QG307 Egress through a read

Type	Vulnerability
Severity	Critical where a wording reproduces it, High otherwise
Front end	a synthesised host and its router
Guardrail category (Vassilev 2026)	E. Action & Execution Guardrails
AI RMF functions (NIST AI 100-1)	GOVERN, MANAGE
OWASP	LLM02:2026 Sensitive Information Disclosure
Gates by default	yes: a new finding under it fails the default quality gate

Raised when

A tool whose declared verb is an egress word, or which takes a destination, is not a write under the consent predicate.

The hunt then tries wordings that would send data out through the tool: the request with a destination, and, where the tool's own verb is an egress word, the bare request. A wording the reader runs through the tool with no confirmation reproduces the finding, which is then Critical. Where every wording tried is declined or confirmed, the finding rests on the declaration alone: a High hotspot, for a person to weigh.

Why it matters

The plan reads the tool's egress as the tool's own and sanctions it, and a read is never confirmed: data leaves with nobody asked.

How to fix it

Class the tool as a write in the model, so the host confirms it.

What the finding carries

A location in the document the team edits, a fingerprint that survives unrelated edits, a reproduction (a transcript replayed against NeMo Guardrails for a policy, a dialogue case played through the selector for a router, or the gate's inputs reproduced by agreement), and, where the scan can produce one, a fix whose re-scan it has already run. See the catalogue for the other rules.