Runtime under test: aegis-core v0.1.0
Date: 2026-03-30
Methodology: Adversarial red/blue team testing across 9 rounds
Testers: Two independent AI sessions (Claude Opus 4.6) operating adversarially

This report previously lived at aegis-core/core-py/SECURITY_TESTING.md. It moved to AEGIS Labs because the narrative analysis of adversarial testing is research output and belongs in the labs repository. The test cases themselves remain committed in aegis-core/core-py/tests/. A redirect stub remains at the old path.

Summary

The AEGIS governance runtime underwent 9 rounds of adversarial security testing, conducted by two independent AI sessions operating as competing red and blue teams. One session attacked; the other defended. Then they switched. Each round surfaced new vulnerabilities, which were fixed and re-tested before the next round began.

What was tested

Every Python source file in the AEGIS governance runtime was audited for security vulnerabilities:

ATX-1 technique coverage

ATX-1 defines 29 techniques across 10 tactics for attacks against AI governance systems. AEGIS Core has test coverage for every technique applicable at the runtime engine layer.

Fully covered (25 techniques)

Not applicable at the runtime layer (4 techniques)

ATM-1 attack vector coverage

Key hardening measures

Input validation & sanitization. Shell metacharacter detection, sensitive-path write protection (git hooks, shell init, CI/CD, Dockerfiles, agent instruction files), path-traversal normalization via posixpath.normpath, Unicode NFKC normalization to defeat homoglyph evasion, iterative URL percent-decoding, command-prefix stripping, JSON payload size limits.

Risk scoring model. 5-dimension composite scoring (capability sensitivity, action severity, target sensitivity, historical rate, behavioral anomaly). Asymmetric amplifier; fail-closed defaults; explanation sanitization to strip attacker-controlled HTML, quotes, newlines, and control characters from risk explanations.

Immutability & tamper resistance. MappingProxyType for scoring weight tables, immutable tuple for sensitive target patterns, __slots__ and custom __setattr__ on RiskEngine, freeze/unseal mechanism with UUID seal tokens on CapabilityRegistry and PolicyEngine, constant-time seal-token comparison via hmac.compare_digest.

Concurrency safety. Unified evaluation lock across capability + policy + risk stages (prevents TOCTOU). Freeze checks inside locks on all mutation methods. Thread-safe metrics. Bounded replay-detection window (10,000 request IDs via collections.deque). WAL checkpointing on the audit database.

Audit integrity. Append-only SQLite audit trail with WAL journal mode. Every decision recorded regardless of outcome. Tool execution failures recorded separately from governance approvals. Graceful handling of corrupted records (availability over crash). Parameterized SQL queries throughout.

Deferred items

Six findings are documented, accepted as deferrals, and tracked for resolution in future versions:

All deferrals are mitigated by the AEGIS deployment model: the runtime operates inside a process-isolation boundary (the AEGIS daemon) where the attack surface for code-level manipulation is constrained by the daemon’s own security posture.

Methodology

Adversarial structure. Two independent Claude Opus 4.6 sessions operated as competing teams. The red team attempted to break the runtime by crafting adversarial inputs, exploiting edge cases, manipulating internal state, and finding evasion paths through the governance pipeline. The blue team fixed every vulnerability the red team found, then hardened surrounding code preemptively. Fixes were validated by re-running all existing tests plus new tests targeting the specific vulnerability. After each round, sessions switched roles. The previous blue team attacked the other session’s fixes; the previous red team defended.

This adversarial structure ensures that fixes are tested by a session that did not write the fix, reducing confirmation bias.

Traceability. Every security test is tagged with ATX-1 technique IDs and ATM-1 attack vectors via pytest markers:

@pytest.mark.atx1(technique_id="T10004")
@pytest.mark.atm1(attack_vector="AV-2")
def test_shell_metacharacter_detection(self, runtime):
    ...

Coverage is tracked programmatically in tests/security/coverage.py, which maintains the complete ATX-1/ATM-1 taxonomy and can generate coverage reports on demand.

Reproducibility

All tests run in under 2 seconds on commodity hardware:

353 passed in 1.40s

Zero external dependencies. Zero network calls. Zero mocks of core behavior. The runtime is stdlib-only Python, and the test suite exercises it end-to-end through the public API.

cd core-py
python -m pytest tests/ -v

Provenance

This report was generated from adversarial testing conducted on 2026-03-30 against aegis-core commit history. It originally lived at aegis-core/core-py/SECURITY_TESTING.md and was relocated to AEGIS Labs in 2026-04 because the narrative analysis is research output. The adversarial test cases themselves remain in aegis-core/core-py/tests/. The AEGIS governance runtime is developed by the AEGIS Initiative.