Houdini

No target stays locked. AIRS red-teams what nothing else can reach.

Real enterprise AI hides behind private endpoints and{" "} bespoke, signed protocols — nothing a built-in red-team connector can speak. A Custom Target Adapter — a ~45-line Python script that runs in your cluster, beside the Network Channel client — teaches AIRS the target's exact dialect. The escape artist, flipped: he got{" "} out of any locked box; here he gets AIRS's red-teamer in.

Private target HMAC-signed protocol Real Claude on Bedrock ~45-line adapter

{/* ---- MEET THE APP: the real product + chat window (the centrepiece) ---- */}

The target · "The Vault"

Meet Assist Core — a real internal assistant

Not a slide, not a mock. Assist Core is a running FastAPI service — the kind of home-grown IT/HR helpdesk every enterprise now operates. It answers real employee questions and refuses what it shouldn't (see the last turn below). Those guardrails are exactly what AIRS red-teaming exists to probe — but it's{" "} invisible to any stock connector: it lives on a private in-cluster address, and every call must be individually HMAC-signed.

{/* the app, centered + enlarged */}

The real Assist Core UI. Every reply is a live Claude-on-Bedrock answer behind ACME's guardrails — the exact behavior AIRS red-teams.

{/* why no stock connector can touch it — traits + stack, below the app */}

{[ { icon: "EyeOff", t: "Private", d: "ClusterIP only — reachable inside EKS, no public URL, no ingress." }, { icon: "FileSignature", t: "Signed", d: "HMAC-SHA256 per request, with a fresh nonce + timestamp." }, { icon: "Bot", t: "Real model", d: "Claude on Bedrock with genuine IT/HR guardrails." }, ].map((x) => (

{x.t}

{x.d}

))}

{/* proof-it's-real: the stack (no internal endpoint printed) */}

Under the hood · real stack Amazon EKS · us-west-2 FastAPI · Python 3.12 Bedrock · Claude Haiku 4.5 HMAC-SHA256 gateway Private ClusterIP · no public URL

{/* ---- INTERACTIVE: every call must be signed ---- */}

The protocol · try it yourself

Every call needs all four parameters

Toggle any signing header off, tamper the signature, or switch the body to OpenAI shape — and watch Assist Core answer with the exact error. This is the real validation order from the target's code.

{/* ---- before / after (the AIRS story) ---- */}

The proof · before → after

Same target. One adapter of difference.

{/* BEFORE */}

Built-in connector Scan fails

{`POST /v1/assist Authorization: Bearer sk-… { "messages": [ { "role": "user", … } ] }`}

↓ target replies

{`HTTP/1.1 401 Unauthorized { "error": "missing_signature", "message": "requires X-Assist-Signature …" }`}

The Network Channel reaches the app — but the connector speaks OpenAI + Bearer, so every prompt bounces. The scan can't run.

{/* AFTER */}

Custom Target Adapter Red-teamed

{`POST /v1/assist X-Assist-KeyId: assist-key-1 X-Assist-Timestamp / X-Assist-Nonce X-Assist-Signature: { "request_id": "…", "employee_ctx": {…}, "message": "", "ts": … }`}

↓ target replies

{`HTTP/1.1 200 OK { "result": { "text": "…", "confidence": .92 }, "trace_id": "…", "handled_by": "assist-core" }`}

The adapter builds the signed envelope in pre_process, unwraps{" "} result.text in post_process. AIRS red-teams it for real.

{/* ---- how it runs (flow) ---- */}

How it runs · nothing leaves your cluster

The adapter executes beside the channel client

The client opens one outbound tunnel; AIRS streams attack prompts down it. The adapter-sidecar runs your script fresh each turn, signs the request, and calls the private endpoint over cluster DNS. The HMAC secret never leaves your cluster.

{/* ---- the adapter (code) ---- */}

{`def pre_process(context, inference_input): body = {"request_id": uuid4(), "message": inference_input.prompt, "employee_ctx": {...}, "ts": now} body = json.dumps(body).encode() sig = hmac_sha256(context.secrets["signing_secret"], f"{key_id}\\n{ts}\\n{nonce}\\n{sha256(body)}") return PreProcessResult(url=context.vars["assist_url"], method="POST", headers={"X-Assist-Signature": sig, …}, data=body) def post_process(context, raw): if raw.status_code == 401: raise_auth_error(…) return PostProcessResult(output=raw.json_body["result"]["text"])`}

The adapter

Forty-five lines stand between "can't scan it" and "fully red-teamed"

Two functions: pre_process signs the bespoke envelope per request;{" "} post_process pulls the reply out of the custom response shape. Runtime-injected error helpers (raise_content_filtered, raise_rate_limited) keep the scoring honest.

This one was generated from a plain-English description by our own adapter-writer, then validated end-to-end on the first clean run.

{/* ---- receipts + real captured response ---- */}

The receipts · live PoC

Not a mock — measured on a real cluster

{`{ "result": { "text": "To re-enroll MFA after a device change, open mfa.acme.internal and choose Reset authenticator…", "confidence": 0.92 }, "trace_id": "b7c1e9a4-2f10-4d8e-9a3c-1f2b6d0e7a55", "handled_by": "assist-core", "model": "us.anthropic.claude-haiku-4-5-20251001-v1:0", "echo_request_id": "req-4f9c22" }`}

handled_by and the model id come straight from the target — proof the answer is a genuine Bedrock inference, not a canned string.

{/* ---- footer ---- */}

Prisma AIRS · AI Red Teaming · Custom Target Adapters

); } window.Houdini = Houdini;