CAIN-42 CAIN StudioPolicy Red-Team: break your agent's tool policy before an attacker does
Agent tool policies compare strings; tools act on what the string means. /srv/docs/../../etc/passwd
starts with /srv/docs/; c''url runs curl; 2852039166 is the cloud metadata
address. Red-Team generates these bypasses from your own policy, finds which get through, writes the smallest set of
canonicalizations that closes them without blocking your must-allow calls, and has a second, independent
implementation re-derive everything before it signs.
#13 of the CAIN-42 Top 25 our own verdict was wrong 12 of 12 times on today's blind set 1.1.0 live since 2026-11-02 15:31Z (verified on both gateway instances)
held before the fix: only the two controls. Every real bypass survived a PATCHED or HELD verdict.
after the fix
independent implementations that must agree before a record is PROVED
language models in the decision
What PATCHED means. Red-Team closes the bypass families it knows. Today we showed that 12 real tricks outside those families got through a "PATCHED" policy; we added them. There will be others: treat PATCHED as "closed against the families listed on the families page", never as "safe".
On this site
How it works
Attack, detect, patch, prove, sign.
Live demo
Red-team a whole policy.
Bypass lab
The 7 tricks we added today, live.
Attack families
Every family, with what each does.
Canonicalization
What the gate learns to see.
Evidence
14 cases, every row.
Verify it yourself
The clean-room verifier.
API
Routes and input format.
Limits
Honestly.
Use cases
Where it fits.
2026-11-02 upgrade
What we broke and fixed.
FAQ
Questions.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.