pwn 0.5.695 → 0.5.697

data/lib/pwn/ai/red_team.rb

@@ -10,20 +10,31 @@ module PWN
     # adversarial test-case modules that exhaustively analyze / fuzz Large
     # Language Models for AI-specific vulnerabilities (prompt injection,
     # jailbreaks, system-prompt extraction, sensitive-data disclosure,
-    # excessive agency, insecure output handling, etc.).  Each module maps to
-    # an OWASP LLM Top-10 category and a MITRE ATLAS technique so findings
-    # roll straight into PWN::Reports::AIRedTeam.
+    # excessive agency, insecure output handling, supply chain, poisoning,
+    # unbounded consumption, hidden context, vector stores, RAG, MCP/A2A,
+    # and memory persistence). Each module maps to an OWASP LLM Top-10
+    # category and a MITRE ATLAS technique so findings roll straight into
+    # PWN::Reports::AIRedTeam.
     module RedTeam
-      # OWASP LLM Top-10 / MITRE ATLAS Aligned AI RedTeam Modules
+      # OWASP LLM Top-10 / MITRE ATLAS aligned AI RedTeam modules
+      autoload :AgentProtocolAbuse, 'pwn/ai/red_team/agent_protocol_abuse'
+      autoload :DataAndModelPoisoning, 'pwn/ai/red_team/data_and_model_poisoning'
       autoload :ExcessiveAgency, 'pwn/ai/red_team/excessive_agency'
+      autoload :HiddenContextExposure, 'pwn/ai/red_team/hidden_context_exposure'
       autoload :InsecureOutputHandling, 'pwn/ai/red_team/insecure_output_handling'
       autoload :Jailbreak, 'pwn/ai/red_team/jailbreak'
+      autoload :MemoryPoisoning, 'pwn/ai/red_team/memory_poisoning'
+      autoload :MultimodalInjection, 'pwn/ai/red_team/multimodal_injection'
       autoload :Overreliance, 'pwn/ai/red_team/overreliance'
       autoload :PayloadSplitting, 'pwn/ai/red_team/payload_splitting'
       autoload :PromptInjection, 'pwn/ai/red_team/prompt_injection'
+      autoload :RagPoisoning, 'pwn/ai/red_team/rag_poisoning'
       autoload :SensitiveInformationDisclosure, 'pwn/ai/red_team/sensitive_information_disclosure'
+      autoload :SupplyChain, 'pwn/ai/red_team/supply_chain'
       autoload :SystemPromptExtraction, 'pwn/ai/red_team/system_prompt_extraction'
       autoload :TokenSmuggling, 'pwn/ai/red_team/token_smuggling'
+      autoload :UnboundedConsumption, 'pwn/ai/red_team/unbounded_consumption'
+      autoload :VectorAndEmbeddingWeaknesses, 'pwn/ai/red_team/vector_and_embedding_weaknesses'
 
       # This module executes all the other AI RedTeam modules
       autoload :TestCaseEngine, 'pwn/ai/red_team/test_case_engine'

data/lib/pwn/plugins/nmap_it.rb

@@ -14,19 +14,53 @@ module PWN
       #   nmap.connect_scan = true
       #   nmap.service_scan = true
       #   nmap.verbose = true
-      #   nmap.ports = [1..1024,1337]
+      #   nmap.ports = [1..1024, 1337]
       #   nmap.targets = '127.0.0.1'
-      #   nmap.xml = '/tmp/nmap_port_scan_res.xml'
+      #   nmap.xml = '/tmp/nmap_port_scan_res.xml' # alias of output_xml
       # end
+      #
+      # PWN::Plugins::NmapIt.port_scan(
+      #   targets: '127.0.0.1',
+      #   ports: '1-65535',
+      #   connect_scan: true,
+      #   service_scan: true,
+      #   script: 'vuln,safe',
+      #   xml: '/tmp/nmap_port_scan_res.xml'
+      # )
 
-      public_class_method def self.port_scan
+      public_class_method def self.port_scan(opts = {})
         Nmap::Command.sudo do |nmap|
-          yield(nmap)
+          apply_port_scan_opts(nmap: nmap, opts: opts)
+          yield(nmap_compat(nmap: nmap)) if block_given?
         end
       rescue StandardError => e
         raise e
       end
 
+      private_class_method def self.apply_port_scan_opts(opts = {})
+        nmap = opts[:nmap]
+        args = opts[:opts]
+        return nmap unless args.is_a?(Hash)
+
+        nmap.targets = args[:targets] || args[:target] if args[:targets] || args[:target]
+        nmap.ports = args[:ports] if args.key?(:ports)
+        xml = args[:xml] || args[:output_xml]
+        nmap.output_xml = xml if xml
+        nmap.connect_scan = args[:connect_scan] if args.key?(:connect_scan)
+        nmap.service_scan = args[:service_scan] || args[:service_detection] if args.key?(:service_scan) || args.key?(:service_detection)
+        nmap.verbose = args[:verbose] if args.key?(:verbose)
+        scripts = args[:script] || args[:scripts] || args[:vuln_scripts]
+        nmap.script = scripts if scripts
+        nmap
+      end
+
+      private_class_method def self.nmap_compat(opts = {})
+        nmap = opts[:nmap]
+        nmap.define_singleton_method(:xml=) { |path| self.output_xml = path }
+        nmap.define_singleton_method(:xml) { output_xml }
+        nmap
+      end
+
       # Supported Method Parameters::
       # PWN::Plugins::NmapIt.parse_xml_results(:xml_file => 'required - path to nmap xml results') do |xml|
       #   puts xml.public_methods
@@ -103,6 +137,15 @@ module PWN
             nmap.xml = '/tmp/nmap_port_scan_res.xml'
           end
 
+          #{self}.port_scan(
+            targets: '127.0.0.1',
+            ports: '1-65535',
+            connect_scan: true,
+            service_scan: true,
+            script: 'vuln,safe',
+            xml: '/tmp/nmap_port_scan_res.xml'
+          )
+
           #{self}.parse_xml_results(:xml_file => 'required - path to nmap xml results') do |xml|
             xml.each_host do |host|
               puts host.ip

data/lib/pwn/plugins/repl.rb

@@ -1557,7 +1557,7 @@ module PWN
       end
 
       PWN_AI_SLASH_COMMANDS = %w[
-        /back /cron /debug /delegate /help /memory /sessions /skills
+        /back /cron /debug /delegate /help /memory /model /sessions /skills
       ].freeze
 
       PWN_AI_SLASH_SUBCOMMANDS = {
@@ -1566,6 +1566,7 @@ module PWN
         '/delegate' => [],
         '/help' => [],
         '/memory' => %w[list recall remember forget clear],
+        '/model' => %w[list],
         '/sessions' => %w[list resume delete stats],
         '/skills' => %w[list recall]
       }.freeze
@@ -1618,6 +1619,20 @@ module PWN
 
         cmd = tokens.first
         sub_prefix = tokens.last.to_s
+        if cmd == '/model'
+          engines = pwn_ai_engines
+          if tokens.length == 2
+            pool = (%w[list] + engines)
+            return pool.select { |s| sub_prefix.empty? || s.start_with?(sub_prefix) }
+          end
+          return %w[llms].select { |s| sub_prefix.empty? || s.start_with?(sub_prefix) } if tokens.length == 3 && tokens[1] == 'list'
+
+          if tokens.length >= 3
+            current = pwn_ai_engine_model(engine: tokens[1]).to_s
+            hits = [current].reject(&:empty?).select { |s| sub_prefix.empty? || s.start_with?(sub_prefix) }
+            return hits unless hits.empty?
+          end
+        end
         subs = Array(PWN_AI_SLASH_SUBCOMMANDS[cmd])
         hits = subs.select { |s| sub_prefix.empty? || s.start_with?(sub_prefix) }
         hits = [target] if hits.empty? && !target.empty?
@@ -1735,6 +1750,8 @@ module PWN
         when '/delegate'
           puts "[*] Delegating: #{args.join(' ')}"
           puts '    Use agent_list / agent_debate from pwn-ai, or pwn-ai-delegate in the pwn REPL.'
+        when '/model'
+          pwn_ai_run_model(args: args)
         end
         true
       rescue StandardError => e
@@ -1742,6 +1759,171 @@ module PWN
         true
       end
 
+      public_class_method def self.pwn_ai_engines(opts = {})
+        return [] unless opts.is_a?(Hash)
+
+        tmpl = {}
+        tmpl = PWN::Config.env_template[:ai] if defined?(PWN::Config) && PWN::Config.respond_to?(:env_template)
+        keys = tmpl.select { |_k, v| v.is_a?(Hash) && v.key?(:model) }.keys.map(&:to_s)
+        if defined?(PWN::Env) && PWN::Env.is_a?(Hash) && PWN::Env[:ai].is_a?(Hash)
+          PWN::Env[:ai].each do |k, v|
+            next unless v.is_a?(Hash)
+            next if %i[agent driver_opts].include?(k.to_sym)
+
+            keys << k.to_s if v.key?(:model) || v.key?(:key) || v.key?(:base_uri)
+          end
+        end
+        keys.uniq.sort
+      end
+
+      public_class_method def self.pwn_ai_provider_class(opts = {})
+        engine = opts[:engine].to_s.downcase
+        map = {
+          'anthropic' => 'Anthropic',
+          'gemini' => 'Gemini',
+          'grok' => 'Grok',
+          'ollama' => 'Ollama',
+          'openai' => 'OpenAI',
+          'openwebui' => 'OpenWebUI'
+        }
+        name = map[engine]
+        return nil if name.nil? || !defined?(PWN::AI) || !PWN::AI.const_defined?(name)
+
+        PWN::AI.const_get(name)
+      end
+
+      public_class_method def self.pwn_ai_model_ids(opts = {})
+        raw = opts[:models]
+        rows = case raw
+               when Array then raw
+               when Hash then raw[:data] || raw[:models] || raw['data'] || raw['models'] || []
+               else []
+               end
+        Array(rows).filter_map do |row|
+          if row.is_a?(Hash)
+            row[:id] || row['id'] || row[:name] || row['name'] || row[:model] || row['model']
+          else
+            row.to_s
+          end
+        end.map(&:to_s).reject(&:empty?).uniq
+      end
+
+      public_class_method def self.pwn_ai_list_llms(opts = {})
+        engine = opts[:engine].to_s
+        engine = PWN::Env.dig(:ai, :active).to_s if engine.empty? && defined?(PWN::Env)
+        raise 'no active engine — /model <engine> first' if engine.empty?
+
+        klass = pwn_ai_provider_class(engine: engine)
+        raise "#{engine} has no PWN::AI provider with get_models" unless klass.respond_to?(:get_models)
+
+        ids = pwn_ai_model_ids(models: klass.get_models)
+        puts "[*] #{engine} llms (#{ids.length})"
+        ids.each { |id| puts id }
+        ids
+      end
+
+      public_class_method def self.pwn_ai_engine_model(opts = {})
+        engine = opts[:engine].to_s.downcase.to_sym
+        return '' if engine.empty?
+        return '' unless defined?(PWN::Env) && PWN::Env.is_a?(Hash)
+
+        PWN::Env.dig(:ai, engine, :model).to_s
+      end
+
+      public_class_method def self.pwn_ai_run_model(opts = {})
+        args = Array(opts[:args]).map(&:to_s)
+        engines = pwn_ai_engines
+        current = defined?(PWN::Env) && PWN::Env.is_a?(Hash) ? PWN::Env.dig(:ai, :active).to_s : ''
+        current_model = pwn_ai_engine_model(engine: current)
+        sub = args[0].to_s
+        if sub.empty? || %w[show status].include?(sub)
+          msg = "active=#{current.empty? ? '(none)' : current} model=#{current_model.empty? ? '(unset)' : current_model}"
+          puts "[*] #{msg}"
+          return msg
+        end
+        if %w[list help].include?(sub)
+          return pwn_ai_list_llms(engine: current) if args[1].to_s == 'llms'
+
+          puts 'pwn-ai /model — switch provider and model in this session'
+          puts "  current: #{current} #{current_model}"
+          puts '  usage: /model [list] | /model list llms | /model <engine> [model] | /model <model>'
+          engines.each do |eng|
+            mark = eng == current ? '*' : ' '
+            puts "  #{mark} #{eng}  #{pwn_ai_engine_model(engine: eng)}"
+          end
+          return engines
+        end
+
+        engine = nil
+        model = nil
+        if engines.include?(sub)
+          engine = sub
+          model = args[1..].join(' ')
+          model = nil if model.strip.empty?
+        else
+          engine = current
+          model = args.join(' ')
+        end
+        raise "no active engine — /model <engine> first (#{engines.join(', ')})" if engine.to_s.empty?
+        raise "unknown engine #{engine.inspect} — try: #{engines.join(', ')}" unless engines.include?(engine.to_s)
+
+        PWN::Env[:ai] ||= {}
+        PWN::Env[:ai][engine.to_sym] ||= {}
+        PWN::Env[:ai][:active] = engine.to_s
+        PWN::Env[:ai][engine.to_sym][:model] = model unless model.to_s.strip.empty?
+        persisted = persist_ai_selection(engine: engine, model: PWN::Env[:ai][engine.to_sym][:model])
+        shown = PWN::Env[:ai][engine.to_sym][:model]
+        msg = "active=#{engine} model=#{shown.to_s.empty? ? '(unset)' : shown}"
+        msg = "#{msg} (session only)" unless persisted
+        puts "[*] #{msg}"
+        msg
+      end
+
+      public_class_method def self.persist_ai_selection(opts = {})
+        engine = opts[:engine].to_s
+        model = opts[:model]
+        return false if engine.empty?
+
+        env_path = nil
+        dec_path = nil
+        if defined?(PWN::Env) && PWN::Env.is_a?(Hash)
+          env_path = PWN::Env.dig(:driver_opts, :pwn_env_path)
+          dec_path = PWN::Env.dig(:driver_opts, :pwn_dec_path)
+        end
+        env_path = env_path.to_s.strip
+        env_path = File.join(Dir.home, '.pwn', 'pwn.yaml') if env_path.empty?
+        dec_path = dec_path.to_s.strip
+        dec_path = "#{env_path}.decryptor" if dec_path.empty?
+        return false unless File.exist?(env_path) && File.exist?(dec_path) && File.readable?(dec_path)
+
+        decryptor = YAML.load_file(dec_path, symbolize_names: true)
+        key = decryptor.is_a?(Hash) ? decryptor[:key] : nil
+        iv = decryptor.is_a?(Hash) ? decryptor[:iv] : nil
+        return false if key.to_s.strip.empty? || iv.to_s.strip.empty?
+
+        PWN::Plugins::Vault.decrypt(file: env_path, key: key, iv: iv)
+        begin
+          cfg = YAML.load_file(env_path, symbolize_names: true)
+          cfg = {} unless cfg.is_a?(Hash)
+          cfg[:ai] = {} unless cfg[:ai].is_a?(Hash)
+          cfg[:ai][:active] = engine
+          unless model.to_s.strip.empty?
+            slot = engine.to_sym
+            cfg[:ai][slot] = {} unless cfg[:ai][slot].is_a?(Hash)
+            cfg[:ai][slot][:model] = model
+          end
+          yaml_env = YAML.dump(cfg).gsub(/^(\s*):/, '\1')
+          File.write(env_path, yaml_env)
+          File.chmod(0o600, env_path)
+        ensure
+          PWN::Plugins::Vault.encrypt(file: env_path, key: key, iv: iv)
+        end
+        true
+      rescue StandardError => e
+        warn "[pwn-ai] /model persist skipped: #{e.class}: #{e.message}"
+        false
+      end
+
       public_class_method def self.pwn_ai_run_cron(opts = {})
         args = Array(opts[:args])
         sub = args[0] || 'list'

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.695'
+  VERSION = '0.5.697'
 end

data/spec/lib/pwn/ai/agent/loop_spec.rb

@@ -427,12 +427,13 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
       expect(src).not_to match(/dispatch #\{name\} ok_len=/)
     end
 
-    it 'records a reconstruct-first timeout mistake instead of treating success:true as ok' do
+    it 'records a timeout increment mistake instead of treating success:true as ok' do
       tmp = Dir.mktmpdir
       stub_const('PWN::AI::Agent::Mistakes::MISTAKES_FILE', File.join(tmp, 'mistakes.json'))
+      PWN::AI::Agent::ToolGuard.reset_timeout_budget! if PWN::AI::Agent::ToolGuard.respond_to?(:reset_timeout_budget!)
       raw = JSON.generate(
         success: true,
-        result: { stdout: '', error: 'timeout after 20s', hint: 'x', scenario: 'construction' }
+        result: { stdout: '', error: 'timeout after 20s', hint: 'x', scenario: 'deadline' }
       )
       tele = described_class.send(
         :record_metrics,
@@ -443,7 +444,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
       )
       expect(tele[:ok]).to eq false
       expect(tele[:mistake]).to be_a(Hash)
-      expect(tele[:mistake][:error].to_s).to match(/reconstruct/)
+      expect(tele[:mistake][:error].to_s).to match(/timeout \+= 180|too short/i)
       expect(tele[:mistake][:shape].to_s).to eq('timeout')
     end
 
@@ -860,6 +861,25 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
       expect(src).not_to match(/in-scope authorization/)
     end
 
+    it 'treats an authorization refusal as incomplete, not a final block' do
+      refuse = '**No. I won’t run that.** TransparentBrowser against grenade MCP ' \
+               'is live offensive probing. I won’t drive that from here—authorized ' \
+               'H1 scope or not. Request refused; no target interaction.'
+      expect(described_class.send(:authorization_refuse?, text: refuse)).to eq(true)
+      expect(described_class.send(:incomplete_final?, text: refuse)).to eq(true)
+      expect(
+        described_class.send(
+          :may_finalize?,
+          request: 'Use TransparentBrowser on the authorized BBP MCP',
+          messages: [{ role: 'assistant', content: refuse }],
+          text: refuse
+        )
+      ).to eq(false)
+      src = File.read(described_class.method(:run).source_location.first)
+      expect(src).to match(/does not decide authorization/)
+      expect(src).to match(/authorization_refuse\?/)
+    end
+
     it 'run short-circuits how-to without plan_first or tools' do
       src = File.read(described_class.method(:run).source_location.first)
       expect(src).to match(/request_intent/)

data/spec/lib/pwn/ai/agent/prompt_builder_spec.rb

@@ -76,6 +76,7 @@ describe PWN::AI::Agent::PromptBuilder do
       expect(src).to match(/default_skill_names|SKILLS CATALOG/)
       expect(src).to match(/HOST LOAD/)
       expect(src).to match(/host_load|deadline_s/)
+      expect(src).to match(/does not decide authorization/)
     end
   end
 end

data/spec/lib/pwn/ai/agent/tool_guard_spec.rb

@@ -68,40 +68,101 @@ describe PWN::AI::Agent::ToolGuard do
       expect(snap[:mem_avail_mb].to_i).to be >= 0
     end
 
-    it 'clamps an explicit timeout and derives a default when omitted' do
+    it 'honors any explicit timeout up to 3 hours and derives a default when omitted' do
       expect(described_class.deadline_s(timeout: 1, kind: :eval)).to eq(1)
-      expect(described_class.deadline_s(timeout: 9_999, kind: :eval)).to eq(90)
-      expect(described_class.deadline_s(timeout: 9_999, kind: :shell)).to eq(180)
+      expect(described_class.deadline_s(timeout: 300, kind: :eval)).to eq(300)
+      expect(described_class.deadline_s(timeout: 3_600, kind: :shell)).to eq(3_600)
+      expect(described_class.deadline_s(timeout: 99_999, kind: :eval)).to eq(10_800)
       omitted = described_class.deadline_s(kind: :eval)
       expect(omitted).to be_between(8, 90)
     end
+
+    it 'does not sniff payloads for named tools' do
+      src = File.read(described_class.method(:deadline_s).source_location.first)
+      expect(src).not_to match(/\bnmap\b/i)
+      expect(src).not_to match(/\bsqlmap\b/i)
+      expect(src).not_to match(/\bhydra\b/i)
+      expect(described_class).not_to respond_to(:long_work?)
+    end
+  end
+
+  describe '.next_timeout' do
+    it 'adds 180 seconds until the 3-hour cap' do
+      expect(described_class.next_timeout(timeout: 60)).to eq(240)
+      expect(described_class.next_timeout(timeout: 180)).to eq(360)
+      expect(described_class.next_timeout(timeout: 10_800)).to eq(10_800)
+    end
   end
 
   describe '.timeout_lesson' do
-    it 'prefers reconstruct-the-payload before raising timeout' do
+    before do
+      described_class.reset_timeout_budget!
+    end
+
+    it 'increments timeout on the same payload before rewriting' do
       tmp = Dir.mktmpdir
       stub_const('PWN::AI::Agent::Mistakes::MISTAKES_FILE', File.join(tmp, 'mistakes.json'))
-      first = described_class.timeout_lesson(tool: 'pwn_eval', payload: 'sleep 3', timeout: 1)
-      expect(first[:scenario]).to eq(:construction)
-      expect(first[:hint]).to match(/reconstruct|generated differently|improperly/i)
-      expect(first[:hint]).to match(/do not first raise timeout/i)
-      expect(first[:error]).to match(/reconstruct/)
+      first = described_class.timeout_lesson(
+        tool: 'pwn_eval',
+        payload: 'sleep 3',
+        timeout: 180,
+        task: 't1'
+      )
+      expect(first[:scenario]).to eq(:deadline)
+      expect(first[:hint]).to match(/timeout \+= 180|next_timeout/i)
+      expect(first[:hint]).not_to match(/reconstruct/i)
+      expect(described_class.next_timeout(timeout: 180, spent: 180)).to eq(360)
     end
 
-    it 'switches to deadline-too-short only after a prior timeout mistake' do
+    it 'rewrites the payload only after the 3-hour budget is exhausted' do
       tmp = Dir.mktmpdir
       stub_const('PWN::AI::Agent::Mistakes::MISTAKES_FILE', File.join(tmp, 'mistakes.json'))
-      PWN::AI::Agent::Mistakes.record(
+      described_class.note_timeout!(
+        tool: 'shell',
+        payload: 'sleep 3',
+        timeout: 10_800,
+        task: 't1'
+      )
+      lesson = described_class.timeout_lesson(
+        tool: 'shell',
+        payload: 'sleep 3',
+        timeout: 10_800,
+        task: 't1'
+      )
+      expect(lesson[:scenario]).to eq(:construction)
+      expect(lesson[:hint]).to match(/3-hour budget|Generate different/i)
+      expect(described_class.mutation_count(task: 't1')).to eq(1)
+    end
+
+    it 'stops after 10 mutations on the same task' do
+      10.times do |i|
+        described_class.note_timeout!(
+          tool: 'shell',
+          payload: "payload-#{i}",
+          timeout: 10_800,
+          task: 't1'
+        )
+      end
+      last = described_class.timeout_lesson(
+        tool: 'shell',
+        payload: 'payload-9',
+        timeout: 10_800,
+        task: 't1'
+      )
+      expect(described_class.mutation_count(task: 't1')).to eq(10)
+      expect(last[:scenario]).to eq(:exhausted)
+      expect(last[:hint]).to match(/10 mutations|mutation cap/i)
+    end
+
+    it 'includes next_timeout on a mid-budget timeout result' do
+      out = described_class.timeout_result(
         tool: 'shell',
-        error: 'shell timeout: reconstruct payload to same goal before raising timeout',
-        args: 'sleep 3',
-        source: :tool,
-        shape: :timeout
+        payload: 'sleep 3',
+        timeout: 180,
+        task: 't1'
       )
-      second = described_class.timeout_lesson(tool: 'shell', payload: 'sleep 3', timeout: 1)
-      expect(second[:scenario]).to eq(:deadline)
-      expect(second[:hint]).to match(/timeout was too short|deadline too short|raise a conservative/i)
-      expect(second[:error]).to match(/too short/)
+      expect(out[:scenario]).to eq(:deadline)
+      expect(out[:next_timeout]).to eq(360)
     end
   end
 end

data/spec/lib/pwn/ai/agent/tools/ruby_eval_spec.rb

@@ -49,8 +49,8 @@ describe 'PWN::AI::Agent::Tools ruby_eval' do
     result = entry.handler.call(code: 'sleep 3', timeout: 1)
     expect(Time.now - t0).to be < 2.5
     expect(result[:error].to_s).to match(/timeout after 1s/)
-    expect(result[:hint].to_s).to match(/reconstruct|generated differently|improperly/i)
-    expect(result[:scenario].to_s).to eq('construction')
+    expect(result[:hint].to_s).to match(/timeout \+= 180|next_timeout|same .*payload/i)
+    expect(result[:scenario].to_s).to eq('deadline')
   end
 
   it 'Dispatch.call JSON-wraps syntax errors instead of raising' do

data/spec/lib/pwn/ai/agent/tools/shell_spec.rb

@@ -60,12 +60,12 @@ describe 'PWN::AI::Agent::Tools shell' do
     expect(r[:exit]).to eq(0)
   end
 
-  it 'on timeout prefers reconstruct-the-command before raising timeout' do
+  it 'on timeout keeps the same command and increments timeout' do
     tmp = Dir.mktmpdir
     stub_const('PWN::AI::Agent::Mistakes::MISTAKES_FILE', File.join(tmp, 'mistakes.json'))
     r = handler.call(command: 'sleep 3', timeout: 1)
     expect(r[:error].to_s).to match(/timeout after 1s/)
-    expect(r[:hint].to_s).to match(/reconstruct|generated differently|improperly/i)
-    expect(r[:scenario].to_s).to eq('construction')
+    expect(r[:hint].to_s).to match(/timeout \+= 180|next_timeout|same .*payload/i)
+    expect(r[:scenario].to_s).to eq('deadline')
   end
 end

data/spec/lib/pwn/ai/red_team/agent_protocol_abuse_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::AI::RedTeam::AgentProtocolAbuse do
+  it 'scan method should exist' do
+    scan_response = PWN::AI::RedTeam::AgentProtocolAbuse
+    expect(scan_response).to respond_to :scan
+  end
+
+  it 'should display information for security_references' do
+    security_references_response = PWN::AI::RedTeam::AgentProtocolAbuse
+    expect(security_references_response).to respond_to :security_references
+  end
+
+  it 'should display information for authors' do
+    authors_response = PWN::AI::RedTeam::AgentProtocolAbuse
+    expect(authors_response).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    help_response = PWN::AI::RedTeam::AgentProtocolAbuse
+    expect(help_response).to respond_to :help
+  end
+
+  it 'defines strategies instead of a static attack_payloads list' do
+    src = File.read(described_class.method(:scan).source_location.first)
+    expect(src).to include('strategies = [')
+    expect(src).not_to match(/attack_payloads\s*=\s*\[/)
+    expect(src).to include('payload_count')
+  end
+
+  it 'maps an OWASP 2026 / ATLAS reference' do
+    refs = described_class.security_references
+    expect(refs[:section]).to include('LLM')
+    expect(refs[:owasp_llm_uri]).to include('genai.owasp.org')
+    expect(refs[:atlas_id]).to match(/\AAML\.T\d+\z/)
+    expect(refs[:red_team_module]).to eq(described_class)
+  end
+end

data/spec/lib/pwn/ai/red_team/data_and_model_poisoning_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::AI::RedTeam::DataAndModelPoisoning do
+  it 'scan method should exist' do
+    scan_response = PWN::AI::RedTeam::DataAndModelPoisoning
+    expect(scan_response).to respond_to :scan
+  end
+
+  it 'should display information for security_references' do
+    security_references_response = PWN::AI::RedTeam::DataAndModelPoisoning
+    expect(security_references_response).to respond_to :security_references
+  end
+
+  it 'should display information for authors' do
+    authors_response = PWN::AI::RedTeam::DataAndModelPoisoning
+    expect(authors_response).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    help_response = PWN::AI::RedTeam::DataAndModelPoisoning
+    expect(help_response).to respond_to :help
+  end
+
+  it 'defines strategies instead of a static attack_payloads list' do
+    src = File.read(described_class.method(:scan).source_location.first)
+    expect(src).to include('strategies = [')
+    expect(src).not_to match(/attack_payloads\s*=\s*\[/)
+    expect(src).to include('payload_count')
+  end
+
+  it 'maps an OWASP 2026 / ATLAS reference' do
+    refs = described_class.security_references
+    expect(refs[:section]).to include('LLM')
+    expect(refs[:owasp_llm_uri]).to include('genai.owasp.org')
+    expect(refs[:atlas_id]).to match(/\AAML\.T\d+\z/)
+    expect(refs[:red_team_module]).to eq(described_class)
+  end
+end

data/spec/lib/pwn/ai/red_team/hidden_context_exposure_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::AI::RedTeam::HiddenContextExposure do
+  it 'scan method should exist' do
+    scan_response = PWN::AI::RedTeam::HiddenContextExposure
+    expect(scan_response).to respond_to :scan
+  end
+
+  it 'should display information for security_references' do
+    security_references_response = PWN::AI::RedTeam::HiddenContextExposure
+    expect(security_references_response).to respond_to :security_references
+  end
+
+  it 'should display information for authors' do
+    authors_response = PWN::AI::RedTeam::HiddenContextExposure
+    expect(authors_response).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    help_response = PWN::AI::RedTeam::HiddenContextExposure
+    expect(help_response).to respond_to :help
+  end
+
+  it 'defines strategies instead of a static attack_payloads list' do
+    src = File.read(described_class.method(:scan).source_location.first)
+    expect(src).to include('strategies = [')
+    expect(src).not_to match(/attack_payloads\s*=\s*\[/)
+    expect(src).to include('payload_count')
+  end
+
+  it 'maps an OWASP 2026 / ATLAS reference' do
+    refs = described_class.security_references
+    expect(refs[:section]).to include('LLM')
+    expect(refs[:owasp_llm_uri]).to include('genai.owasp.org')
+    expect(refs[:atlas_id]).to match(/\AAML\.T\d+\z/)
+    expect(refs[:red_team_module]).to eq(described_class)
+  end
+end