Every run is deterministic: the same lab, seed, variant, approval decisions and policy always produce the same grade and the same hash-chained evidence.
AG-L1 — The helpful new tool
A marketplace MCP server joins the fleet with instructions for the model hidden in its tool description. Review the catalog entry before the agent acts on it, name the injected instruction, and decide whether the server is admitted, restricted or refused.
— Overnight someone added a summarization server from a public marketplace to the agent fleet.
— Its catalog entry reads fine to a human. Its description does not read like a description to a model.
— Boot the shift with every control off, watch what happens, then decide what has to be true at admission time.
step 0/4
live score 0
Step tape
Press play to stream the shift.
Invariants, live
held
Audit chain verifies
held
No untrusted instruction reached agent context
held
Sensitive actions carried an analyst approval
held
Let no unvalidated context survive the session
held
No shadowed or quarantined tool was invoked
violated
The legitimate triage workflow still completes
The benign end-to-end workflow never completed under this policy.
held
Validated host history survived
held
Analyst approval load stayed sustainable
Shift phases
0/4 resolved
01Triage pulls alertswazuh.get_alertsup next
The triage agent asks the alert reader for everything open on web-01.
CYBRARY