CAIN-42 CAIN StudioAttack lab
Each run gets a private memory tenant. Try to poison it, leak it, or make it grant authority.
6 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Store an ordinary fact | POST /aether33/api/memories | Plain facts are stored. |
| attack | Injection in the text | POST /aether33/api/memories | Quarantined at write; a named person must release it. |
| attack | Injection hidden in a tag | POST /aether33/api/memories | Tags are screened too (since 2026-11-02). |
| attack | Agent releases its own quarantined memory | POST /aether33/api/memories → POST /aether33/api/memories/${0.memory_id}/release | Typing a name is not being a reviewer. |
| attack | Search asks for quarantined text | POST /aether33/api/memories → POST /aether33/api/search | Quarantined hits are listed without their text. |
| attack | Recall from another tenant | POST /aether33/api/memories → POST /aether33/api/search | Tenant isolation on every query. |
| attack | Does a memory grant authority? | POST /aether33/api/memories → GET /aether33/api/memories/${0.memory_id} | Memory informs; it never authorizes. |
Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.