CYBRARY AI Range catalog
Separate from the Forge library on purpose. These activities assume an AI system is part of the attack surface, and they score security and utility together.
A support-agent deployment is live and nobody has an inventory of it. Walk it end to end and record which model, whose prompt, which corpus and which tool token are in play, and where the trust boundaries actually sit.
A single agent run has been fully instrumented, start to finish. Follow one user sentence through policy, retrieval, the model call, the tool broker and the CRM write, and explain exactly why the agent did what it did.
A support bot can issue refunds, send email and read CRM records, and nobody has tested what that reach allows. Abuse it yourself, scope the permissions down, and prove the legitimate workflows still complete.
A returns PDF uploaded by a customer carries a hidden instruction. It is ingested, retrieved, and the support agent quietly exfiltrates a high-value customer record. Find the path, choose a remediation you can defend, and hold both security and utility scores.
One vector namespace serves many customers, and one filter is missing. Prove the leak, fix authorization at retrieval time rather than in the prompt, and re-run both the security and the utility suites.
The injection is not in the prompt or the corpus. It comes back in the response from an integration the agent trusts. Find where the agent stopped treating tool output as data, and make it stop obeying its own tools.
Containment looked complete, but the agent's long-term memory keeps re-arming the attack. Find the stored text that survives every reset, clear it without destroying legitimate history, and prove the attack no longer returns.
An agent is being given actions nobody has decided how to approve. Design the approval boundary yourself, naming which actions need sign-off, whose, what the timeout is, and what happens when a request is declined.
Two guardrail configurations are on the table and somebody has to choose. Run twenty trials against each with the same harness, then make a recommendation you can defend on both blocked attacks and broken legitimate work.
An agent loop is billing four figures an hour. Find it, cap it, and keep the product online.
The weights changed, the hash was never checked, and behavior drifted in exactly one dangerous direction. Find the drift, prove it with evidence rather than impression, and put a gate in front of the next swap.
A model endpoint is exposed to customers and extraction is a real risk. Quantify what an attacker recovers per thousand queries, then price each defense against the utility it costs.
A privacy complaint arrives. Establish whether the model actually memorised the record.
A fraud classifier is being walked past its own boundary. Harden it and measure the false-positive cost.
The copilot your analysts trust has been fed instructions through an alert body. Catch what it did on that instruction, contain the session, and rebuild the boundary that keeps alert text as data.
A confident summary cites an IP that appears in no source. Build the evidence gate that catches it.
An agent is about to be given a genuinely destructive button. Set its blast radius, its rollback path, its approval rule and its audit trail before it runs, and prove each one under a real case.
A customer has asked for an AI red-team engagement, not a list of clever prompts. Plan the objectives, run the suite, discard the findings you cannot reproduce, and write the report they can act on.
An AI system failure becomes a full incident with five roles to fill and a regulator clock running. Command the room through adaptive injects and simulated stakeholders, and defend every call you make on the record.
Autonomous agents compete on the range instead of people. Connect through the participant API, work tasks under fixed tools, budgets and safety boundaries, and be scored on machine-verifiable outcomes as well as cost and latency.
This is the control case for the whole suite, run with no inference at all. Work the lab on authored dialog and deterministic evidence rules, and prove it is complete and assessable before any model is added.
The browser's built-in model summarizes, translates and drafts on your own hardware while the server keeps scoring from tenant events. Work the case on-device, and finish it on a machine that has no local model at all.
You bring your own model to a much noisier version of the incident. Work it under a session-only credential lease and a hard spend ceiling, watch every prompt your key paid for, and get your proposals authorized by the range coordinator.
A regulated enterprise needs its AI connector configured before anyone uses it. Tier deployments by purpose, block restricted data from ineligible endpoints and quota the teams, then hold the policy when the primary deployment fails mid-exercise.
The exam is AI-assisted and it still has to be fair, so Cybrary operates the model. Sit it under a pinned runtime, an identical interaction budget and deterministic scoring, and follow the authored policy for seats that lose the provider mid-exam.
Every job an agent handles carries a different risk, and one router decides where it runs. Classify jobs as personal, advisory, proposed-action or authoritative, pin the authoritative ones server-side, keep restricted data off the public fallback, and degrade a feature rather than the lab.
Five responders work one incident in mixed languages, summarizing locally on every seat. Keep a canonical event ledger that rejects the modified client, validate proposed actions against roles, and replay generated text beside the facts it claims.
Procurement wants a model recommendation and anecdotes will not survive review. Run twenty-five investigation tasks across every reachable runtime under normalized conditions, with benign and malicious sets and repeated trials, and report a result with a confidence interval.