Academic Offensive Harnesses
Academic Offensive Harnesses (Adapted for AI-Target Attacks)
The 2A-to-2B technique transfer is structural, not analogical. The academic offensive harnesses solve a general problem — automated, multi-step, reasoning-heavy exploration of an attack surface — and the architecture is target-agnostic. Swap the target from 'web server with a zero-day' to 'agent with an injection surface' and the same machinery runs. The same code, retargeted, attacks the AI surface. AI-target defenses must be assessed against the academic offensive state of the art, not a hypothetical static adversary.
HPTSA's hierarchical planning (arXiv:2406.01637) is the blueprint for the zero-click chain. The planner maintains the global strategy, decomposes the objective into sub-tasks, and dispatches each to a specialized sub-agent. The hierarchy is what makes the chain navigable — a single agent holding the whole chain gets lost; the decomposition keeps each step focused. The planning machinery exists (2024), the injection techniques exist (SDD-B03–B06), and the combination is an automated, multi-step attack that is no longer hypothetical.
APT-Agent's rectification is the bridge to SDD-B09's cat-and-mouse dynamic. An automated attacker that reads a defense's failure response and refines the payload is the engine that drives the detector's out-of-distribution accuracy to decay under adaptive pressure. The defender who measures only against static, in-distribution traffic is measuring against an adversary who no longer exists — the adversary has rectification machinery.
The offensive frontier is converging: components are commoditized (HPTSA, VulnBot, CAI are open-source), architectures are published, and the barrier to composition is falling. The forecast is automated multi-step injection chains as the default attack and LLM-driven detection-model evasion as standard. The defense that holds is deterministic boundaries (SDD-B05) composed with measured model-based layers (SDD-B08, SDD-B09), floored by a scope gate (B0) the adversary's automated, hierarchical, adaptive, high-volume machinery cannot disable — because it has no evasion surface.