Secure AI Kit, with an attacker already in the room

Field notes

The page separates its defenses by attack stage: input refusals are logged, retrieved chunks are wrapped as data, and unapproved or irreversible tool calls stop before execution. Its evidence section records three attacks against a local Ollama qwen2.5:7b model, including a tool-abuse case that erased four records. The fourth case is explicitly omitted because the model refused it in all 20 unguarded attempts.