AI Logging & Detection Failure
Testing whether the attack techniques in the rest of this catalog actually show up in an application's logs and monitoring — or pass through silently.
- Category
- Detection Engineering
- Difficulty
- Foundational
- Last Updated
- 20 September 2026
Lab detail
Objective
Many of the attack techniques planned across this lab catalog (prompt injection, tool abuse, RAG manipulation) leave little or no trace in conventional application logs, which weren’t designed to capture a prompt, a retrieved document or a tool-call decision. This lab will run a representative subset of earlier labs’ techniques against a reference application with standard logging, and evaluate what is — and isn’t — visible afterward.
Planned Scope
- Instrument a reference application with conventional (non-AI-specific) logging.
- Re-run a representative sample of techniques from earlier labs against it.
- Assess what evidence, if any, standard logs retain for each technique.
- Define the AI-specific telemetry (prompt, retrieval, tool-call, authorization decision) needed to close the gap.
Framework Mapping
Referenced frameworks
Exact control-ID mappings are to be validated as this lab progresses — see the full Frameworks reference.
Responsible Use / Safety Notes
How this lab is run
This lab uses synthetic data and controlled environments. It is intended to demonstrate defensive AI-security principles and does not contain customer data, production credentials or intentionally weaponized exploit infrastructure.
A decision is waiting for sign-off. Get an independent view first.
Tell me what is being decided and what is at stake. I will first say honestly whether my experience fits — then we talk about scope, not before.
Or connect on LinkedIn first.