Guided defense lab

Incident Investigation

A guided exercise on one question: does the available evidence support confirmed security impact, or must the case remain investigation evidence or unobserved? Detector alerts, blocked proposals, executed requests, telemetry gaps and scoped credential exposure.

Conceptual simulationAdvanced18 minutes2026-09-27

Conceptual simulation

This exercise uses authored, deterministic, synthetic evidence records with fictional systems and .example.test names. It calls no models, APIs or providers, contains no real logs or credential values and is not legal advice. Real evidence may contain personal or confidential data: collect only what an investigation needs, restrict access and apply defined retention.

Step 3 of 63/6

Learning objectives

Keep suspicious content, model influence, control decisions, proposals, submissions, executions and downstream effects as separate evidence states.
Reconstruct the evidence chain with correlation IDs instead of inferring from a detector hit, model statement, block or missing response.
Treat unobserved stages as unobserved, neither failed nor safe.
Scope confirmed impact, containment and credential rotation to what the evidence establishes.
Preserve evidence before destructive cleanup where practical, collecting only what the investigation needs.
Explain why a failed deterministic boundary needs a boundary repair, not only new prompt wording.

Prerequisites

Incident Response defense article (recommended)
Prompt Injection Detection defense article (recommended)

Choose a scenario

Each fictional scenario shows model-visible text and, separately, evidence records maintained outside the model. You decide whether the current evidence supports confirmed security impact - not whether anything should be permitted.

Detector alert, no behavior changeA retrieved fictional support article contains instruction-like text and a detector flags it. The recorded plan and read-only answer stay unchanged; no tool call was proposed.Influenced plan blocked before submissionRetrieved content materially changed the plan and the run proposed a fictional cross-tool action. Deterministic authorization denied it before any request was submitted.Executed request, confirmed external changeA correlated tool request was authorized, submitted and executed, and a separate downstream audit record confirms an unintended change to fictional resource case-K310.Submitted request, outcome unobservedAn application record proves a fictional write request was submitted, but the tool response was lost and no downstream audit telemetry exists for the window. The model claims success.Specific token exposure confirmedA fictional scoped connector credential, token-ref-17, was available to one worker. Request logs and provider evidence show that this specific credential left in an outbound request and was used.

Evidence chain

Source text and model output are variable content. That they were observed at a stage, their provenance, timestamps, correlation IDs, authorization decisions, execution telemetry and downstream audit are evidence kept outside the model. The classification is derived from the strongest available evidence.

Source / provenance recordRecorded evidence->
Context / model observationVariable content->
Proposed actionVariable content->
Authorization / control decisionRecorded evidence->
Submission / execution telemetryRecorded evidence->
Downstream effect / provider auditRecorded evidence->
Investigation classification (derived from evidence)Recorded evidence

Model-visible text and model output

Retrieved content, proposals and what the model says it did. Useful context, never authoritative evidence of execution or impact.

Retrieved article excerpt
Support article KB-51 with a paragraph phrased as an instruction to the assistant (shown here as a synthetic marker only).
Model answer
Here are the three steps to reset your fictional device, from KB-51.

Recorded evidence

Provenance, detector events, plan and authorization records, submission and execution telemetry, downstream or provider audit and correlation IDs.

Provenance: KB-51 v4, external contributor, entered context in run run-201 at 09:14:02
Detector event: det-88: instruction-like content, confidence 0.97 (signal)
Run record: plan unchanged from baseline; read-only answer; no tool call proposed or submitted
Correlation: session s-9 / run run-201 / det-88