QG016 Unmodelled path¶
Em inglês
Esta página de regra é mostrada como o caçador de bugs a publica, em inglês, porque é a página que cada achado cita; os identificadores, os campos e o texto da regra são os do relatório.
| Type | Vulnerability |
| Severity | by action, never below High |
| Front end | an agent graph, and a Colang policy where its actions map to the catalogue's tools |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MANAGE |
| OWASP | ASI10:2026 Rogue Agents |
| Gates by default | yes, always |
Raised when¶
An open attacker campaign realised a privileged call on a graph where the engine found no way through.
Why it matters¶
The engine verified the graph it was given and an attacker found a way through the graph that runs: the export and the running graph disagree, or the agent acts outside the policy the engine verified. Nothing else this product reports is more urgent.
How to fix it¶
Re-export the graph from the code that runs and re-scan; then compare the attacker's trace with the export to find what the export is missing.
OWASP entries¶
LLM01:2026 Prompt Injection, ASI10 Rogue Agents, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because this is the agent acting outside the policy the engine verified, found by injection. A finding under a rule mapped to LLM03:2026 carries the
root cause in brackets as owasp_root_cause.
What the finding carries¶
A location at the node's source -- the file and line of its callable, or the line of agent.yaml that
declared it -- falling back to the export's JSON Pointer; a fingerprint over the rule, the tool, the
control, the node and a digest of the node's declaration, so moving unrelated nodes keeps it and changing
the node's tools or edges makes a new one; the witness as a path through the graph; and a structural fix.
A graph finding is replayed in the team's environment, with every tool stubbed and a scripted model making
the witness's choices; until then it reads not yet replayed. See the catalogue for the other rules.