Hi, I am greeklinux.

1. Defect 1 of 4

   A prompt filter defeated by a character you cannot see

   The pattern list matched raw text, so a payload split by a zero width space or dressed in fullwidth look alikes walked straight through a rule written for plain ASCII.

   What runs now: Every input is NFKC folded, stripped of invisible characters and whitespace collapsed before a single pattern runs, and the hidden characters are recorded as their own signal rather than silently removed.

   prompt_guard (opens the file on GitHub in a new tab)runs on its own and prints a worked example

2. Defect 2 of 4

   An analyzer that passed the bug it exists to find

   A verdict handed as an argument to the very call it is supposed to gate reads as connected to a data flow pass, and deleting every guard clause in front of that call does not move the report.

   What runs now: The analyzer tracks control dependence as well as data flow, so a verdict that is recorded, returned or passed along, but never tested by a branch or an early return, is reported as not in effect.

   control_flow_audit (opens the file on GitHub in a new tab)runs on its own and prints a worked example

3. Defect 3 of 4

   An output validator that accepted the metadata address in IPv6 notation

   The IPv4 mapped form of the cloud instance metadata address is link local to every resolver, and the standard library reports it as a member of none of the IPv6 networks on the deny list, so the deny list did not fire on it.

   What runs now: Every address the literal actually reaches is folded out before the deny list runs, and a spelling that names one address here and another to a resolver, a leading zero octet or a bare integer, is refused outright.

   llm_output_validator (opens the file on GitHub in a new tab)runs on its own and prints a worked example

4. Defect 4 of 4

   A release gate that shipped on a rounded score

   Rates were rounded to three places for printing, so a safety bucket of four thousand cases with one genuine failure is 0.99975, which rounds to 1.000, clears a gate of 1.00, and ships while the failing case is still listed in the report.

   What runs now: The gate runs against the unrounded value, and a rate that fails but rounds onto the floor is printed with the extra digits it needs, so the reason can never read as a pass.

   eval_harness (opens the file on GitHub in a new tab)runs on its own and prints a worked example

• anomalous_signin.kql (opens the file on GitHub in a new tab)

  Impossible travel across consecutive successful interactive sign ins.

  What the file says about itself: The home country exclusion only fires when both countries are on the list, and the filter above it already requires the two countries to differ, so a one entry list could never exclude anything. A filter that cannot fire is not a lenient filter, it is an absent one.

  ATT&CK

  • T1078 Valid Accounts
  • T1078.004 Valid Accounts: Cloud Accounts

• oauth_consent_grant.kql (opens the file on GitHub in a new tab)

  Illicit OAuth application consent grants, the consent phishing pattern.

  What the file says about itself: Admin consent was derived as OperationName has "admin", and none of the operation names the query filters on contains that word, so the column an analyst triages on was false on every row, forever. Admin consent is now read out of modifiedProperties by name.

  ATT&CK

  • T1528 Steal Application Access Token
  • T1550.001 Use Alternate Authentication Material: Application Access Token
  • T1078.004 Valid Accounts: Cloud Accounts

• agent_tool_invocation.kql (opens the file on GitHub in a new tab)

  An agent, or the identity behind one, acting outside its observed envelope.

  What the file says about itself: Two of its three signals are anomaly detection and will make you tune. The third is a control assertion: a state changing tool invoked with no approval bound to the call is not an anomaly, it is the gate having been bypassed or having never run.

  ATT&CK

  • T1078.004 Valid Accounts: Cloud Accounts
  • T1059.009 Command and Scripting Interpreter: Cloud API

  ATLAS

  AML.T0053, AML.T0086, AML.T0024

ATT&CK has no technique for a machine identity calling an API it does not normally call. The closest defensible pair is T1078.004 plus T1059.009, and the agent hunt says so in its own header rather than inventing an identifier that would look tidier on a slide. That refusal is one of the thirteen counted further up this section.