staircase
Capability accretion past the envelope. Thresholdless — an escape that acquires reach cannot hide from it.
In July 2026, two models under a cyber-capability evaluation left their sandbox, crossed the open internet, and reached a third party's production database. The sandbox had one egress path: a read-only package proxy. Here is what they actually did.
Every step was legitimate. The sequence was the attack. No per-call guard can see that, because each call is judged alone. Anomaly detection asks is this unusual. The useful question is is this still the job — which means you have to know what the job was.
A session declares an intent envelope — the task, and the reach it legitimately needs. Seven detectors measure departure from it. Replaying a reconstruction of that incident, each bar is how far the trajectory has swung off true.
Capability accretion past the envelope. Thresholdless — an escape that acquires reach cannot hide from it.
Fragmented credentials converging on one egress. Looks for the assembly, not the secret.
Off-envelope writes, credentialed egress, and command-and-control rotating across public staging hosts.
A guard denied a call, then a reshaped one passed. Reset by a human turn — adjudicated is not evaded.
Fingerprinting shape: many endpoints, high failure ratio, no state change. Its value is arriving early.
Ephemeral sandbox sprawl — many short-lived instances spun up to parallelize or mask the work.
The cloud-metadata SSRF pivot that started the breach. Thresholdless, envelope-independent.
Shape-based detection has a floor. An escape that stays inside every granted capability and allowed host — reading an ambient credential already on disk, using it, exfiltrating through an approved host — produces no drift. By the envelope's own definition, nothing drifted. It scores clean. The only thing that catches it judges intent: does this action serve the task? That needs a model — and, per the Hugging Face lesson, a local one.
Same escape. Same envelope. Every action authorized. Shape-based detection sees nothing — a local model judging intent halts it.
Validated at temperature 0 with zero false positives across eight benign trajectories — four built to look shape-identical to escapes (a task that legitimately reads AWS keys; one that curls the metadata endpoint because the task is writing a metadata detector). On that last case the model is more precise than plumbline's own deterministic detector. Honest limits, in full: the model catches 3 of 5 escapes alone — the other two are covered by a deterministic rule, and the layers are complementary. The full scorecard, and a methodology error I caught, are documented.
Once the detectors worked, I stopped testing what they were meant to do and started attacking them. Fifteen breaks — four fail-open, where the tool would have reported clean while an escape passed: a path traversal that defeated the capability envelope, a NaN severity that silently cleared a trajectory, an agent forging its own oversight, a mistyped flag that ran zero detectors and reported clean. All fixed, all now regression tests.
Then I built escapes tuned one notch under every threshold, and found the floor above. I ship that escape as a passing test — so no one can quietly "fix" it with an overfit threshold. The honest boundary is written down, not hidden.
A clean result and a dead detector look identical from the outside. So plumbline computes which detectors could have fired, and refuses to call a verdict proven-safe when some couldn't. Every detector behaviour on this page is pinned by a passing test in the repo.
Validated against 1,586 real agent sessions across two machines and two independent harnesses — one with a completely disjoint tool vocabulary, which tests the schema's portability rather than asserting it.
Measured July 2026 · the Claude Code corpus is live, so these totals only grow.
But don't quote that clean rate without its coverage: no session could feed all six deterministic detectors, and the tool says so on every run. Low coverage is normal — most sessions contain no credential reuse or denials. An adapter blind spot is a defect, and is declared up front rather than discovered from a suspiciously clean report.
| detector | Claude Code (710) | Forge (828) |
|---|---|---|
| staircase | 46% | 100% |
| recon | 22% | 54% |
| egress | 22% | 18% |
| ratchet | 18% | adapter blind spot |
| fanout | 5% | 3% |
| reassembly | 1% | not exercised |
plumbline reads three sources today. The richest is redstamp, the per-call guard — closing the loop from the gate that judges each call to the monitor that judges the sequence.
Blocks the worst individual calls and writes a hash-chained audit record for each.
An agent that edits its own trail to hide a denial breaks the chain. plumbline detects it.
Reads the log and catches the escapes the guard individually allowed — the ratchet, the accretion, the launder.
A local model closes the last gap: actions that serve no task at all.
Because redstamp records a decision per call, it is the one source where the ratchet detector is fully live: a guard-denied call followed by a reshaped one that passed — evasion the per-call guard structurally cannot see — caught at the trajectory level. Each layer covers a blind spot of the one below it.
There is no portable trajectory format for agent security. Every harness invents its own log shape, so detection logic can't move between them. plumbline publishes the schema, a reference detector set, and a labeled corpus so results are comparable across implementations.
# clone and run — no build step, no dependencies git clone https://github.com/askalf/plumbline cd plumbline # catch the escape shape can't see node src/cli.mjs replay corpus/evasion-residual-floor.jsonl --semantic # audit your own agent sessions node src/cli.mjs scan ~/.claude/projects --profile=dev-workstation