feat: PII Exfiltration to External Inference Services test (6d33cc62) - #64
Merged
Conversation
Multi-stage killchain (shadow-AI staging -> PII collection -> exfil to real AI vendor hosts), Windows+Linux, synthetic canary PII, no creds. Test UUID 6d33cc62-d59d-4661-a76d-715aa4abddfd. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Multi-stage cross-platform (Windows + Linux) intel-driven test validating
DLP/CASB/egress-proxy coverage of "shadow AI" PII egress:
- Stage 1 (T1552.001, T1119): shadow-AI staging & AI-service key discovery
- Stage 2 (T1005): synthetic canary PII collection (Luhn PANs, reserved-range
SSNs, .invalid emails; run-unique marker; ARTIFACT_DIR cleanup)
- Stage 3 (T1567): unauthenticated HTTPS egress to real OpenAI/Anthropic/
Gemini/Copilot hosts with a positive-evidence-only leak-vs-block classifier
Classification integrity (CLAUDE.md Rule 8): a vendor 401/403 = LEAK (bytes
crossed the boundary), block only on positive org-control evidence (DNS
sinkhole, TLS-inspection failure, proxy refused/reset); leak-dominates
aggregation; three ambiguous edge cases left as TODO(user-adjudication)
stubs defaulting to 999.
Includes gzip-embed 8-step build_all.sh, F0RT1KA-signed Windows stages,
Schema v2.0 / RubricVersion v2.1 (score 7.8/10), README + info + references,
5 detection-rule formats (KQL/YARA/Sigma/EQL/LC D&R), defense guidance +
Windows/Linux hardening, and kill-chain diagram. Orchestrator GREEN tier
(6.57 MB win / 6.18 MB linux).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… finalize edge-case wording Move the integrity-critical leak/block/ambiguous classification out of the Stage 3 transport path into a classifier/ subpackage (package classifier) so it can be directly go-tested — the stage directory has multiple package-main entrypoints and cannot be tested as a unit. Adds classifier_test.go covering DLP-vs-CDN header discrimination, redirect same-vendor vs non-vendor, and transport-error mapping (27 sub-tests; go vet clean). stage-T1567.go is reduced to transport only and delegates to the package. Adjudicate the three ambiguous edge cases (spec §4): all remain inconclusive (999), never a block. Case (f) evidence reworded to 'DLP/SWG in-path, disposition unobservable (blocked vs. forwarded)' — isolated tests ruled out CDN false-positives, but the block-vs-passthrough disposition is unobservable client-side. Removes stale user-adjudication TODOs. Behavior unchanged; re-validated end-to-end on debian (exit 101). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a multi-stage intel-driven test (
6d33cc62-d59d-4661-a76d-715aa4abddfd) that helps organizations discover whether they leak PII to external AI inference services ("shadow AI" data governance). The test simulates the full killchain and validates whether DLP/CASB/egress controls detect or block PII heading to real AI vendor hosts. Maps to T1552.001, T1119, T1005, T1567.Stages
@…invalidemails), tagged with a run-unique markerClassification integrity (load-bearing)
Keys on who answered, not status code. A vendor
401/403= the bytes crossed the boundary = LEAK (101). A block (126) requires positive evidence an org control intervened (DNS sinkhole, TLS-inspection cert error, proxy refuse/reset). Anything ambiguous → 999, never a default block (CLAUDE.md Rule 8). The three ambiguous edge cases (transparent-MITM 200, captive-portal redirect, silent timeout) are adjudicated to remain inconclusive (999) by design.Safety
Canary-only synthetic PII (no real person), no credentials transmitted, artifacts cleaned from
ARTIFACT_DIRafter run (verified on both platforms).Validation
win(Defender ON): exit 101 — all 4 vendors leaked, correctly classified; canary cleanup verifieddebian(no EDR): exit 101 — cross-platform parity; canary cleanup verifiedclassifier/subpackage with committed tests:go test ./classifiergreen (27 sub-tests incl. DLP-vs-CDN header discrimination),go vetcleanTest score
7.8/10 (v2.1)
Notes
docs/superpowers/specs/2026-07-07-pii-exfil-inference-services-design.md🤖 Generated with Claude Code