The field test: nine questions for any live AI system
Put one AI system in a room with the people who built it. Ask nine questions. Inside forty minutes you will know whether it is defensible.
What kept arriving
I did not set out to write these nine questions. They are simply what kept arriving.
This season covered prompt injection, the OWASP lists, the EU AI Act, a zero-click exfiltration and a set of defences that all broke. Different subjects every week. The same three answers underneath every one of them.
This is not a recap. A recap lists what happened. This lists what kept turning up regardless of the week's subject — and together those questions form a test somebody can actually run.
Shape: what it can reach
Three questions. They are the oldest three in the season and they are still the most useful.
- What untrusted content reaches it? Anything the system reads that somebody outside your organisation could have written. An email. A curriculum vitae. A support ticket. A web page. A retrieved document. The test is authorship, not format.
- What does it hold? Everything inside the boundary it can reach. Not what it was designed to use. What it can reach.
- Where can it send things? Every outward path. Email. An API call. A rendered image. A link preview. A trusted domain that will fetch a URL on your behalf is an outward path, even though nobody ever wrote it down as one.
If all three answers come back large, you have not found a vulnerability. You have found an architecture that can be made to leak. The leak simply has not happened yet.
Authority: what it is permitted to do
- Under whose identity does it act — and how long does that credential live? This is the question most organisations cannot answer in the room. They can describe what the assistant is for. Far fewer can produce the list of what it is permitted to do, and who can revoke that mid-task.
- What is it optimised for — and could it hit that number without achieving the goal? Any system optimising a proxy has a structural reason to make things look right. Ask whether the number and the goal can come apart. They usually can.
- What is the maximum unauthorised consequence possible before a human intervenes? This is blast radius, and it is deliberately phrased as a worst case.
Not what is likely. What is possible before anybody notices.
Controls: what holds when a control fails
This is the part that changed most for me this season.
- Filter, or boundary? A filter reads text and then decides. A boundary does not read anything at all. It constrains what is reachable regardless of what the text says.
- How is that control classified in your register? Preventive, or detective. A control you can phrase your way past belongs in the detective column.
- If every filter failed, what is left carrying the risk?
The distinction matters because twelve published defences were tested properly last October by a team drawn from four frontier labs. Most had reported near-zero attack success. Under an attacker who knew how they worked, they broke above ninety per cent.
The filters are still worth having. They reduce noise and they raise cost. The error was never having them. The error is the column they are written in.
If the honest answer to the ninth question is nothing, the review is already finished. You have your finding.
How to score it
This is the part that makes it a test rather than a checklist. You are not scoring the answers. You are scoring whether an answer exists at all.
A confident wrong answer is recoverable. A question that nobody in the room can answer is the finding. It means the system's autonomy has run ahead of the organisation's assurance — and that gap is where every incident in this season lived.
How to run it
- Forty minutes.
- One system that is already live — not the whole estate, and not a system somebody is still designing.
- The person who built it in the room. Not a slide about it.
- Write the answers down as you go, because the questions that produce silence are the actual deliverable.
Do that once and you will know more about your real AI risk than a quarter of policy work will tell you.
What this page is not
It is not a maturity model. There is no score and nothing to benchmark yourself against.
It is not a document to file. Nine questions fit on one page precisely so that nobody has to read a framework before they can use them.
It is not a replacement for the standards. OWASP, NIST and the EU AI Act all do things this page does not. This is the thing you carry into the room. Those are the things you build the programme from.
Where each question comes from
- Questions 1–3 — The lethal trifecta and EchoLeak
- Questions 4 and 6 — The OWASP Agentic Top 10, in five questions
- Question 5 — Reward hacking
- Questions 7–9 — Guardrail theatre and EchoLeak
Sources
- The Attacker Moves Second — OpenAI, Anthropic, Google DeepMind, ETH Zürich, October 2025
- OWASP Top 10 for Agentic Applications 2026, OWASP GenAI Security Project
- Meta guidance on agent capability combinations, October 2025
- CVE-2025-32711 and the Aim Labs EchoLeak disclosure
Not the model. Not the prompt. Not the filter. What the system can reach, what it is permitted to do, and what still holds when the control you were relying on does not.