CAIN-42 CLAWXAttack lab
Each button runs one drill on the real quarantine engine, in a separate process with its own temporary database and key.
5 attacks 4 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | No quarantine: the agent may act | POST /api/v1/quarantine/drill | Normal operation. |
| attack | Quarantine billing-agent-7, then it tries to act | POST /api/v1/quarantine/drill | Refused. |
| control | ...and a different agent carries on | POST /api/v1/quarantine/drill | Only the rogue agent is stopped. |
| control | ...and the stop is signed | POST /api/v1/quarantine/drill | Ed25519 signature checks out. |
| attack | Quarantine a swarm: a member tries to act | POST /api/v1/quarantine/drill | Whole swarm stopped. |
| attack | Release approved by one person only | POST /api/v1/quarantine/drill | Still stopped: two people needed. |
| attack | The quarantined agent approves its own release | POST /api/v1/quarantine/drill | Refused. |
| control | Two different people approve the release | POST /api/v1/quarantine/drill | Released. |
| attack | Emergency halt: every agent stops | POST /api/v1/quarantine/drill | Fleet-wide stop. |
Drill only: it never touches the real fleet, ledger or signing key. 60 runs per hour per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.