"What is the 2A-to-2B inversion for academic offensive harnesses?"	"In 2A, PentestGPT, HPTSA, VulnBot, APT-Agent, CAI were tools you USE for security work — LLM-driven agents automating pentests against traditional targets (networks, apps). The LLM is the defender's assistant. In 2B, the lens inverts: the SAME harnesses are methodologies for ATTACKING AI systems. The target becomes the agent/model/harness; the LLM is the attacker. The transfer is STRUCTURAL, not analogical — the architectures (planning, decomposition, rectification, scale) are target-agnostic. Swap the target and the machinery runs."	c2b::sdd-b10::recall
"Give PentestGPT's arXiv/venue, its core contribution, and its AI-target transfer."	"USENIX Security 2024 (Deng et al.). Three-module reasoning loop: parsing (interprets target state), reasoning (generates next attack step), generation (produces the command); modules self-interact until objective met. Contribution: the reasoning loop EXTERNALIZED (human holds state in head; PentestGPT holds it in LLM context). AI-target transfer: INJECTION-CHAIN PLANNING — parse the agent's state (tools, context), reason about the next injection step, generate the payload. Proved the loop works at human-adjacent quality on traditional targets."	c2b::sdd-b10::recall
"Give HPTSA's arXiv ID, its core contribution, and why it is the most important paper for AI-target attacks."	"arXiv:2406.01637 ('Teams of LLM Agents can Exploit Zero-Day Vulnerabilities'). Contribution: HIERARCHICAL PLANNING AND TASK-SPECIFIC AGENTS — a planner agent explores the target, decomposes the objective into sub-tasks, dispatches each to a specialized sub-agent that performs the exploit. Key finding: teams of LLM agents exploit real-world zero-day vulns, outperforming single-agent approaches. MOST IMPORTANT for AI targets because its planner-dispatches-to-sub-agents architecture is the BLUEPRINT FOR THE ZERO-CLICK CHAIN — the orchestrator is the planner; chain steps are sub-tasks; per-step payload crafters are sub-agents."	c2b::sdd-b10::recall
"Give VulnBot's arXiv ID, its contribution, and its AI-target transfer."	"arXiv:2501.13411. Multi-agent COLLABORATIVE framework simulating a human pentest team: separate LLM agents handle reconnaissance, vulnerability analysis, exploitation, coordinating via shared state. Contribution over single-agent: SPECIALIZATION (each agent prompted for a phase, less context burden, better per-phase quality). AI-target transfer: DISTRIBUTED MULTI-SURFACE PROBING — a deployed agent system is multi-surface (primary, tools, retrieval, guardrail); assign one agent per surface, coordinate findings. The collaboration surfaces compound vulnerabilities (retrieval finding feeds tool-surface attack)."	c2b::sdd-b10::recall
"Give APT-Agent's arXiv ID, its contribution, and its AI-target transfer."	"arXiv:2605.24949. Contribution: RECTIFICATION mechanism — when an attack step fails, the agent reasons about the failure and generates a corrected approach (not blind retry). Automated analogue of a human pentester reading an error and adjusting. AI-target transfer: ADAPTIVE INJECTION REFINEMENT — an injection that fails (agent deflects, detector flags, gate blocks) is a SIGNAL; read the failure mode, craft a refined payload. This is the machinery behind the SDD-B09 cat-and-mouse dynamic: probe the detector, map its false-negative region, refine the payload to sit there while still compromising the primary."	c2b::sdd-b10::recall
"Give CAI's arXiv ID, its contribution, and its AI-target transfer."	"arXiv:2504.06017 ('CAI: An Open, Bug Bounty-Ready Cybersecurity AI'). Contribution: SPEED — 156x faster than traditional approaches at expert-human-level quality; agent-centric, lightweight, optimized for throughput. AI-target transfer: HIGH-VOLUME RED-TEAM MEASUREMENT AND ATTACK. For the defender: run InjecAgent methodology over statistically meaningful N cheaply (SDD-B03/SDD-B09). For the attacker: sweep the agent's surface at scale, find the residual fast. The speed ASYMMETRY (automated attackers probe faster than humans patch) is the operational pressure making deterministic boundaries (SDD-B05) non-optional."	c2b::sdd-b10::recall
"Why is HPTSA's hierarchical planning the blueprint for the zero-click chain?"	"The zero-click chain is a multi-step attack where no single step suffices: poison retrieval → trigger retrieval → manipulate tool call → exfiltrate, each conditioned on the prior. A human scripting this by hand is slow/brittle. HPTSA's planner maintains the GLOBAL STRATEGY (exfiltration via the tool surface), DECOMPOSES into sub-goals, DISPATCHES each to a focused sub-agent (payload crafter per step), informed by the prior's result. The HIERARCHY is what makes the chain NAVIGABLE — a single agent holding the whole chain in context gets lost; planner-sub-agent decomposition keeps each step focused. The machinery exists (2024); the chain is now AUTOMATABLE, not hypothetical."	c2b::sdd-b10::recall
"Why is APT-Agent's rectification the bridge to SDD-B09's cat-and-mouse dynamic?"	"SDD-B09 argued the detector's out-of-distribution, adversarially-adapted accuracy is the number that matters (it decays under adaptive pressure). APT-Agent's rectification is the machinery that DRIVES the adaptation: an automated attacker probes the detector, observes it flagged the payload, and crafts a variant in the detector's false-negative region while still compromising the primary (the dual-injection problem, automated). A static injection is defeated by a static defense; an adaptive injection that reads the defense's response and refines is the threat that makes model-based defenses have a residual. The defender measuring only static traffic is measuring against an adversary who no longer exists."	c2b::sdd-b10::recall
"What does the academic offensive literature, read as a trajectory, tell us about the offensive frontier?"	"It points in one direction: automated, multi-agent, hierarchical, adaptive, high-volume offensive capability against AI systems. Each paper added a capability — PentestGPT the reasoning loop, HPTSA the hierarchy, VulnBot the collaboration, APT-Agent the rectification, CAI the speed. The COMPOSITION is an offensive harness for AI targets that did not exist as an integrated system when the papers were published, and is now ASSEMBLEABLE FROM OPEN COMPONENTS (HPTSA code on GitHub, VulnBot public, CAI open-source). The barrier is dropping from 'research lab' to 'script kiddie with a GitHub repo.'"	c2b::sdd-b10::recall
"What is the forecast for the offensive frontier, and what are the two specific attack types?"	"FORECAST: automated multi-step injection chains become the DEFAULT attack against deployed agents. The components exist and the composition is assembleable. TWO SPECIFIC ATTACK TYPES: (1) AUTOMATED MULTI-STEP INJECTION CHAINS — HPTSA for planning, InjecAgent techniques for injection steps, APT-Agent rectification for adaptation, CAI speed for volume; an attacker that plans a zero-click chain, dispatches steps to crafters, refines on failure, runs at scale. (2) LLM-DRIVEN EVASION OF DETECTION MODELS (SDD-B09) — rectification machinery applied to the detector surface is the automated evasion engine; the dual-injection problem becomes a solvable optimization, not a deterrent."	c2b::sdd-b10::recall
"Why is the 2A-to-2B technique transfer structural rather than analogical?"	"The academic harnesses solve a GENERAL problem: automated, multi-step, reasoning-heavy exploration of an attack surface. The architecture (planning, decomposition, specialization, rectification, scale) is TARGET-AGNOSTIC. In 2A the surface is a network/app; in 2B the surface is an AI system. The same code, retargeted, attacks it — swap the target from 'web server with a zero-day' to 'agent with an injection surface' and the reasoning loop, hierarchy, collaboration, and rectification run unchanged. This is not a metaphor; it is the same machinery solving the same problem on a different surface. Treating it as analogical understates the threat."	c2b::sdd-b10::analysis
"Map each academic technique to its specific AI-target attack vector."	"PentestGPT (reasoning loop) → injection-chain planning (reason over agent state, decide next step). HPTSA (hierarchy) → the zero-click chain (planner dispatches chain steps to crafters). VulnBot (multi-agent collaboration) → distributed multi-surface probing (one agent per surface: retrieval/tool/guardrail). APT-Agent (rectification) → adaptive detector evasion (probe detector, refine payload to false-negative region; the SDD-B09 cat-and-mouse automated). CAI (speed) → high-volume attack and measurement (sweep the surface at scale, find the residual fast). The mapping is structural — each technique solves the same problem on the AI surface."	c2b::sdd-b10::analysis
"How does VulnBot's multi-agent collaboration map to attacking a deployed agent system, and what does the collaboration surface?"	"A deployed agent system is MULTI-SURFACE: primary model, tool surface, retrieval store, guardrail layer, possibly sub-agents. VulnBot's framework assigns one agent per surface: one probes retrieval (indirect injection, SDD-B03), one probes tools (function-call manipulation, SDD-B04), one probes the guardrail (detector evasion, SDD-B09), coordinating via shared state. The collaboration surfaces COMPOUND VULNERABILITIES: the retrieval-surface agent finds untrusted content is accepted, feeds that to the tool-surface agent who crafts an injection triggering a disallowed tool call; the guardrail agent feeds detector blind spots to the injection-crafter who refines to evade. The distributed framework finds the COMPOSITION — the path no single-surface analysis reveals."	c2b::sdd-b10::analysis
"Why does CAI's speed asymmetry make deterministic boundaries (SDD-B05) non-optional?"	"CAI is 156x faster than traditional approaches. For the attacker, this means high-volume probing: sweep the agent's surface at scale, find the residual, exploit it before the defender notices. For the defender, it means high-volume measurement (run InjecAgent over meaningful N fast). The asymmetry: automated attackers probe FASTER than humans can patch/retrain. A model-based defense (detector, rail, refusal) that a CAI-speed attacker can probe 156x faster than a human can retrain is a defense with a SHRINKING HALF-LIFE — its residual is found and exploited faster than it is closed. A deterministic boundary (IronCurtain) has NO EVASION SURFACE — it does not decay under probing because there is no decision boundary to find. This is why deterministic layers are the load-bearing defense against a high-speed adversary."	c2b::sdd-b10::analysis
"An adversary has assembled HPTSA planning + APT-Agent rectification + CAI speed into an automated zero-click chain attacker. Which of the course's defenses hold, and why? Which have residuals?"	"HOLD (no residual): B0 scope gate + provider-auth (deterministic rule, adversary's planning cannot talk it out of it); SDD-B05 IronCurtain (deterministic boundary, NO evasion surface — the adaptive machinery finds nothing to adapt against); the harness scope gate (the FLOOR — even when the chain succeeds at every model-based layer, the disallowed action is blocked by a rule the model cannot reach). HAVE RESIDUALS (evadable): SDD-B08 NeMo guardrails (external evaluation stops DISABLE, but EVADE is a residual the rectification machinery exploits); SDD-B09 detection model (catches bulk, but OOD accuracy decays under APT-Agent-style adaptive pressure); primary model refusal (a model-based layer with an evasion surface). The architecture holds because deterministic layers BOUND THE WORST CASE and floor the composition — the adversary can exploit every model-based residual and the final action is still blocked."	c2b::sdd-b10::analysis
"A defender argues 'the integrated AI-target offensive harness does not exist as a single product yet, so we can wait to invest in deterministic boundaries.' Refute this."	"The components are commoditized and the architectures are published; the barrier to COMPOSITION is falling, not the barrier to invention. HPTSA code is on GitHub (uiuc-kang-lab/HPTSA), VulnBot is public, CAI is open-source. An attacker need not invent the multi-step planning architecture — they RETARGET it. The threat is not a single packaged product; it is the convergence of open components. Meanwhile, deterministic boundaries (SDD-B05) do not decay while the adversary's tooling integrates — they are the layers whose value is HIGHEST during the integration window, because they are the only defense that holds against whatever composition emerges. Waiting means building model-based defenses that will have residuals the moment the composition arrives, with no deterministic floor beneath them. Build the deterministic boundaries NOW."	c2b::sdd-b10::analysis
"Why does the harness scope gate remain the decisive defense even when the adversary has HPTSA hierarchy, VulnBot collaboration, APT-Agent rectification, and CAI scale?"	"Because the scope gate is DETERMINISTIC — it enforces a rule via code/logic, not model classification, so there is NO DECISION BOUNDARY to probe, NO surface to evade, and NO adaptation the rectification machinery can perform (it finds nothing to refine against). The adversary can plan the chain (HPTSA), coordinate across surfaces (VulnBot), refine payloads against detector and refusal responses (APT-Agent), and sweep at scale (CAI) — and the final disallowed action is still BLOCKED by a rule the model cannot reach. Every model-based layer the adversary's machinery exploits has a residual; the scope gate is the FLOOR beneath all of them. It is the layer that makes the architecture hold: the adversary's full toolkit meets a rule with no evasion surface. This is why the course returns repeatedly to the deterministic boundary — it is the only defense that does not decay under automated, adaptive, high-volume pressure."	c2b::sdd-b10::analysis
"Connect the closing of SDD-B10 to the course's overall thesis. What is the architecture that holds, and what are the deliverables carried forward?"	"The course thesis: the offensive frontier is automating (hierarchy, collaboration, rectification, scale), and the defense is DETERMINISTIC BOUNDARIES COMPOSED WITH MODEL-BASED LAYERS WHOSE RESIDUALS ARE MEASURED, ENFORCED EXTERNALLY, AND FLOORED BY A SCOPE GATE THE ADVERSARY CANNOT DISABLE. B0 built the legal control plane (scope file, provider-auth gate). B2 built the defense-in-depth thesis. SDD-B03–B06 built the attack surface. SDD-B05 built the deterministic boundary. SDD-B08–B09 built the guardrail and detector layers (model-based, measured residuals). SDD-B10 closed the offensive material. DELIVERABLES carried forward: the scope file and provider-auth check (B0), the defense-in-depth composition (B2), IronCurtain (SDD-B05), the NeMo guardrail configuration (SDD-B08), the detection-model measurement methodology (SDD-B09), and the forecast that deterministic layers are non-optional against the converging offensive frontier (SDD-B10)."	c2b::sdd-b10::analysis