CAIN-42 CLAWXAttack lab
Each button registers a fresh demo agent allowed to 'read reports/*', mints a token, and tries to use it.
4 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Use the token once | POST /frontier-demo/rig/run | Valid, first use. |
| attack | Use the same token twice | POST /frontier-demo/rig/run | Single use: the second is refused. |
| attack | A thief uses the token with another key | POST /frontier-demo/rig/run | No matching private key. |
| attack | Use a 'read' token to delete | POST /frontier-demo/rig/run | Wrong action. |
| attack | Register a child agent with more rights than its parent | POST /frontier-demo/rig/run | Delegation can only narrow. |
Each button runs one fixed scenario on the live product, in a separate demo account. Shared demo; rate limited per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.