A purple-team review finds the permitting AI service runs on an outdated container base image with unpatched libraries. What infrastructure supply-chain issue should the report emphasize?

When a purple-team review finds the permitting AI service running on an outdated container base image with unpatched libraries, the report should emphasize container and base-image hygiene as civic AI infrastructure supply-chain risk. Municipal AI applications inherit CVEs from OS packages, language runtimes, and shared libraries baked into the image. An unpatched base under a permitting model is still an attack surface against the civic workload even if the model weights themselves are sound. The finding therefore belongs in the infrastructure supply-chain section: image currency, CVE tracking, rebuild cadence, signed images, and least-privilege runtime—not only model or prompt reviews.

Retraining the permit classification model on recent application outcomes improves model accuracy but does not remediate vulnerable libraries in the AI container. Enforcing signed commits for civic planning code repository contributors protects code provenance but does not address unpatched libraries in the container base image. Configuring registry pull-through caching to speed permit service redeployments citywide improves deployment speed but does not patch the vulnerable base image or improve its hygiene. Each distractor shifts attention to model retraining, repository commits, or registry caching instead of the unpatched base image, so none answers the supply-chain finding.

Exam caveat: base-image hygiene is necessary but not sufficient; civic AI supply-chain risk also includes model artifacts, plugins, and training data. Do not treat 'patch the image' as a substitute for model integrity controls—but equally, do not ignore containers because the workload is labeled AI. Purple-team findings should map CVEs to exploitability in the municipal deployment context (exposure of the permitting API, secrets in the container, lateral movement paths).

Operational check: inventory the permitting AI image digests, compare base tags against current hardened city standards, confirm automated rebuilds on CVE publication, and verify that production only pulls signed images from the municipal registry. Require the report to list unpatched CVEs with severity and an owner for rebuild. If the service still runs a months-old public base with known remote exploits, treat that as an open supply-chain finding against civic AI infrastructure until remediated and revalidated.