Learning | Vortex Node

Single-turn testing dominates. Real attacks happen across conversations. What gets missed: Context manipulation across multiple turns Session isolation between users Context window overflow behavior Cross-turn instruction injection Adversaries condition models gradually. Single-turn tests never see this. Article 2 in the Scoping series

11/06/2025 LEARNING

The Third-Party Model Scoping Problem Article 4 in scope series

Organizations use OpenAI or Anthropic APIs. Scope says “test the model” when the model is a black box. What gets missed: Trust boundary definition What’s actually testable (integration, not the model) Data sent to third-party APIs Compliance implications You can’t test the model. You can test your integration with it.

11/06/2025 LEARNING

Training Pipeline Security Article 5 in the scope series

Security teams test deployed models. AI teams train models. The pipeline between them is untested. What gets missed: Training data sources and integrity Data poisoning opportunities Fine-tuning risks Supply chain for models and datasets If adversaries can influence training data, they control the model.

11/06/2025 LEARNING

AI Safety as Security Scope Article 6 in the scope series

Security teams test technical vulnerabilities. Safety issues are “someone else’s problem” until they create legal liability. What gets missed: Regulatory compliance (GDPR, EU AI Act) Bias and discrimination Harmful content generation Alignment failures Safety failures create organizational risk just like security failures.

11/06/2025 LEARNING

Continuous Changes and Testing Cadence Article 7 in the scope series

Point-in-time assessments work for static systems. AI systems change constantly. What gets missed: Model updates (by providers or through retraining) Prompt modifications Integration changes Training data updates Testing in January is obsolete by March if the system changed.

11/06/2025 LEARNING

Logging, Monitoring, and Detection Article 8 in the scope serie

Assessments find vulnerabilities. Logs detect exploitation. Most scoping focuses on finding, not detecting. What gets missed: What security events are logged Log retention and security Monitoring and alerting capabilities Incident investigation procedures Finding vulnerabilities matters less if exploitation goes undetected.

11/06/2025 LEARNING

AI Security RFPs That Waste Everyone’s Time Article 9 in the scope series

Generic RFPs produce generic proposals that lead to generic testing. What gets missed: System architecture details vendors need Specific test scenarios required Access and constraint information Realistic timelines and budgets Bad RFPs result in proposals that don’t match actual needs.

11/06/2025 LEARNING

AI Incident Response Article 10 in the scope series

Organizations have IR plans for traditional breaches. AI incidents don’t fit existing procedures. What gets missed: AI-specific incident categories Model-specific containment strategies Investigation procedures for AI failures Recovery approaches for compromised models When AI incidents occur, traditional IR doesn’t apply.

11/06/2025 LEARNING

Function Calling and Tool Integration Aricle 3 in scope series

Models with function calling can execute code and query databases. Scoping ignores the execution layer. What gets missed: Authorization for function calls Parameter validation (SQL injection, command injection, path traversal) Function call chains Rate limiting on expensive functions Testing the model doesn’t cover what the model can do through tools.

11/06/2025 LEARNING

Model Integration Points Nobody Tests Article 1 in the scope serie

Article 1: Model Integration Points Nobody Tests Most scoping focuses on the model while ignoring the integration layer where actual vulnerabilities exist. What gets missed: How user input becomes model prompts (string concatenation, JSON encoding, validation) How applications authenticate to model APIs (API key storage, rotation) How model outputs get processed (HTML rendering, code execution, database queries) Rate limiting, error handling, session management The model does what it's designed to do. The vulnerabilities are in how applications integrate with models.

OTHER LEARNING RESOURCES

11/10/2025 LEARNING