Red team · you are the attacker
Try to break it.
This AI has the power to kill database sessions in production. Six ways to trick it into doing harm. Pick one and watch.
Every attack below is a real recorded run of RecoveryPact under that attack, on Nemotron, against a live database with real checkout traffic. Where we have it, the typical AI agent faces the same attack next to it.
0 s
Three layers, and an attack has to beat all of them
1 · Nemotron guard
Safety Guard 8B and a Nemotron judge screen every untrusted string before an agent reads it. Hidden instructions are quarantined.
2 · Two mandates, live facts
The Business AI won't accept a plan the live Zetaris records contradict. Memory is weak evidence; a missing source is unknown, never empty.
3 · A deterministic authority
Plain code re-checks the exact action against the live system before anything runs. It can't be persuaded. Agreement is not permission.