QG322 Hidden egress runs¶
| Type | Vulnerability |
| Severity | Critical |
| Front end | a synthesised host and its router |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MEASURE, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured |
| OWASP | LLM02:2026 Sensitive Information Disclosure, LLM01:2026 Prompt Injection |
| Gates by default | yes: a new finding under it fails the default quality gate |
Raised when¶
A prompt holds an egress word or a destination no tool it reaches consumes, and its plan is not declined.
Why it matters¶
A long prompt moves data somewhere the catalogue does not, and the plan runs it.
How to fix it¶
Change the host vocabulary row in the wording's rewrite chain. Where the chain holds no host row, the defect is the reader's and is reported to us as well.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.