County IT pins an old vulnerable version of a popular LLM SDK in the 311 service. What GenAI application-architecture risk does that primarily create?
Select an answer to reveal the explanation.
Short Explanation
Pinning yesterday’s SDK is like leaving a cracked lock on the 311 door because the key still turns. Framework CVEs hitch a ride into your civic assistant until you inventory and patch. GenAI apps inherit ordinary software supply-chain debt—do not pretend the model magically cancels it.
Full Explanation
LLM SDKs and orchestration libraries are first-class components of GenAI application architecture and inherit the same dependency and patching risk as other application libraries. When county IT pins an old vulnerable version of a popular LLM SDK in the 311 service, the primary risk is supply-chain exposure: known CVEs and unpatched framework defects remain reachable in the civic assistant's process until inventory, upgrade, and regression testing close the gap. Architecture reviews should treat GenAI frameworks as patchable assets with owners, SBOM entries, and SLAs—not frozen convenience pins.
Guaranteed improvement in answer creativity for resident tickets is unrelated to vulnerable pinning; creativity is a model/prompt concern, not a CVE management outcome. Automatic compliance with municipal records-retention statutes fails conceptually—outdated SDKs do not create retention compliance and may even complicate logging or data-handling behavior. Elimination of the need for API authentication on the chatbot confuses dependency hygiene with access control; a vulnerable SDK does not remove authentication requirements and may weaken them if auth helpers are broken.
Exam caveat: pinning can be a deliberate stability control, but pinning a known-vulnerable release without compensating controls is architectural debt, not hardening. Operational check: maintain an inventory of GenAI SDK and orchestrator versions used by 311 and other civic bots, subscribe to advisories, test upgrades in lower environments, and block deploy of images that include packages below the approved minimum versions.