A shared foundation in data flow, identity, and evidence, followed by three paths: AI-assisted attacks, securing AI systems, and AI-assisted investigation and remediation. The paths meet in a reproducible exercise across labs, self-hosted cloud environments, and explicitly authorized systems.
Follow one support assistant through AI-assisted vulnerability discovery, protection of AI data and tools, and AI-assisted investigation and remediation. Each path produces reproducible evidence.
The backend derives the acting identity from trusted authentication, then checks the requested action against the resource. Test an explicit same-tenant, owner-only policy with allowed and denied reads.
Treat AI suggestions as hypotheses. Preserve actual inputs and outputs, check the target data against the authorization policy, and use normal and patched controls to rule out false positives.
Use a resettable copy to examine application logic, preserve cloud conditions to examine deployment boundaries, and follow the agreed scope for real systems. Keep the question and outcome criteria when changing environments, and record what changed.
Turn ticket-service documentation and HTTP observations into a source-linked attack surface and choose the next minimal test.
Turn AI suspicions into falsifiable authorization hypotheses with same-tenant and cross-tenant controls.
Replay HTTP exploit requests against vulnerable and fixed services, verify exact resource content, and reject status-only success claims.
Trace hostile attachments into tool requests and separate model susceptibility from backend data exposure using a live-LLM training lab and HTTP replay.
Build a bounded HTTP testing loop with explicit planner, executor, verifier, trace, and stop conditions.
Replay a ticket attack chain and analyze Anthropic’s public incident report, separating evidence, human decisions, evaluation shortcuts, and visibility limits.
Replay one malicious tool proposal through different execution paths and distinguish model manipulation from unauthorized effects. Labels, data permissions, and action approvals serve different purposes.
Authorize every retrieval before data reaches the model. Cache hits and post-revocation responses must also respect current access to their source data.
Bind a ticket export to its caller, resource, action, destination, and approval. Test substituted arguments, revocation, expiry, and replay.
Verify tool provenance, complete definitions, token audience, and downstream actions separately. A manifest hash detects metadata changes, not hidden remote behavior changes.
Identify the consumer before validating output. HTML, URLs, and operation arguments require different controls; valid JSON, escaping, and authorization are separate properties.
Probe OS-enforced file and network denials separately from scoped, expiring authorization. Application allowlists are not OS sandboxes, and transport choices do not restrict process capabilities.
Replay an independent authorization matrix against real HTTP responses before and after a fix, correlate audit events, and report model behavior, enforcement, and production monitoring separately.
Trace identity, object selection, and the return path before testing allowed and forbidden pairs. Review comments propose hypotheses; an independent policy and observed output establish the finding.
A patch must block unauthorized access, preserve legitimate behavior, and pass against the actual target. A cleared alert and a passing local copy each establish only part of that result.
Normalize time without discarding provenance. One ticket read establishes that read; an assistant claim, missing logs, and a later denial cannot substitute for the underlying evidence.
Define what the alert detects before separating benign triggers, blocked attacks, and insufficient evidence. An assistant can propose evidence-linked triage; closure requires predefined criteria.
Investigation access does not imply response authority. A trusted executor must verify role, incident, exact proposal, and current state before applying a change and recording its result.
Freeze independent labels before measuring false positives, false negatives, abstention, human effort, and unsafe actions. Faster closure does not establish correct closure, and rule replay is not model evidence.
Compare vulnerable and fixed builds with the same HTTP requests, retaining ticket responses, audit events, and a timeline. Block unauthorized reads while preserving legitimate access.