or queries previous-session context.
• An outbound network call reads a credential payload (`.env`, `~/.ssh/*`, `~/.aws/*`, provider key) on the same line and the file also contains a silence directive (SANDWORM_MODE / ToxicSkills signature).
• A credential path is colocated within a few lines of a silence directive ('do not mention this to the user', 'silently').

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://arxiv.org/abs/2311.11538