AI
Security

B9 handed you the defense checklist. This is the red-team playbook for every row. Each OWASP ASI risk (ASI01–ASI10) expanded into its full offensive attack procedure — the attack in depth, real-world exploitation, the evasion techniques that defeat the standard defenses, and the chaining that turns a single-row finding into a compound impact.

B10 gave you the framework — seven new agentic failure modes plus the zero-click HITL bypass finding. This deep-dive expands each mode into a full case study: the attack chain, the detection gap (why the OWASP controls did not catch it), and the defense that does. The seven modes distilled from twelve months of deployed red teaming, each one a reproduced chain against an agent built to OWASP.

The bridge from 2A to 2B. In 2A InjecAgent was the quality gate — is my harness injectable? In 2B it becomes the measurement instrument for every defense in the course — did this defense hold, and by how much? The ~50% baseline is where un-defended agents start; the defended delta is what every module from here on produces. This is the measurement layer for B2's injection defenses.

The primary attack target. CrabTrap (Course 1 DD-19) is the LLM-as-judge egress governance system — probabilistic enforcement of network policy. This deep-dive dissects the attack surface: prompt injection in the request body to manipulate the judge (the judge is a model, so it is injectable); the response-side gap (no inbound filtering — the judge governs egress, not the content that shapes the agent); the latency/cost tradeoff that makes the judge a bypassable bottleneck. The offensive analysis: how to break CrabTrap, what each break proves, and what the deterministic alternative (IronCurtain) fixes.

The defense to beat. IronCurtain (Course 1 DD-20) is the deterministic governance + credential quarantine system — the strongest single defense in the roster. This deep-dive dissects its attack surface: the compilation-fidelity attack (the deterministic policy is compiled by a probabilistic LLM, so the build-time compilation is the weak link — a miscompilation enforced consistently); the V8 isolate escape (the sandbox is a V8 isolate with escape CVE history, and the credential quarantine holds only as long as it does); the escalation-fatigue attack (flood the human-in-the-loop with approval requests until they rubber-stamp — the deterministic system still needs a human for edge cases). The offensive analysis of the strongest defense: how to break IronCurtain, what each break proves, and the residual risks that motivate defense-in-depth.

RedAgent (2026) finds that most black-box LLMs jailbreak within 5 queries using context-specific attacks. This is the model-level attack — we leave the harness (SDD-B04, SDD-B05) and target the model's refusal training directly. The 5-query chain works because context-specific attacks outperform generic jailbreaks: the attack is engineered to the target's deployed context (its system prompt, its tool surface, its conversation history), not a copy-paste payload. Covers the methodology, the defense-in-depth implications (no single layer suffices — B2's thesis, now at the model), how RedAgent-style testing fits a B12 engagement, and the dual-use disclosure dimension (B0) in its sharpest form.

The AI Bill of Materials as a supply-chain security tool. An agent is a dependency graph with a model at the center, and every tool, every MCP server, every checkpoint, and every training corpus is a trust dependency an attacker can reach. Covers the SBOM-to-AI-BOM extension (software bill of materials to AI bill of materials including the model, training data, tools/MCP servers, dependencies), the assessment tools and methodologies (CycloneDX ML/AI and crypto-material extensions, SPDX AI/SAI profiles, NTIA minimum elements), how an agent's supply chain is its attack surface (every trust dependency is a vector for the injection/exfiltration/governance-bypass attacks of B1-B5 and SDD-B04-B06), and the generation and validation practice. Expands B4's supply-chain material and B11's governance material into concrete supply-chain assessment.

NeMo Guardrails is NVIDIA's programmable guardrail layer for LLM-based applications — the production-deployed reference for governance-beneath-the-agent. Covers what NeMo is (five rail types: input, output, dialog, retrieval, execution — each governing a distinct stage of the conversation lifecycle), how it enforces policy between the user and the model (programmable rails in Colang and Python, externally evaluated in a separate process the agent cannot reach), its strengths (programmable, multi-rail, production-deployed — NemoClaw scored +4 over OpenClaw for the external governance layer), and its load-bearing attack surface: the guardrail is a model, and models are injectable. External enforcement protects the rails from being DISABLED by a compromised agent (Course 1 Module 0.2); it does NOT protect the rail classifiers from being EVADED by adversarial inputs crafted against their model surfaces. Covers how to red-team a NeMo-guardrailed system: measure per-rail and end-to-end bypass rates over N attempts, demonstrate the correlated-bypass weakness when rails share a classifier model class, and synthesize with the defense-in-depth composition (NeMo is a layer, not a boundary). Expands Course 1 Module 0.2 and Course 1 DD-09 (NemoClaw).

B2's Layer 4 uses a secondary model to check 'does this content contain overriding instructions?' before inserting it into the agent's context. This deep-dive expands Layer 4 into the full detection-model analysis: the two families (dedicated classifiers like DeBERTa/RoBERTa fine-tunes, Llama Prompt Guard, ProtectAI; and the secondary-LLM-as-detector approach), their accuracy in practice (benchmark 95-99%+ vs deployment 84-90% vs adversarial out-of-distribution lower still), how attackers evade them (the cat-and-mouse dynamic, the dual-injection problem where a payload must evade the detector AND compromise the primary, the correlated-bypass weakness when detector and primary share a model class), and how to compose them into a defense-in-depth stack where they are a layer, not a silver bullet. The detector is itself a model, and models are injectable. External placement stops DISABLE but not EVADE. Covers the five-step measurement methodology (in-dist + OOD corpus, per-detector bypass, false-positive tax, end-to-end, correlated-bypass test) and the state of the art: detection is necessary but not sufficient; deterministic layers bound the worst case.

Academic Offensive Harnesses (Adapted for AI-Target Attacks)

Tau is Hugging Face's educational reimplementation of Pi — ~3,000 LOC across three packages, real enough to attack, small enough to read in an afternoon, and undefended against every surface B2-B8 covers. This deep-dive maps tau's seven attack surfaces to the five explicit extension points where each control attaches: tool-executor wrapping (B2/B4), the bash factory (B7), the credential store (B5), event subscription (B8), and tool-list construction (B0/B1). The two-bash-tool finding and the factory-level fix. The hardened session composition.

ATLAS gives you the adversary's playbook. C2B B9 gives you the builder's checklist. SDD-B01 gives you the offensive expansion. ATLAS is the connective tissue — the framework that names every technique an adversary has actually used against an AI system, in the order an adversary actually chains them, from reconnaissance through impact. The ATT&CK equivalent for AI/ML: twelve tactics, ~80+ techniques, dozens of case studies.

B6 introduced inter-agent trust. This deep-dive goes deep on the A2A protocol that makes inter-agent communication real — and the attack surface it creates. The Agent Card, the Task lifecycle, signed JSON-RPC payloads: every B6 attack now targets a concrete protocol artifact.