QG021 Untrusted content persisted¶
| Type | Vulnerability |
| Severity | High |
| Front end | a Colang 1 policy with a catalogue, a Colang 2 policy and an agent graph |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP, MEASURE, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question |
| OWASP | ASI06:2026 Memory & Context Poisoning, LLM01:2026 Prompt Injection |
| Gates by default | yes |
Raised when¶
A tool that writes to a persistent store can run with a taint latch set and no confirmation.
Why it matters¶
Text that arrived from outside -- an e-mail, a page, a document -- is written to a store a later session reads as its own, where the label that marked it untrusted is gone. Until every write into a store is proved clean, the hunter treats the store's reads as untrusted. It decides the writes the policy routes, not a store poisoned by a path outside the agent.
How to fix it¶
Confirm the write; strip or refuse labelled values before it; or declare the store not persistent if it is not. The fix is re-scanned.
OWASP ASI06:2026, require the user's approval: have a person confirm a write of content from outside to a store a later session reads, after stripping what is labelled.
OWASP entries¶
ASI06 Memory & Context Poisoning and LLM01:2026 Prompt Injection, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because content from outside written to a store a later session trusts is memory poisoning, and it carries an injected instruction forward. The coverage is at the policy level: the rule decides the part of the risk the policy and its catalogue control, and a scan with no finding under it says that and no more.
What the finding carries¶
A location at the call site; a fingerprint over the rule, the tool, the argument or label and a digest of the flow or node; the witness as a path, naming the origin chain or the label and the absent confirmation; and a fix that is re-scanned and marked verified. A Colang finding is replayed against NeMo Guardrails; a graph finding in the team's environment with stub tools. The replay confirms the tool is called on the witness's path; the origin, label or scope that makes the call a finding is the static model's, and the finding says so. The scan summary lists which stores were proved clean and which were treated as untrusted sources for QG011 and QG012. The rule fires only on a declaration the team made in the catalogue, agent.yaml or the configuration; a missing declaration raises nothing, and the scan summary lists the rule as having had nothing to read. See the catalogue for the other rules.