# kosa8 attack

Test kosa8's controls against AI-agent attacks and write a signed scorecard

Runs a fixed catalogue of the things a hijacked agent tries — exfiltrate a secret,
read the host's keys, reach an unapproved host or 169.254.169.254, destroy work,
call a poisoned or unapproved MCP tool, install from a look-alike registry,
persist — through kosa8's real decision code: the tool-call rules, the egress
broker, the host network guard, the MCP policy and tool pins. Each scenario is
mapped to the OWASP Top 10 for LLM Applications 2025 and to MITRE ATLAS.

Every scenario is run against two postures: this machine's defaults, and the
recommended hardened setup. Results are BLOCKED, NEEDS APPROVAL or ALLOWED,
and a scenario the default allows names the setting that stops it.

This is a self-test of kosa8's controls, not a penetration test or a
certification.

## Subcommands

- [`kosa8 attack list`](https://docs.kosa8.com/reference/attack-list.md): List the attack scenarios and their OWASP and ATLAS mappings
- [`kosa8 attack run`](https://docs.kosa8.com/reference/attack-run.md): Run the scenarios and write a signed scorecard
- [`kosa8 attack upload`](https://docs.kosa8.com/reference/attack-upload.md): Upload a signed scorecard to your kosa8 Cloud org
- [`kosa8 attack verify`](https://docs.kosa8.com/reference/attack-verify.md): Check a signed attack scorecard

---
Source: https://docs.kosa8.com/reference/attack/