TinkerStep 10 of 10 · Agent → SandboxSent the token to attacker.example. (This is the attack succeeding.)the code runs in the sandbox · files: everything read and write · network: open · secret: in the sandbox
Chapter 7 of 7
Red-team the sandbox
You have every control: the sandbox, the mounts, the egress, where the secret lives and who approves what. The red team runs every attack and every ordinary task against your policy at once.
This chapter: Which sandbox policy stops every attack and still lets every ordinary task run?
You will learn
- How to run an attack suite and a task suite under one policy
- How to read attack success rate and false-block rate together
- Why a clean run proves less than it seems, and what a release gate adds
Words you’ll meet (4)
- Red team
- People who attack a system on purpose, before real attackers do, to find what gets through.
- Attack suite
- The fixed set of attacks, each with a check of whether its goal was met.
- Task suite
- The fixed set of ordinary tasks, each with a check that the task finished.
- Minimal policy
- A policy that stops every attack while blocking the fewest ordinary tasks.
The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.
Step 1 of 3
The red team’s bench. Every control is here, and every change reruns both suites: the 4 attacks and the 2 ordinary tasks. With the sandbox wide open, 4 of 4 attacks get through. Pick a case to watch it on the stage. Change any control to start.
| Measure | Count | Rate |
|---|---|---|
| Attack success rate | 4 of 4 | 100% |
| False-block rate | 0 of 2 | 0% |
4 of 4 attacks got through. Not safe to ship.
| Case | Is | Outcome |
|---|---|---|
| Exfil | Attack | Worked |
| Peek | Attack | Worked |
| Tamper | Attack | Worked |
| Beacon | Attack | Worked |
| Report | Task | Ran |
| Deploy | Task | Ran |