[uk-ai-resilience] [security] Escalate: XPIA cache-memory poisoning unresolved >6 months — implement sanitization layer (Tier C [Content truncated due to length]

[github-actions]

Escalation Notice

This is an escalation of #45777 which has been open since July 2025 (>6 months). The XPIA cache-memory poisoning surface remains unmitigated and is the highest composite risk (8.5/10) finding in this week's UK AI governance assessment.

Tier & Risk Scoring

Dimension	Score
Tier	C — Restricted Pending Review
Composite Risk	8.5 / 10
Remediation Priority	Critical
SLA	14 days (by 2026-08-04)
Exposure amplification	5/5 — cross-run agentic poisoning with AI autonomy multiplier
Patchability	2/5 — requires architectural sanitization layer
Detectability	2/5 — poisoned cache content is silent until triggered

Description

The migrate-legacy-files path and cache-memory ingestion layer in pkg/workflow/cache.go reads content from prior agentic runs without validation. An adversarial workflow run could write crafted content to cache memory that, on subsequent runs, is injected into LLM prompts without sanitization — a classic cross-run XPIA (Cross-Prompt Injection Attack).

Related issues: #28830 (cache-memory cross-run poisoning), #28775 (sanitize repo-memory and cache-memory content).

Why This Is an Escalation

• Age: Open since ~July 2025 — MTTR proxy is >6 months, well beyond the 30-day Tier C target.
• AI amplification: gh-aw runs agentic pipelines with actions: write, issues: write, and pull-requests: write permissions. Poisoned cache feeding into LLM prompts could cause the agent to take unauthorized destructive actions.
• No mitigation in place: No sanitization, no allowlist, no content-integrity check exists on cache reads.

Required Remediation Actions

1. Short-term (7 days): Add content length and format validation on cache memory reads; reject entries exceeding reasonable bounds or containing obvious injection patterns.
2. Medium-term (14 days): Implement a sanitization layer that strips or escapes prompt-injection patterns before cache content is appended to LLM context.
3. Long-term: Introduce content-integrity signatures for cache entries so runs can verify they're reading their own prior output, not adversarially injected content.
4. Document threat model and mitigations in an ADR.

Exception Governance

• Threat hypothesis: Adversarial workflow run writes crafted cache content; subsequent run injects it into AI model context without sanitization.
• Exploit acceleration: High — agentic pipelines with write permissions are prime targets for prompt injection.
• Operational weakness: No sanitization layer on cache reads.
• Exception expiry: 2026-08-07 (must have at minimum short-term mitigation by this date).
• Mitigation plan: See remediation actions above.

References:

• §29846286340
• Parent: [uk-ai-resilience] [security] Memory/cache XPIA poisoning — consolidate and remediate (#28830, #28775, Tier C Critical) #45777, Cache-memory cross-run poisoning: migrate-legacy-files ingests unvalidated content (XPIA surface) #28830, ASI-06: Sanitize repo-memory and cache-memory content before prompt injection #28775

Generated by UK AI Operational Resilience · sonnet46 88.1 AIC · ⌖ 6.03 AIC · ⊞ 5.2K · ◷