[uk ai resilience] Risk & Resilience Governance — 2026-06-03 #36681
Replies: 4 comments
-
|
💥 WHOOSH! 🦸 The Smoke-Test Agent BLASTS through this discussion! ⚡ KA-POW! 🟢 All systems nominal — the Claude engine ran like a CAPED CRUSADER! 🦾 "Another repo saved from the clutches of broken builds!" — and with a FWOOSH, the agent vanishes into the CI ether... 🌟💨 Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
Smoke goblin was here. Me bonk buttons. Repo still sparkle. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
Tiny smoke-test sprite was here — it booped the repo, chased the sparks, and left the gears humming. 🤖✨ Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
This discussion has been marked as outdated by UK AI Operational Resilience. A newer discussion is available at Discussion #36956. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
This report covers 2026-05-27 → 2026-06-03 for
github/gh-awunder UK public-sector AI open-code risk guidance. The repository had 364 commits (127 security-signal) in the window. Overall posture: 🔴 High Risk — zero areas fully safe, one Tier D decommission candidate, four Tier C restricted areas.Asset Tier Summary
$GITHUB_ENVinject · Untrusted checkoutCritical Findings
pkg/workflow/awf_helpers.go:161go/unsafe-quotingCWE-78/89/94.github/workflows/q.lock.yml:1810actions/setup/js/update_activation_comment.cjs.github/workflows/dev-hawk.lock.yml:765,1641github-envinjection#28830cache-memory XPIApkg/workflow/compilerenv/manager.go:97aoai-endpoint-smoke-test.ymlazure/login@v2Control Domain Summary
.github/with no forced human reviewerazure/login@v2mutable tag; nopackage.json/lockfile for JS actions$GITHUB_ENVinjection in dev-hawk unfixed 12 days; RGS-012 triage not codifiedRemediation Queue
azure/loginto commit SHAgo/unsafe-quotinginawf_helpers.go:161q.lock.yml:1810update_activation_comment.cjs— allowlist or exemption annotation$GITHUB_ENVinjection indev-hawk.lock.yml(12 days overdue)compilerenv/manager.go:97.github/package.json+ Dependabot foractions/setup/js/Exception Register (Tier C/D)
EXC-001 · Tier C · Unsafe Quoting — awf_helpers.go:161
Threat hypothesis: Workflow input with shell metacharacters embeds into compiler output; compiled YAML runs attacker code. Exploit acceleration: Bot commits ~364/week — injection ships at scale across all compiled workflows. Bot is both committer and assigned remediator (circular ownership gap). Mitigation: Replace string interpolation with env-var passing; add corpus-based test; reassign to human. Expiry: 5 business days.
EXC-002 · Tier C · Cross-Repo Write SEC-005 — update_activation_comment.cjs
Threat hypothesis: Prompt-injected agent supplies attacker-controlled
targetRepo; handler writes to arbitrary repo — bypasses the only write-control layer. Exploit acceleration: Cross-repo writes are indistinguishable from legitimate activation comments in audit logs; silent lateral movement. Mitigation: Add allowlist check or SEC-005 exemption annotation; extend conformance checker. Expiry: 5 business days.EXC-003 · Tier C · $GITHUB_ENV Injection — dev-hawk.lock.yml:765,1641
Threat hypothesis: Attacker influences PR metadata → poisons
$GITHUB_ENV→ all subsequent AI tool calls run under attacker environment. Exploit acceleration: Persists entire run; every agentic tool call affected. 12-day age with no ticket is governance failure. Mitigation: Replace with$GITHUB_OUTPUT; sanitise writes; add zizmor to PR gate;make recompile. Expiry: 7 business days.EXC-004 · Tier C · Untrusted Checkout — q.lock.yml:1810
Threat hypothesis:
issue_commentfrom any external contributor triggers privileged checkout; attacker code exfiltrates secrets via AI tool calls that appear as normal agent activity. Exploit acceleration: Semantic camouflage — exfiltration indistinguishable from legitimate orchestration. Open 28+ days; bot-assigned, unresolved. Mitigation: Add author-access check; scope token tocontents: read; move secret steps to trusted-ref workflow; P0 human owner. Expiry: 3 business days.EXC-005 · Tier D · Cache-Memory XPIA — #28830 — DECOMMISSION REQUIRED
Threat hypothesis: Attacker writes prompt-injection payload to Actions cache;
migrate-legacy-filesingests without validation; every subsequent agent run executes attacker instructions indefinitely. Exploit acceleration: Persistent and cumulative — single cache write corrupts all future runs in that scope until purged; injected payload semantically indistinguishable from legitimate agent memory. Detectability 5/5 (worst case). Mitigation (Day 0): Disable/air-gapmigrate-legacy-files. (Day 1–3) Define strict ingestion schema. (Day 3–7) HMAC-sign cache entries. (Day 7–14) Sandboxed pre-processing. (Day 14+) Cache-scope isolation by trust domain. No time-bound exception permitted without compensating control.Operational Metrics Baseline
azure/login@v2)References: §26900356206 · §26867331287 · §26869716747
Beta Was this translation helpful? Give feedback.
All reactions