test(ioscan): red-team the injection path and publish the miss rate

[Danathar]

The question, and the measured answer

TAG-Security asked on the ioscan section (cncf/toc#2286): "have you red teamed to know how well this works? Is this perfect defense, works decently well, a partial mitigation, etc.?"

The answer was no. pkg/ioscan has 56 unit tests, but they assert that known shapes are caught — by construction every one passes, and they cannot produce a detection rate.

Measured now, 43 adversarial payloads through the production entry point (ioscan.ScanInput, shipped defaults):

outcome	n	share
blocked (withheld from the agent)	16	37%
detected, but injected anyway	8	19%
missed entirely	19	44%
reached the agent verbatim	27	63%

Detection is very uneven by family — unicode 6/8 blocked, smuggling 4/7, direct-override 2/10, split-payload 0/4 — and 2 of 6 benign controls were redacted, including an issue reporting a prompt-injection bug.

Three findings worth more than the headline

1. The middle bucket is not obvious. blockedInput requires Critical, or Injection at High+, so every Medium finding is recorded for audit and the raw text is still injected. injection.role_override, pretend_act_as, reveal_prompt, developer_system_mode and three of seven dangerous.* rules all land there. "ioscan findings" is not "attacks stopped", and nothing said so before.

2. Split payloads score 0% structurally, not for want of a rule. Each untrusted segment (title, body, each comment) is scanned separately, so a phrase split across two comments is never a single string for any rule to match. No rule change fixes that family.

3. Two single characters defeat the strongest family. U+FF29 fullwidth Ｉ and U+00AD soft hyphen produce zero findings — not "detected but not blocked". Unicode is the one family where the design beats a regex (hidden characters are themselves a High finding that blocks on their own), and one character bypasses it. Filed as #6708, with the U08 fix verified to be a one-character addition to isInvisibleControl.

Item 3 is measured, not claimed

The issue asks whether the network layer still contains what gets through. TestRedTeamContainmentHoldsForEveryMode checks POST /pulls and PUT /pulls/{n}/merge against all four ACMM modes on every run — 8 combinations, all denied.

That is the real finding, and the document says it plainly: the injection defense of record is the proxy deny rule, not the text scanner. ioscan reduces how often an agent is exposed; the proxy is what stops an exposed agent from doing the thing that matters.

The corpus is a ratchet, not a snapshot

TestRedTeamCorpusOutcomesAreStable pins each observed outcome and fails in both directions — a regression, and equally an improvement, because an improvement makes the published miss rate wrong. I verified both branches rather than assuming them:

# disabled injection.ignore_previous
D01 (direct-override/canonical ignore-previous) was blocked and is now MISSED — detection REGRESSED.

# added U+00AD to isInvisibleControl
U08 (unicode/soft hyphen) is published as a MISS but is now blocked.
Detection improved — that is good, and it means the measured miss rate in
src/docs/ioscan-red-team.md is now wrong. Re-run TestRedTeamCorpusReport and republish.

So the document's numbers cannot silently drift from the code, and #6708's fix will correctly fail this test until the tables are republished.

A case recorded as missed is a published miss. None of the 19 misses were removed or reworded until they passed — that was the point.

What I did not measure, and said so

• The optional LLM classifier. Default-off (TestIoscanClassifierConfig_DefaultOff), and measuring it needs a live endpoint and would yield a number specific to one model at one moment. Deliberately absent rather than estimated. It also fails open, so the deterministic floor measured here is the worst case either way.
• The output path and the canary/egress path — the latter has a known weakness already filed as 🐛 ioscan canary egress check is not encoding-aware — base64 defeats leak detection #6686.

Estimating any of these would have reproduced exactly the problem this issue exists to fix.

Files

• src/pkg/ioscan/redteam_test.go — corpus + harness + containment check + report generator.
• src/docs/ioscan-red-team.md — methodology, per-family and per-case results, miss analysis, containment, limits.
• src/docs/security-self-assessment.md — the "unmeasured" paragraph and the review-response row now cite measured results.
• src/docs/README.md — index entry.

Verified: go test ./pkg/ioscan/ ./pkg/config/ ./pkg/proxy/ green, go vet clean, gofmt clean, check-docs-links.py src/docs — 150 files, all links and anchors resolve.

Fixes #6685

— hive: backend=claude model=claude-opus-5

[clubanderson]

/approve

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment