Context
UK AI Open Code Risk & Resilience Governance run (2026-08-14, 7-day lookback) — see discussion report for full analysis.
Tier
Tier B — Open With Conditions
Risk-scoring breakdown
| Dimension |
Rating |
| Exposure amplification |
High (privileged KVM access) |
| Patchability |
Medium (preview, compile-time gated) |
| Detectability |
Medium (new code, less battle-tested) |
| Operational fragility |
Medium |
| Ownership confidence |
Medium |
| Overall |
Medium-High |
Finding
This week's commits merged the preview Cloud Hypervisor runtime support for sandbox.agent.runtime (#52119, #52588), introducing: privileged strict-isolation AWF host invocation, scoped KVM access, a verified virtiofsd release bundle contract, MCP gateway topology, guest sizing, and timeout propagation. Unsupported combinations are now rejected at compile time, which is a good control, but the privilege level (KVM) and newness of this code path amplify blast radius if a flaw is present.
Remediation action
Conduct a dedicated security review of the privileged sandbox runtime path before wider rollout: confirm KVM access scope is minimal, virtiofsd bundle verification is enforced (not just contractually described), and MCP gateway topology cannot be used to escalate privileges or bypass isolation. Recommend a human-review trigger given the privilege-escalation surface.
SLA urgency
High — target review within 14 days given preview status and limited current exposure, but before broader/GA rollout.
Report
See the full UK AI Open Code Risk & Resilience Governance discussion report generated in this run for asset graph, control verification, and full remediation queue.
Generated by UK AI Operational Resilience · auto · 51.5 AIC · ⌖ 2.25 AIC · ⊞ 8.7K · ◷
Context
UK AI Open Code Risk & Resilience Governance run (2026-08-14, 7-day lookback) — see discussion report for full analysis.
Tier
Tier B — Open With Conditions
Risk-scoring breakdown
Finding
This week's commits merged the preview Cloud Hypervisor runtime support for
sandbox.agent.runtime(#52119, #52588), introducing: privileged strict-isolation AWF host invocation, scoped KVM access, a verified virtiofsd release bundle contract, MCP gateway topology, guest sizing, and timeout propagation. Unsupported combinations are now rejected at compile time, which is a good control, but the privilege level (KVM) and newness of this code path amplify blast radius if a flaw is present.Remediation action
Conduct a dedicated security review of the privileged sandbox runtime path before wider rollout: confirm KVM access scope is minimal, virtiofsd bundle verification is enforced (not just contractually described), and MCP gateway topology cannot be used to escalate privileges or bypass isolation. Recommend a human-review trigger given the privilege-escalation surface.
SLA urgency
High — target review within 14 days given preview status and limited current exposure, but before broader/GA rollout.
Report
See the full UK AI Open Code Risk & Resilience Governance discussion report generated in this run for asset graph, control verification, and full remediation queue.