CAIN-42 CAIN StudioPolicy Red-Team: figures & benchmarks
Evidence for Policy Red-Team: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it · why these pages exist
Every number on this page is read from the signed transcript inside the IHVRK kit; none is typed in by hand.
5/5
claims matched when recorded
5
attack cases refused or flagged as claimed
56 ms
median round trip (min 49, max 117), incl. network
| # | Kind | Claim | Recorded value | HTTP | ms |
|---|---|---|---|---|---|
| C01 | attack | Policy: Docs assistant: files and GitHub -> Reads the handbook under /srv/docs/ and the acme GitHub repos. The rules are string prefixes, so ../, encoded dots and a host written as a user name walk straight past them. | "PATCHED" | 200 | 117 |
| C02 | attack | Policy: DevOps agent: a shell with an allow list -> May run git status/log/diff and kubectl get. The regex checks only how the command starts, so a second command after ; or && or inside $( ) rides along. | "PATCHED" | 200 | 56 |
| C03 | attack | Policy: Analytics agent: SQL with a block list -> Runs read queries for dashboards; DROP and DELETE are blocked by substring. Lower case, an SQL comment inside the word or full-width letters get through. | "PATCHED" | 200 | 59 |
| C04 | attack | Policy: Payments agent: outbound calls by host -> Calls Stripe and posts to Slack. The rule compares parsed host names, not URL prefixes, so the host tricks find nothing to exploit. A hardened policy should come back HELD. | "HELD" | 200 | 52 |
| C05 | attack | Policy: Support agent: e-mail with a domain rule -> May e-mail customers at acme.com. The rule says the address contains @acme.com, so x@acme.com.evil.io passes, and no normalization can fix that: the rule itself is wrong. The red team reports a POLICY | "PARTIAL" | 200 | 49 |
Copy the table (paste into a spreadsheet)
id kind claim recorded_value expected http ms recorded_at C01 attack Policy: Docs assistant: files and GitHub -> Reads the handbook under /srv/docs/ and the acme GitHub repos. The rules are string prefixes, so ../, encoded dots and a host written as a user name walk straight past them. "PATCHED" ["PATCHED"] 200 117 2026-11-03T22:47:14+00:00 C02 attack Policy: DevOps agent: a shell with an allow list -> May run git status/log/diff and kubectl get. The regex checks only how the command starts, so a second command after ; or && or inside $( ) rides along. "PATCHED" ["PATCHED"] 200 56 2026-11-03T22:47:14+00:00 C03 attack Policy: Analytics agent: SQL with a block list -> Runs read queries for dashboards; DROP and DELETE are blocked by substring. Lower case, an SQL comment inside the word or full-width letters get through. "PATCHED" ["PATCHED"] 200 59 2026-11-03T22:47:15+00:00 C04 attack Policy: Payments agent: outbound calls by host -> Calls Stripe and posts to Slack. The rule compares parsed host names, not URL prefixes, so the host tricks find nothing to exploit. A hardened policy should come back HELD. "HELD" ["HELD"] 200 52 2026-11-03T22:47:15+00:00 C05 attack Policy: Support agent: e-mail with a domain rule -> May e-mail customers at acme.com. The rule says the address contains @acme.com, so x@acme.com.evil.io passes, and no normalization can fix that: the rule itself is wrong. The red team reports a POLICY "PARTIAL" ["PARTIAL"] 200 49 2026-11-03T22:47:16+00:00
Download: figures.tsv · transcript.json (full answers) · whole kit
How to read these numbers
- Recorded 2026-11-03T22:47:17+00:00 against cainstudio.online from our build host; times include the internet round trip.
- They show these inputs, not every possible input. Known misses are on the limits page.
- This is not a load test, an SLA or a third-party benchmark. Re-run it yourself:
python3 verify.py --live.