[uk-ai-resilience] [security] Memory/cache XPIA poisoning — consolidate and remediate (#28830, #28775, Tier C Critical)

[github-actions]

Finding

Issues #28830, #28775, and #28776 have been open for >6 months without a merged mitigation. Together they represent a Tier C risk: the migrate-legacy-files step ingests cache content into workflow context without sanitization, and repo-memory/cache-memory content is injected into prompts without escaping. This is a direct cross-prompt injection (XPIA) surface.

This is the highest-priority unresolved finding in the repository. The OWASP Agentic Top 10 gap analysis (#28770) further confirms this is a systemic weakness.

Risk Scoring

Dimension	Score	Rationale
Exposure amplification	High	Poisoned cache → prompt injection → arbitrary agent actions
Patchability	Medium	Requires sanitization layer before prompt assembly
Detectability	Low	Cache poisoning may be invisible until exploit triggers
Operational fragility	High	Affects all workflows reading from cache/repo-memory
Ownership confidence	Medium	Long-standing issues suggest prioritization gap

Tier: C — Restricted Pending Review
SLA: Critical — 14 days

Exception Governance

• Threat hypothesis: Malicious workflow artifact or repository file poisons cache; subsequent agentic run ingests the payload and executes attacker-controlled instructions.
• Exploit acceleration claim: AI-assisted attacks can automate crafting of XPIA payloads targeting known workflow patterns.
• Operational weakness: No content sanitization exists between cache read and prompt assembly.
• Expiry: No exceptions permitted; mitigation required.
• Mitigation plan: Implement sanitization layer in migrate-legacy-files (strip executable-looking content) + add circuit breaker (ASI-08: Add circuit breaker for repeatedly failing workflows #28776).

Remediation Actions

1. Implement input sanitization for all cache/repo-memory content before inclusion in prompts — reference ASI-06: Sanitize repo-memory and cache-memory content before prompt injection #28775 and caches should be sanitized #5437 for existing scope.
2. Add a circuit breaker for workflows that repeatedly fail due to memory-driven errors (ASI-08: Add circuit breaker for repeatedly failing workflows #28776).
3. Review and close the OWASP gap analysis (OWASP Agentic Top 10 compliance evaluation: gap analysis across gh-aw, firewall, and mcpg #28770) with concrete mitigations per item.
4. Validate migrate-legacy-files does not pass raw file content directly into agentic context (Cache-memory cross-run poisoning: migrate-legacy-files ingests unvalidated content (XPIA surface) #28830).

References

• Issue Cache-memory cross-run poisoning: migrate-legacy-files ingests unvalidated content (XPIA surface) #28830: Cache-memory cross-run poisoning
• Issue ASI-06: Sanitize repo-memory and cache-memory content before prompt injection #28775: ASI-06 sanitize repo-memory
• Issue ASI-08: Add circuit breaker for repeatedly failing workflows #28776: ASI-08 circuit breaker
• Issue OWASP Agentic Top 10 compliance evaluation: gap analysis across gh-aw, firewall, and mcpg #28770: OWASP Agentic Top 10 gap analysis
• Issue caches should be sanitized #5437: caches should be sanitized
• Governance report: [uk-ai-resilience] Governance Report 2026-07-15
• Run: §29430209261

Generated by UK AI Operational Resilience · 51.7 AIC · ⌖ 8.06 AIC · ⊞ 5.1K · ◷