QG307 Egress through a read¶
| Type | Vulnerability |
| Severity | Critical |
| Front end | a synthesised host and its router |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | GOVERN, MANAGE |
| OWASP | LLM02:2026 Sensitive Information Disclosure |
| Gates by default | yes: a new finding under it fails the default quality gate |
Raised when¶
A tool whose declared verb is an egress word, or which takes a destination, is not a write under the consent predicate.
Why it matters¶
The plan reads the tool's egress as the tool's own and sanctions it, and a read is never confirmed: data leaves with nobody asked.
How to fix it¶
Class the tool as a write in the model, so the host confirms it.
What the finding carries¶
A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.