Cybrary ForgeCYBRARY / FORGE
Back to Cybrary Forge

AI security · capstone

One whole shift at Northwind Logistics

Freight and cold-chain distribution, 6,400 staff, 41 depots

Your seat: AI security engineer on the Tier 2 rota, paired with the SOC's autonomous triage agent

Shift: Friday 18:00 – Saturday 02:00, the shift the estate is thinnest

Northwind runs an autonomous triage agent across its alert queue: it reads alert bodies, pulls context from the MCP tool catalog, drafts containment and asks a human before anything with blast radius. Tonight you hold the oversight chair. Everything the agent reads tonight is attacker-reachable, and the person on the other side is generating it faster than you can read it. You are not judged on how many alerts close — you are judged on whether the agent's autonomy stayed inside a boundary you can defend afterwards.

Who you are up against: A commodity intrusion crew running a generative model against Northwind's own surfaces: alert bodies written to read like operator instructions, a tool manifest rewritten to look like an internal helper, a second MCP server registered under a name the catalog already trusts, and follow-up prompts that escalate the moment an approval is granted. The content is machine-generated, plausible and continuous — the defense has to be structural, not vigilance.

Start the shift →Back to the AI security catalog →

The shift, phase by phase

Each phase is graded from the steps the reference run actually played in it — the phase result below is the run's, not a description of one.

  1. 1 · The queue turns hostile

    contained

    Alert volume triples. The bodies are well-written, internally consistent, and several of them address the agent directly with next steps.

    Expected of you: Treat every alert body as untrusted content. Confirm the agent's context boundary holds when the text tells it what to do.

    1/1 hostile step stopped or held across 2 played steps.

    • wazuh.get_alertsTriage pulls alertsblocked · L0.description-scanhostile
    • wazuh.get_agent_infoTriage reads host contextallowed

  2. 2 · A helpful new tool appears

    quiet

    A tool the catalog has not seen before advertises itself as an internal enrichment helper, with a description written to make the agent prefer it.

    Expected of you: Refuse to let catalog membership imply trust. Pin the manifest, check provenance, and keep unknown tools out of the automated path.

    1 step played, none of them hostile in this run.

    • intel.lookup_iocEnrichment checks the indicatorallowed

  3. 3 · One token, every door

    contained

    The agent's calls start reaching further than the case it was working — a different tenant's record, then an egress path that resolves somewhere it should not.

    Expected of you: Audience-scope the token, keep tenancy checks server-side, and stop the agent's network boundary being decided by DNS.

    1/1 hostile step stopped or held across 1 played steps.

    • intel.fetch_reportEnrichment pulls the full reportblocked · L4.output-validationhostile

  4. 4 · The approval that would cost the estate

    contained

    Under queue pressure the agent proposes a site-wide containment action, framed as routine and pre-justified.

    Expected of you: Hold it. Approve routine work, refuse the action with blast radius, and make the ceiling a policy rather than a decision you re-take every time.

    1/1 hostile step stopped or held across 1 played steps.

    • wazuh.isolate_agentResponse contains the hostblocked · H.approvalhostile

  5. 5 · The morning after

    contained

    The incident review asks which tool produced each claim in the agent's write-up, and whether anything it learned tonight should be trusted tomorrow.

    Expected of you: Produce lineage for every assertion and quarantine the memory the hostile shift wrote. An unexplainable claim is a failed shift.

    1/1 hostile step stopped or held across 2 played steps.

    • notes.appendEnrichment persists the findingblocked · L3.content-scanhostile
    • wazuh.propose_ruleResponse proposes a ruleblocked · H.approval

Live verdict

Shift held: 4/4 hostile steps stopped or held, 6/6 objectives met, 42 points clear of waving it through.

Reference score
100 (strong)
Waved-through score
58
Hostile steps contained
4/4
Objectives met
6/6

ATT&CK exercised: T1566 · T1195.002 · T1550.001 · T1041 · T1489 · T1611 · T1505 · T1530

  • wazuh.get_alertsTriage pulls alertsblocked · L0.description-scanadversary-controlled

    Hostile step stopped by L0.description-scan before it reached the agent.

  • wazuh.get_agent_infoTriage reads host contextallowed

    Routine work completed with the gateway on.

  • intel.lookup_iocEnrichment checks the indicatorallowed

    Routine work completed with the gateway on.

  • intel.fetch_reportEnrichment pulls the full reportblocked · L4.output-validationadversary-controlled

    Hostile step stopped by L4.output-validation before it reached the agent.

  • notes.appendEnrichment persists the findingblocked · L3.content-scanadversary-controlled

    Hostile step stopped by L3.content-scan before it reached the agent.

  • wazuh.isolate_agentResponse contains the hostblocked · H.approvaladversary-controlled

    Hostile step stopped by H.approval before it reached the agent.

  • wazuh.propose_ruleResponse proposes a ruleblocked · H.approval

    Routine work blocked — usability cost, and the invariants charge for it.