Observed arrival · 2026-11-09
HighCastle: an AI hacker with a deterministic referee
HighCastle demonstrates authorized AI-assisted red-team checks in a synthetic invoice app, with sandbox execution, an independent verdict, and patch replay.
- For
- Developers checking application authorization logic
- Worth noticing
- The sample keeps a positive control: Alice still retrieves her own invoice after access to Bob’s is denied.
Field notes
The page lays out a five-stage run: record a bounded authorization scope, generate a hypothesis from a threat map, execute a policy-validated pack in a disposable sandbox, ask a deterministic oracle for the verdict, then replay after a patch. Its sample invoice fixture shows Alice’s cross-account request changing from HTTP 200 to 403 while her own invoice remains accessible. The site says user-verified targets and GitHub PR checks are planned; the current demo is limited to HighCastle’s synthetic lab.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue