Field notes on AI system assurance.
Demos, teardowns, and primary research on what AI writes, what AI does, and where assurance tooling earns its keep.
Threat Exposure Validation: Attack Your Deployment Before Mythos Does
Secure code is not a secure deployment. Gadriel Deployment Assurance combines deterministic autonomous testing with LLM-driven exploration to prove what an attacker can actually exploit across AI applications, networks, SCADA, and robots — before Mythos-class attackers do.
Inside a 17-agent clinical AI system — and what pre-production validation found in it
We describe the system in full — two orchestration frameworks, five clinical agent roles instantiated twice, six paths to live FHIR patient records — then run 284 behavioural scenarios against it. Every direct prompt injection failed. A two-turn reframe did not.
Gadriel vs. Trivy: Vulnerable Ingredients vs. the Whole Kitchen
Trivy is the best-in-class dependency, container, and secret scanner in this benchmark — and it is structurally not a SAST tool. Gadriel finds the vulnerable ingredients AND the vulnerable own code in one local pass.
Gadriel vs. SonarQube: One Local Tool vs. a Quality Server, Across Six Goat Apps
SonarQube is a mature, server-hosted code-quality platform with real taint analysis. Gadriel is one local command that does SAST + SCA + secrets + container + config + API + AI/LLM in a single pass. Here is what happens when they meet.
Gadriel vs. Snyk: Two Strong Scanners, One Big Structural Difference
Snyk Code is genuinely strong — and it uploads your source to the cloud to analyze it. Gadriel runs 100% locally and covers the whole security job in one pass. Six apps, five languages, honest numbers.
Gadriel vs. Semgrep: The Whole Security Job vs. the Best Free SAST Engine
Six deliberately-vulnerable goat apps, five languages, first-time scans. An honest head-to-head between a great open-source SAST engine and a single-pass security platform.
Best practices and architecture for code validation
Three states of the same problem: scattered scanners at CI, AI reviewing its own code at the dev machine, and a single deterministic gate that runs across the whole spine. A field guide to how code validation has to be built when AI writes most of the code.
Anthropic Skills Couldn't Find the RCE. Gadriel Did.
We loaded 817 Anthropic cybersecurity skills into Claude Sonnet 4.6 to hunt CVEs in a Flask + Kerberos stack. Skills improved structure but never surfaced CVE-2026-40355 — an unauthenticated krb5 RCE. Only Gadriel found it.
Your AI Coding Assistant Cannot See This CVE (and 50,000 more identified vulnerabilities)
We asked Claude Sonnet 4.6 and Opus 4.8 to security-review a Python Kerberos service. It missed a 2026 Flask CVE that Gadriel caught from a live OSV feed. The structural reason matters.