[Dream Cycle 2026-05-26] security: Indirect prompt injection critical gap vs OWASP ASI01 + intelligence,swarm scan

## Tonight's Rotation

| Field | Value |
|-------|-------|
| **SLOT** | 1 |
| **DEEP surface** | security |
| **SCAN surfaces** | intelligence, swarm |
| **Session commit** | `60f37f2d37a342866d9d4f66a257ec1166a21794` |
| **Date** | 2026-05-26 |

---

## Drift Check

- **Prior dream-cycle issues:** 0 (first night — no prior issues found)
- **Prior self-score:** N/A (no prior gist)
- **Drift flags:** None
- **needs-merge flag:** N/A (first run)

---

## Deep Dive Findings — Security

### SOTA Summary (2026)

The OWASP Top 10 for Agentic Applications 2026 (released Dec 2025, 100+ contributors) ranks **ASI01 — Agent Goal Hijacking** as the #1 risk: attackers embed malicious instructions in content that agents retrieve autonomously (MCP tool responses, memory entries, web fetches, emails, documents). The LLM cannot reliably distinguish instructions from data.

A Jan 2026 systematic review of 78 studies (arXiv:2601.17548) shows adaptive attack strategies achieve **>85% bypass rates** against current SOTA defenses in agentic coding systems. Four defense categories have emerged: training-based, detection-based, prompt augmentation, and system-level. System-level (per-tool-call guardrails) is the only category with sub-millisecond latency impact and no model dependency.

OpenAI Agents SDK (March 2025) is the current best-in-class implementation: parallel-execution guardrails at every tool boundary (input, output, per-invocation) with no critical-path latency penalty.

### Gap vs Current Ruflo

Ruflo's `@claude-flow/security` has strong transport/boundary security (InputValidator, PathValidator, SafeExecutor, PasswordHasher, TokenGenerator) but **zero semantic screening of content returned by MCP tools, memory reads, or external API calls** before that content enters agent reasoning. An attacker influencing any retrieved content can inject adversarial instructions with no current defense.

Additionally, OWASP's ASI01–ASI10 risks have **not been mapped** to Ruflo controls — no compliance matrix exists.

### Recommended Action

Implement `ToolOutputGuardrail` class (ADR-131) with pattern-matching at MCP tool result boundary and memory read path. Separately produce `v3/docs/security/owasp-agents-2026-mapping.md` compliance matrix.

---

## Scan Findings — Intelligence

**Source:** arXiv:2503.07686 (adaptive routing), AgentRouter paper (arXiv:2510.05445), Google ADK docs.

**Competitive signal:** Google ADK now supports hierarchical multi-agent structures with automatic routing by capability description. Knowledge-graph-based routing (AgentRouter) outperforms capability-description routing by producing task-aware distributions over agents.

**Finding:** Ruflo's 3-tier model routing (ADR-026) is task-complexity-based only. It has no knowledge-graph awareness for optimal agent selection. Adding KG-augmented routing to the `route` hook is a tractable improvement — no ADR yet needed (implementation-level enhancement).

---

## Scan Findings — Swarm

**Source:** arXiv:2508.00622 (SwarmRaft), arXiv:2601.17303 (DMAS).

**Competitive signal (C — pre-print signal only):** SwarmRaft extends Raft consensus with spoofing detection and sensor-validity filtering, identifying consensus payload injection as a new swarm threat vector.

**Finding:** Ruflo uses Raft consensus for hive-mind (ADR-103 witness temporal history, ADR-104 federation wire transport) but the consensus proposal pipeline does not validate whether state-transition payloads contain injected content. This is the swarm-layer manifestation of the same ASI01 gap identified in the deep dive. Addressed by ADR-131 P1 integration point.

---

## Competitors Reviewed

| Framework | Indirect Injection Defense | Per-Tool Guardrail | OWASP Alignment | Security Posture |
|-----------|--------------------------|-------------------|-----------------|-----------------|
| **Ruflo** | None (gap) | None | Not mapped | Strong transport; weak semantic |
| **OpenAI Agents SDK** | Input + output + tool guardrails, parallel | Yes — every invocation | Implicit | Best-in-class |
| **LangGraph v0.4** | HITL checkpoints only | No | Partial | Relies on human review |
| **CrewAI Enterprise** | SOC 2 / HIPAA compliance; observability hooks | No | SOC 2 partial | Strong compliance |
| **AutoGen 1.0 GA** | Security patches; MS focus shifting | No | Not published | Declining investment |

---

## Gist Link

`v3/docs/research/dream-cycle-2026-05-26-security.md` (committed to branch `dream/2026-05-26-security`)

_No public gist URL — running without gh CLI gist support in this environment. Gist content is committed to the branch for auditability._

---

## Witness

| Field | Value |
|-------|-------|
| **Session commit** | `60f37f2d37a342866d9d4f66a257ec1166a21794` |
| **Gist SHA-256** | `30f8be8703b0e54dc394bf0bac516eca3181e49d333a338f017c24848a281d35` |
| **Witness stamp** | `315b50204819aaece8ceb464c2c8ddf2c248bc6ea4bd23772fea5b0d34b9fe1c` |
| **Verifier** | `sha256sum dream-cycle-2026-05-26-security.md` → concat session commit → `sha256sum` → must equal witness stamp |