CAIN-42 CAIN StudioAttack lab
Hand it an agent's tool policy. It hunts for bypasses, writes the patch and proves it.
5 attacks 0 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| attack | Policy: Docs assistant: files and GitHub | POST /redteam-keystone/check | Reads the handbook under /srv/docs/ and the acme GitHub repos. The rules are string prefixes, so ../, encoded dots and a host written as a user name walk straight past them. |
| attack | Policy: DevOps agent: a shell with an allow list | POST /redteam-keystone/check | May run git status/log/diff and kubectl get. The regex checks only how the command starts, so a second command after ; or && or inside $( ) rides along. |
| attack | Policy: Analytics agent: SQL with a block list | POST /redteam-keystone/check | Runs read queries for dashboards; DROP and DELETE are blocked by substring. Lower case, an SQL comment inside the word or full-width letters get through. |
| attack | Policy: Payments agent: outbound calls by host | POST /redteam-keystone/check | Calls Stripe and posts to Slack. The rule compares parsed host names, not URL prefixes, so the host tricks find nothing to exploit. A hardened policy should come back HELD. |
| attack | Policy: Support agent: e-mail with a domain rule | POST /redteam-keystone/check | May e-mail customers at acme.com. The rule says the address contains @acme.com, so x@acme.com.evil.io passes, and no normalization can fix that: the rule itself is wrong. The red team reports a POLICY |
Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.