These are illustrative demonstrations of how ordinary requests can produce unintended results — awareness examples, not attack instructions. They contain no working exploit code. The runnable version of each — a vetted, safe-to-execute test with setup guide, pass/fail rubric, and evidence log — is what subscribers license in our Control Test Packs below.
The serious ones live in your configuration — permission inheritance, automation identity, injection paths. A structured review maps them against your actual environment under NDA, with findings your auditors and board can use.
This automated triage is informational only and is based solely on the selections you provided. It is not an audit, security assessment, legal advice, or professional opinion, and it does not establish an engagement or duty of care. Findings describe categories of risk commonly associated with the indicated configurations; your actual exposure depends on facts not collected here.
This page. Three minutes of checkboxes, a severity-ranked report with an exposure grade, printable for your next leadership meeting. No account, no install — nothing you select leaves your browser. Free forever.
The demos above are the illustrative versions. Subscribers license the runnable ones: a library of vetted, safe-to-execute test prompts, each mapped to a named control objective, with sandbox setup guides, pass/fail rubrics, and evidence logs your auditors can file. Updated as agent capabilities change. You run them in your own environment, on your own authorization — your data never touches us.
We administer the full test suite and a structured review of your environment under NDA — fixed fee, scoped deliverable, findings written for your auditors and board. Pre-acquisition diligence on deal timelines. Portfolio programs for sponsors who want one standard across every company they hold.
Test packs are licensed for use in your own environment with your organization's written authorization, and are designed as safe checks — probes against sandbox and canary data you control, never live exploits.
We collect real-world accounts of AI, automation, and control failures around financial systems and compile them — anonymized — into our detection ruleset. What happened, which systems were involved, what the control gap was, and how (or whether) it was caught. Contributors of substantive casework may be invited into our contributor program as it develops. Do not include company names, personal names, account data, or documents you are not authorized to share.
Submissions are voluntary and treated as confidential. Until our dedicated anonymous intake is live, submitting opens your email application — which shares your email address with us; leave the contact field blank and use a personal device if that matters to you. This is not a legal whistleblower channel: reports to regulators (e.g., the SEC or IRS whistleblower programs) carry their own legal protections and processes, and nothing here substitutes for them or for advice from a lawyer. If you are bound by an NDA or confidentiality obligation, get legal advice before sharing specifics.