Kimi K2.6 vs GPT-5.5 in Authorization Testing
What two real authorization traces showed us about persistence, restraint, and the evidence gates Tahr needs around both.
Insight: Model choice changes how hard an agent pushes before evidence promotion.
Posts tagged verification
Authorization Testing as a Matrix, Not a Spot Check
Tahr treats access control as a coverage problem across identities, operations, object owners, and tenants, then promotes only proof-backed violations.
Insight: Access control testing should be modeled as coverage across users, tenants, objects, and operations.
Creativity and verification don't live in the same agent
Most AI security systems constrain every attack agent. We take a different approach: let some agents explore widely, then rely on a downstream verifier to keep only what is real.
Insight: Exploration and verification work better when different agents own each job.
A Second Agent That Proves the First One Wrong
We pair every AI testing agent with a second agent that independently re-exploits each finding using statistical verification and drops anything it can't reproduce.
Insight: AI findings need independent re-exploitation before they reach a report.
