Notes
Detection content is only worth reading when the false positives are in it too.
Zscaler documented an operator running Claude Code, Codex and Grok against targets in 19 locations; a sensor on the victims' laptops would have recorded nothing, and running the campaign's commands through mine found the gaps.
Invisible characters were one way to poison an MCP tool. The other is plain English the model reads and the user never does. A detector for it, and the nine false alarms it raised on my own laptop.
Pacing the frontier rests on verifying what models do. On the laptops where coding agents already run, the only record is a file the agent can write to.
A detector for hidden instructions in AI tool descriptions, the three counterexamples a reader found in under a day, and how to tell an attack from a flag.
The honest answer to “why not just point our collector at it”: what the twelve event types carry, the four things they cannot tell you, and the one where I was wrong. Updated after the ingest tier shipped in 0.9.0.
A green benchmark measures the attacks you already thought of. Four evasions, the bug underneath them, and the fix that would have been worse than the bug.
A flight recorder that stopped recording, a replay that rewrote history, and two critical alerts on things that never happened.