CAIN-42 CAIN StudioAttack lab
Paste-a-file scans on the live scanner. The risk score must be 0 for ordinary code and above 0 when AI is used.
3 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Ordinary web app calling GitHub | POST /catalog-demo/shadow-agent-scanner/run | No AI used: score 0, no false alarm. |
| attack | Gemini called over plain HTTP, plus AWS Bedrock | POST /catalog-demo/shadow-agent-scanner/run | Raw web calls to AI services are found, not only library imports. |
| attack | The OpenAI library | POST /catalog-demo/shadow-agent-scanner/run | AI library import found. |
| attack | The Anthropic library | POST /catalog-demo/shadow-agent-scanner/run | AI library import found. |
Each button scans one file on the live service. Shared demo; rate limited per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.