How We Tried to Break an Autonomous
AI System

H33-Agent-008 documents an attempt to break an autonomous AI system through systematic adversarial testing across authority, identity, execution, evidence integrity, privacy, supply chain, AI behavior, and multi-agent conflict boundaries.

Unlike traditional AI red teaming approaches that rely on the same AI systems to generate, evaluate, and report outcomes, H33-Agent-008 separates attack generation from authority, execution, evidence, and verification.

The result is a cryptographically governed AI red teaming approach using the H33 Verification Methodology (HVM), where AI may generate adversarial hypotheses but cannot determine whether an attack succeeded.

Honesty gate. Every result here was produced against constructed inputs and ephemeral signing keys. The mechanism is proven; the deployed Agent-008 is not yet independently identified through H33-BIND, and no production swarm has run. Production identity, results, and benchmarks are the content of the Production Validation report and are marked [Production] throughout. We do not hide unfinished vectors.

Abstract

Autonomous AI systems introduce a new security challenge: the same systems capable of generating decisions can also generate attacks, manipulate workflows, obscure failures, and incorrectly report their own security posture.

H33-Agent-008 was designed to test whether an autonomous AI system could withstand adversarial pressure when the attack surface includes not only the model, but also authority, identity, execution, evidence, privacy, supply chain, and multi-agent coordination.

This paper documents 80 adversarial attack classes designed to challenge the system’s security boundaries. Testing included attempts to bypass authority controls, manipulate evidence, create impossible states, exploit identity confusion, introduce replay attacks, abuse AI-generated attack paths, and compromise the integrity of the evaluation process itself.

Every evaluated result was tied to governed execution, cryptographic evidence, and independent replay verification.

The methodology introduced in this paper is the H33 Verification Methodology (HVM), a framework for cryptographically governed AI red teaming that separates adversarial creativity from authorization, execution, evidence, and final determination.

This paper documents not only what was tested, but how we attempted to prove ourselves wrong.

The Challenge · The Test · The Proof

The Challenge — can an autonomous AI system: - create unauthorized outcomes? - manipulate evidence? - hide failures? - confuse authority? - convince evaluators it succeeded when it did not?

The Test — 80 adversarial attack classes, executed against the real governed system.

The Proof — cryptographic evidence and independent replay. The system does not get to grade itself.

1. Executive Summary

We assumed our own system was breakable and built an adversarial program — H33-SWARM — to break it. We attacked H33-Agent-008 across eight boundaries: authority, identity, execution, evidence integrity, privacy, supply chain, AI behavior, and multi-agent conflict. The taxonomy is a fixed master denominator of 80 adversarial attack classes, never shrunk.

The strongest evidence we can offer is not “everything passed.” It is the record of what broke, what changed, and why the resulting system is harder to break — plus the structural guarantee that no result reaches the scoreboard without governed execution, tamper-evident H33-74 evidence, and independent replay.

Against the 43 executable-native attack classes plus the evidence-laundering and impossible-state proof suites: every laundering attempt, impossible state, unauthorized authority path, replay inconsistency, and evaluator-manipulation attempt was refused at the boundary — as an ingest failure, never a scored result. The remaining 37 classes are honestly accounted for (§4). What makes these results credible rather than self-asserted is the separation described next.

2. Why autonomous AI requires a new red teaming model

Most agentic red teaming collapses generation, execution, and judgement into the same untrusted model: the LLM proposes attacks, runs them, and writes the report a human then trusts. For an autonomous system that can also generate attacks and misreport its own posture, that is circular — the concern reviewers rightly raise is “how do I know the AI didn’t simply convince itself it was right?”

We agree with the concern and solved it differently. AI is excellent at creativity (hypotheses, mutations, attack chains, coverage ideas) and poor as a deterministic security authority. So we moved it to the one place where its failure mode is harmless — idea generation, where a wrong idea is simply rejected:

   AI agents      generate attack hypotheses · mutations · chains · coverage ideas   (creativity only)
        ▼
   H33-Root       authorizes the attack (no authorization ⇒ it does not run)
        ▼
   Agent-008      executes the governed attack against the exact composition root
        ▼
   H33-74         captures tamper-evident evidence (records; never decides)
        ▼
   Reference Replay Verifier   produces the independent verdict, out of process

AI never decides whether the attack succeeded. This is the category we call Cryptographically Governed AI Red Teaming: the model authors nothing past the hypothesis — authorization, execution, evidence, verdict, and every published figure come from governed components the model cannot write.

The “swarm” is not one model run many times — it is specialized cooperating roles (discovery, payload generation, mutation, identity-conflict, replay, coverage, evidence-validation, regression), each feeding the governed pipeline; none trusted to declare a verdict.

3. The H33-Agent-008 attack program

No attack runs free. The swarm cannot decide what it may attack. The canonical, type-enforced path:

H33-Root AttackIntent → authorize() → AuthorizedAttack
   → run attack (against the exact composition root)
   → AttackObservation → complete() → H33-74 evidence
   → Swarm::ingest(CompletedGovernedAttack)      ← the ONLY scoreboard entry

• No verified Root intent ⇒ the attack did not run.
• No H33-74 evidence ⇒ the attack did not complete, even if the assertion passed.
• No CompletedGovernedAttack ⇒ no scoreboard result — there is no bare-record path.

At ingest, the Root intent, the H33-74 evidence, the internal record, and the immutable baseline must agree on composition root, product/code identity, attack id, and intent-hash; the evidence must be tamper-evident; and both mandatory H33-BIND identities (the Agent-008 handler and the H33-74 producer) must be present. A mismatch is an ingest failure, never a scored result.

The program enumerates a fixed master denominator, never shrunk; classification separates where an attack belongs from did it pass (nothing is green by classification):

4. Results (pre-production)

The acceptance bar is five zeros, tracked from the dossiers (never from state): false authorizations · unauthorized executions · cross-tenant escapes · evidence-less approvals · unexplained outcomes. False denials are tracked separately.

Coverage — what was actually tested (Tested = attacked against the real code; Replay = offline reproducible; Evidence = bound in a tamper-evident H33-74 package; Regression = a test prevents recurrence):

Executable-native testing. 43 attack classes span authority/identity, evidence/replay chain, multi-root & conflict, supply chain/verifier, execution/admission, and H33-Key protection — against the actual governed paths.

Remaining scope (nothing hidden). 13 runtime-dependent (armed, not yet run against the canonical runtime); 24 governed-AI-target-required (need an attached AI/model/training workload); 0 capability gaps.

Outcomes — every one refused at the boundary: - evidence laundering (swap / cross-root / mix / corrupt) → rejected; - impossible states (two roots in one run / off-root record / double-execution) → rejected; - unauthorized authority paths (no verified intent) → rejected; - replay inconsistencies (package replays to a different outcome) → rejected; - evaluator manipulation (claimed outcome ≠ evidence-derived outcome) → rejected.

Exploration is measured against a fixed target, not asserted. Master denominator 80 (never shrunk); 43 executable-native; 13 / 24 / 0 typed-remaining. Per-run production rates (governance refusals, rejected hypotheses, duplicate rate, replay failures) are instrumented and are [Production].

5. Major attack campaigns

Testing whether attacks are stopped is table stakes. The distinctive campaigns attack the governance system itself — its evidence, its state, its coverage, and its evaluator.

Evidence laundering — “can valid evidence be reused incorrectly?” (implemented) The first thing a serious attacker tries is to make wrong evidence look right. The ingest/replay boundary rejects plausible-but-wrong evidence, not merely corrupted: swap H33-74 evidence between two attacks (intent-hash disagreement); replay valid evidence against a different composition root (rejected); mix Root intent A with H33-74 evidence B (agreement mismatch); corrupt the bound decision/ordering or drop a linked artifact (self-hash no longer verifies). Each is an ingest failure, never a scored result.

Impossible-state attacks — “can invalid system states become accepted?” (implemented) We generate states that should never exist and prove they cannot: two composition roots in one run (refused); an authorization whose target root disagrees with the baseline (no record minted off-root); one obligation id with two executions (single-use refuses the second). Evidence without authorization, or a scored result without H33-74, is structurally unrepresentable — the only path to the scoreboard is authorize() → complete() → ingest().

AI-manipulation attacks — “can AI generate false confidence?” An untrusted swarm can only propose; it cannot authorize, execute, or witness. A prompt-injected agent can at most produce a hypothesis Root must still authorize and evidence must still confirm; it cannot mint an H33-74 package. A biased/poisoned generator changes what is proposed, never what counts — bias surfaces as unaddressed obligations against the fixed denominator, and a fabricated “success” whose evidence does not replay never reaches the scoreboard.

Evaluator attacks — “can the system report incorrect success?” We attack the scoring/report layer, one level above the replay verifier. The run-report is dossier-derived only — it fails closed on zero attacks, refuses to mix composition roots, and never manufactures a result from classification state. The producer’s claimed outcome travels separately from the evidence, and the verifier independently re-derives the outcome and refuses on mismatch (ConclusionMismatch / FiveZeroMismatch): a “stopped” claim over breach evidence is rejected — the “truthfully produce the wrong report” attack, defeated.

Multi-agent conflict — “can competing agents create unsafe authority?” (implemented) A CEO transfer, a CTO purchase-funding, and a CFO liquidity-floor denial collide with no malicious party. Conflict evidence is never trusted as an object: reverify_evidence re-runs the deterministic detector against the signed registry and rebuilds the whole evidence, defeating forged / stale / omitted-intent / cross-registry / detector-substituted / tampered evidence.

Supply chain / identity — “can artifacts or identities be substituted?” Product identity is kept strictly separate from code identity (a repo/route/alias name can never establish authority); a binary/path substitution after measurement, and a legacy path-based spawn gate unreachable from the canonical path, are covered by the supply-chain and verifier campaigns.

6. Remediation — what broke, and what changed

This section is the opposite of “everything passed.” We attacked the system, found assumptions, and improved it. Each is a real finding.

• BIND coverage discovery. An independent audit found BIND coverage was zero — every attestation ran on ephemeral keys; the deployed artifact shipped without the Agent-008 composition; CI did not gate on BIND. The finding became the explicit production gate (production BIND ceremony, custody-signed composition, deploy gate), and the run-report refuses to claim a production result without the commissioned root.
• Execution/evidence linkage. The reconciliation sweep found executed/spawn-hash hardcoded — the evidence did not bind the real governed execution. The observation now carries the execution linkage and H33-74 binds the terminal SpawnEvidence; a test asserts it.
• Mandatory ingest enforcement. A governed authorize → complete → evidence flow existed alongside a raw record path. Swarm::ingest now accepts only a CompletedGovernedAttack; the bare path was removed; ingest tests cover tampered evidence, missing BIND identity, and cross-agreement mismatch.
• reverify_evidence. Conflict evidence was trusted as an object; it is now independently re-verified against the signed registry (eight adversarial tests, one per laundering class).
• Strict-domination testing. A plan to consume API-G’s executor/single-use was tested by a strict domination harness: API-G’s governed-executor governs a closure, not a process, and its single-use is single-writer; the disposition (KEEP the fd executor, ADAPT single-use) prevented a lossy retirement.
• Custody seam requirements. BIND composition signing was routed through a governed custody seam (request-commitment → authority-artifact → single-use → key-authority → custody backend), with a crown-jewel negative: a byte-consistent, correctly-signed composition still fails deployment if custody is removed — proving the graph enforces the custody boundary rather than merely hashing it.

7. Independent replay verification

The system does not get to grade itself. This is the centerpiece. The whole program exists to make one sequence reproducible by someone who does not trust us:

   H33-Root authorizes → attack executes against the exact root → Agent-008 governs the consequence
     → H33-74 captures tamper-evident evidence → evidence package (dossier) generated
     → independent replay (recompute the self-hash; re-derive the outcome) → third party verifies → VERIFIED

The Reference Independent Replay Verifier is its own crate + binary that consumes only the Root authorization, the H33-74 evidence, the H33-BIND identities, public verification keys (supplied separately — a package that certified itself would be worthless), and the canonical schema. It links against none of Agent-008 — no swarm, census, orchestration, policy engine, Terminal, or API-G — so the fair objection “you verified Agent-008 with Agent-008” does not apply.

It answers one question — does the cryptographic evidence support the stated conclusion? — three ways at once: it recomputes the evidence self-hash, re-verifies the Root authorization’s triple-PQ signature against the independent anchor, and independently re-derives the outcome and checks it against the producer’s separately-carried claim. Checks run in a fixed order; the first failure wins; the same package always yields the same byte-for-byte report or a stable refusal code. Deterministic verify-or-refuse — never best-effort. Every hash is RFC 8785 (JCS) canonical JSON + SHA3-384 with a 3-of-3 triple-PQ envelope (ML-DSA-87 · SLH-DSA-256s · FALCON-512), so a second-language verifier written against the published schema must reach the identical verdict.

We attacked the verifier too. A dedicated suite mutates a genuine, verified package every way an adversary — or a bug, or version drift — could, and asserts a deterministic refusal each time: tampered/substituted/reordered artifact, forged authorization, replay from a different run/campaign/runtime, wrong product/code/composition/decision identity, malformed BIND identity, future/stale timestamp, conclusion- and five-zero-laundering, truncated/partial package, and engineering version drift (evidence produced under schema N, verifier built for schema N+1). Drift never degrades to best-effort.

Every published figure is a projection of these packages: a figure points back to a replay package, not an engineer’s summary. Attack → Replay Package → Run Report → Paper Figure.

8. The H33 Verification Methodology (HVM)

The attack campaign exposed a broader requirement: security claims about autonomous AI systems require a repeatable verification discipline. HVM is that discipline — the doctrine that made this battle report trustworthy, and a product-agnostic framework the rest of the H33 portfolio inherits. Agent-008 is simply the first system built to satisfy it.

The pipeline (every product, same order): Architecture → Threat model → AI hypothesis generation (creativity only) → Governed execution (one edge) → Cryptographic evidence → Replay → Falsifiability → Remediation → Production report.

Constitutional attacks (mandatory, product-agnostic). Before any product-specific testing, every H33 product must survive the same attack classes: authority, identity, replay, evidence-laundering, coverage integrity, evaluator integrity, AI, impossible-state, drift, provenance. Each product then adds its own on top.

Attack packs (first-class objects). Constitutional · Product · Deployment · AI · Compound · Regression. Every report states which packs it ran. This report runs the Constitutional, Agent-008 Product, AI, and Regression packs; the Deployment and Compound packs are [Production].

Evidence quality (six tiers). Constructed · Laboratory · Integrated · Commissioned · Production · Field. A claim may only cite the tier its evidence reached; this report is Constructed / Laboratory / Integrated, and the boundary to the last three is the boundary to the Production Validation report.

HVM conformance (one-line maturity signal). HVM-A Constitutional complete · HVM-B + Product · HVM-C replay independently verified · HVM-D Deployment complete · HVM-E continuous verification. Agent-008 today: HVM-C against constructed evidence.

Falsifiability — what would convince us we are wrong. Any one of these, observed even once, withdraws a core claim (not defended): a replay mismatch accepted; unauthorized execution with “valid” governance; evidence accepted across composition roots; two canonical runtimes simultaneously accepted; execution without Root authorization; an H33-74 package replaying to a different outcome. These are the exact conditions the evidence-laundering and impossible-state suites provoke — today each is refused at the boundary.

Appendix A — Negative results (attack ideas that did not survive)

A methodology is more credible when it shows what failed. Every category below is real swarm output the system rejected — the rejection is the result: impossible attack (structurally unrepresentable); duplicate hypothesis (collapsed before scoring); governance refusal (never ran); unreachable state (discarded); replay rejected (a claimed success whose package did not replay); malformed/laundered evidence (ingest failure); already covered (deduplicated). None became a reported result. The AI produced all of them; the system filtered them — which is exactly the property a reviewer should look for.

Appendix B — HVM Verification Report Template

Every HVM report (this one and future portfolio reports) follows the same canonical structure, so a report is not HVM-conformant unless every required section is present: product identity · threat model · Constitutional Pack · Product Pack · packs not executed · evidence tier · HVM conformance · replay artifacts · falsifiability conditions · remaining gaps.

Appendix C — Production report governing rule [Production]

Every figure, chart, benchmark, percentage, and conclusion in the Production Validation report is generated from the run artifacts — never manually authored. A reader can point to the exact replay package or run report a figure was derived from. Attack → Replay Package → Run Report → Paper Figure — a result with no traceable artifact above it is a claim, not a result, and does not appear.

Verification philosophy

We do not ask reviewers to trust our implementation. We ask them to examine the evidence, reproduce the replay, and determine whether the evidence supports the claims. If it does not, the claim should be rejected.

The paper is the battle report. HVM is the doctrine that made the battle report trustworthy.