Free lab · no signup · 3 rounds, about 4 minutes each
Agent Defence-Evasion Hunt
An intruder who gets into your Claude organisation will try to turn the lights off before doing anything noisy. Widen the IP allow-list, drop approval on a tool, redirect telemetry, switch an agent to bypassPermissions, shorten local retention.
Watch an overnight feed of admin events, Claude Code and Cowork telemetry and endpoint changes. Call each event, link the intruder's steps into a chain, and see what to check next for every one. Planned changes with tickets are mixed in to test your judgement.
Loading the feed…
Synthetic training data: the organisation, people, hosts, tickets, domains (.example) and IP addresses (RFC 5737) are invented. Names in code style are event and setting names listed in the Invictus report; payloads are illustrative, not exact schemas.
Did the actor weaken visibility or enforcement?
That is the question Invictus Incident Response asks at its third investigative starting point, defence evasion. The evidence and the control to check sit in three places:
| Where | Evidence (as listed in the report) | Controls to check |
|---|---|---|
| Claude Enterprise | Compliance API, SSO, directory sync or inference hook changes; org_ip_restriction_*, mcp_tool_policy_updated, org_connector_domain_guard_updated, org_cowork_* | Compliance API settings, SSO and directory sync, IP restrictions, inference hooks, encryption keys, tool policies, connector domain guard, Cowork permission modes |
| Claude Platform | Compliance settings, workspace retention settings, credential or access-control changes | Compliance and retention settings, access controls |
| Claude Code and Cowork | Cowork OTLP settings, Claude Code telemetry settings, managed settings, bypassPermissions, dangerouslyDisableSandbox, permission_mode_changed | Telemetry destinations, managed settings, permission modes, sandbox settings |
Two habits from the report make the difference. First, check the Activity Feed for configuration changes during the incident window, because current settings may differ from the ones in place at the time. Second, remember that customer-side telemetry (Claude Code OTel, Cowork OTel) cannot be recovered if it was never collected: an attacker who redirects it is deleting your future evidence.
How to tell evasion from routine change
- Direction. Narrowing an allow-list or enabling a sandbox tightens control. The same event family pointing the other way is the evasion step.
- Ticket and scope. A planned change has a ticket that matches what changed. A closed ticket reused for a wider change is a tell.
- Actor. Pivot on the account behind an odd sign-in. Everything it does next is a candidate chain link; a different person's risky setting is flagged, not chained.
- Domains. Telemetry, MCP servers and connectors moving to a domain you do not own are worse than ones moving inside your own.
- Correlation keys. Use
prompt.idfor Cowork OTel, andtool_use_idandrequest_idto tie Claude Code OTel to session transcripts.
Questions
What does defence evasion look like in a Claude Enterprise environment?
Invictus Incident Response's Frontier Forensics report lists the evidence for this starting point. In the Activity Feed: changes to the Compliance API, SSO, directory sync or inference hooks, plus org_ip_restriction_*, mcp_tool_policy_updated, org_connector_domain_guard_updated and org_cowork_* events. On the Claude Code and Cowork side: Cowork OTLP settings, Claude Code telemetry settings, managed settings, bypassPermissions, dangerouslyDisableSandbox and permission_mode_changed. Each one either reduces what you can see or what is enforced.
Where would an investigator find these events?
Administrative events come from the Activity Feed, read through the Compliance API (GET /v1/compliance/activities). The report notes Anthropic retains Activity Feed records for six years from when the feed is first enabled, with no backfill. Claude Code and Cowork OpenTelemetry exist only if the organisation configured a collector before the incident. Endpoint settings live in the user's ~/.claude directory, ~/.claude.json and managed settings.
How is the hunt scored?
Any call other than benign counts as a detection, so precision and recall measure how many flags were right and how many bad events you caught. Exact verdicts check benign, suspicious or evasion. Chain overlap compares the events you linked with the intruder's real steps. The overall score is 40% detection F1, 25% exact verdicts and 35% chain overlap; passing needs 70% overall and at least 60% recall.
Are the events real?
No. The organisation, people, hosts, tickets and addresses are synthetic, domains use .example and IPs are RFC 5737 documentation ranges. Event and setting names shown in code style are the ones the Invictus report lists; plain-text names are descriptive labels, and every payload is illustrative rather than an exact Anthropic schema.
Keep going
- Poisoned Instruction File Lab: find injected instructions in CLAUDE.md, .mcp.json, hooks and memory files.
- AI Investigation Scoping Lab: pick the right starting point and evidence for a Claude incident.
- AI Evidence Readiness: check what your organisation would actually have on the day.
- Evidence Expiry Race: collect evidence before retention windows close.
- Agent Trace Triage Lab: read agent traces for what actually executed.
- MCP Rug-Pull Lab: when a trusted MCP server changes underneath you.
- AI incident response checklist: the response steps after the hunt.
- Investigating Claude misuse: evidence sources and retention.
Further reading: Invictus Incident Response, “Frontier Forensics: Anthropic” (Oct 2026, TLP:CLEAR), the source for the event names, starting points and controls used here. Product behaviour is as described in Anthropic's documentation: Compliance API, inference hooks, the .claude directory. PlayCISO is not affiliated with Anthropic or Invictus.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.