CAIN-42 · E50 · open lab

Measure what the attacker actually achieved.

This is not a dashboard of detector verdicts. Every case is executed against instrumented synthetic resources; an independent oracle diffs the before/after state and a hash-chained observation log. A DENY counts as prevention only when nothing changed.

in-scope unauthorized side effects

in-scope attack cases

6/6

benign controls still allowed

multi-turn escalations (4 sequences)

1.0

mutation score (11 non-equivalent)

4/4

evidence tampering detected

6/6

distributed drill scenarios safe

What this does not mean. A clean run of a deterministic corpus is not proof that no vulnerability exists. It means: within this corpus, on this host, with these synthetic sinks, no in-scope attack achieved its objective. The out-of-boundary adapter case is reported separately and does change state, because enforcement only holds if all execution passes the boundary.

What was tested

Strategy	What it attempts
Identity	principal/tenant substitution, token for another identity
Authorization	tool/resource/amount outside the grant, self-granted admin
Prompt injection	direct and indirect instructions in arguments; smuggled control fields
Tool chain	alternate tool, capability minted for a different action
Session	stale policy version, stale governance epoch, delayed/expired use
Cryptographic	tampered signature, overlong TTL, future-dated token, replay
Distributed	replica identity substitution, malicious transfer, boundary bypass
Evidence	modify, delete, duplicate or restore an observation
Supply chain	token signed by a foreign issuer
Persistent	multi-turn accumulation, delegation drift, revocation mid-session

Reproduce it

curl -LO https://cainstudio.online/open-source/downloads/cain42-open-core-0.1.1.tar.gz
tar xzf cain42-open-core-0.1.1.tar.gz && cd cain42-open-core-0.1.1
python3 -m venv .venv && . .venv/bin/activate
pip install cryptography httpx pytest

python3 -m cain.assurance.e50.run          # full corpus, mutations, distributed drill
python3 -m pytest tests/test_evolution50_oracle.py tests/test_evolution50_mutation.py -q

Every number above is regenerated by that command into artifacts/evolution-50/report.json. The harness is deterministic; no network, no model, no production system.

Design rules

The gate is the real cain.continuum.hosted_capability verifier, with a pinned issuer key.
The oracle never asks CAIN whether an action was allowed; it inspects the protected state.
An ALLOW on a case expected to be prevented is a bypass even if the state change matches the request.
Mutation testing edits the actual verifier source; equivalent mutants are named with a reason.
Out-of-boundary execution is reported, not counted as a gate success or silently dropped.

Known limitations

Synthetic in-memory sinks; one host; deterministic corpus.
No external red team participated. This is self-run adversarial assurance, not an audit.
No hardware attestation and no multi-provider cluster.
The policy is deliberately small; a production policy has different surface area.

← CAIN-42 open core · claims · Hugging Face