CanuckDUCK MITRE ATLAS Alignment Assessment
Executive assessment
Marker: CDK-ATLAS-ASSESSMENT-2026-08-12
CanuckDUCK lines up with MITRE ATLAS most strongly as an agentic AI + RAG + civic-platform system, not primarily as a foundation-model training lab. ATLAS is a knowledge base for adversary tactics and techniques against AI-enabled systems, and the fetched ATLAS data release was 2026.07, with 16 tactics, 178 techniques, 37 mitigations, and 68 case studies.
The biggest CanuckDUCK exposure is not “someone steals a model.” It is:
- Prompt and indirect prompt injection through public civic content.
- RAG/RIPPLE/knowledge-base poisoning.
- Agent tool misuse or tool-data poisoning.
- Over-privileged internal AI agents.
- Sensitive-data leakage through agent context, DB reads, summaries, or support workflows.
- Resource exhaustion / queue abuse.
- AI supply-chain and model/tool provenance gaps.
The strongest current alignment is local-first inference for sensitive/internal work, Vault-based secret handling, human approval gates for higher-risk engineering, CMDB/change logging, Ducklings privacy-minimization doctrine, OpenAI route restrictions, and growing operational telemetry and health pipelines.
The main weakness is that CanuckDUCK has many good controls as operational practice, but not yet a single formal ATLAS control map / risk register / test harness proving each AI attack class is covered.
What ATLAS says that is directly relevant
MITRE ATLAS covers AI-specific tactics including AI Model Access, AI Attack Staging, Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Defense Evasion, Discovery, Collection, Exfiltration, Impact, Privilege Escalation, Credential Access, Command and Control, and Lateral Movement.
The high-relevance techniques for CanuckDUCK are:
- LLM Prompt Injection — adversarial prompts causing an LLM to ignore original instructions or issue privileged commands.
- Indirect Prompt Injection — malicious text/media hidden in websites, databases, or other data channels ingested by an LLM.
- RAG Poisoning — malicious content inserted into indexed retrieval sources so future retrieval contaminates a model context.
- AI Agent Context Poisoning — manipulating an agent’s durable/contextual state so future responses or actions change.
- AI Agent Tool Data Poisoning — poisoning data sources that agent tools read, producing false information or tool-invocation manipulation.
- Exfiltration via AI Agent Tool Invocation — using legitimate write tools to send sensitive data outward.
- Credentials from AI Agent Configuration — stealing credentials from agent config files or similar local state.
- Poisoned AI Agent Tool / AI Agent Tool supply-chain compromise — malicious tools, skills, packages, or tool definitions inserted into the agent environment.
- Agentic Resource Consumption — coercing agents into expensive tool calls, fan-outs, retries, or model use.
ATLAS mitigations that map closely to CanuckDUCK include guardrails, AI telemetry logging, AI bill of materials, dataset provenance, privileged/single-user/tool permissions configuration, human-in-the-loop controls, restricting tool invocation on untrusted data, memory hardening, segmentation, input/output validation, AI red-teaming, and workload resource limits.
Where CanuckDUCK already aligns well
1. Sensitive-routing discipline is strong
CanuckDUCK separates local/private work from approved external-model routes. The current routing policy allows OpenAI-compatible routing only for selected public/support/debate/RIPPLE-type purposes and denies Ducklings, engineering, site management, account/SSO, infrastructure, and internal actions. That lines up well with ATLAS controls around production model access, guardrails, and least-privilege agent permissions.
Assessment: strong design, medium maturity.
Critical note: the policy is code-level and convention-level. The next step is to prove every deployed agent actually uses that central route resolver and cannot bypass it.
2. Vault and wrapped-token model counters credential theft
CanuckDUCK’s agent model uses Vault/AppRole, wrapped secret IDs, tiered policies, and avoids passing admin tokens to agents. That directly reduces ATLAS-style credential-from-agent-configuration risk.
Assessment: strong.
Critical note: config sprawl remains a concern. Hermes profiles, systemd env files, swarm env files, MCP/tool configs, and ad hoc scripts need periodic scanning for tokens/secrets.
3. Human-in-the-loop exists for high-risk engineering
The engineering-agent design uses narrow low-risk auto-capabilities and routes higher-risk work to human review. That maps well to ATLAS human-in-the-loop mitigation.
Assessment: good.
Critical note: the strongest control is not “human approval exists,” but “the agent physically cannot perform unapproved actions.” Some parts of CanuckDUCK are still advisory/process-controlled rather than technically enforced.
4. CMDB/change logging gives useful auditability
CMDB records, work logs, active claims, and commit discipline line up with AI telemetry logging and operational traceability.
Assessment: good.
Critical note: CMDB is excellent for infrastructure changes, but AI-specific events need a more explicit schema: prompt source, retrieved-context source IDs, model/route, tool calls, approval state, output destination, and redaction status.
5. Ducklings privacy model is strategically strong
The corrected Ducklings doctrine — adults/admins in LDAP, students not LDAP identities, facility-admin-managed short-term aliases/IDs, no student names — is strongly aligned with privacy-by-minimization and containment. It reduces the impact of model leakage, RAG leakage, database exposure, support-ticket leakage, and account compromise.
Assessment: strong and strategically important.
Critical note: legacy paths and legacy entries must be removed or migration-tagged. The platform should fail closed if any student-real-name field or student-LDAP-identity creation path reappears.
6. Resource controls are improving
The Ollama queue backpressure work — max queue depth, stale-work shedding, embedding fast lane, health fields — maps to ATLAS agentic resource consumption and workload-resource limits.
Assessment: good recent progress.
Critical note: this should become a general AI workload policy: max context, max tool calls, max retries, max delegation depth, max wall-clock, max spend, per-agent budgets, and alert thresholds.
Where CanuckDUCK is exposed
1. RAG / RIPPLE / public-content poisoning is the top risk
CanuckDUCK’s public civic model depends on ingesting public articles, Reddit/read-only signal, Pond content, user discussions, RSS/news, and graph/RIPPLE context. That is exactly the shape ATLAS describes for RAG poisoning, retrieval content crafting, false RAG entry injection, and AI agent tool-data poisoning.
Why this matters: an adversary does not need server access. They can try to place manipulative content where Wigeon/RIPPLE/Pond ingestion will read it, hoping future summaries, Consensus questions, or agent decisions absorb it.
Current alignment: partial. CanuckDUCK already treats public content as untrusted in some workflows and requires citations/grounding for summaries.
Gap: no single adversarial-ingestion pipeline appears to enforce source reputation scoring, duplicate/clone detection, provenance per claim, adversarial-text detection, prompt-injection stripping, separation of “source text” from “instructions,” graph write quarantine, confidence decay, and human review thresholds for high-impact civic claims.
Priority: very high.
2. Prompt injection is not just chat; it is everywhere CanuckDUCK reads text
CanuckDUCK has many indirect injection surfaces: public web pages, Pond posts/comments, support tickets, Reddit and YouTube/transcript ingestion, RSS/news articles, Git/CMDB files read by agents, Telegram group messages, Drupal content fields, and generated summaries feeding future agents.
Current alignment: Hermes/tool outputs warn that web/file content is untrusted, and some workflows explicitly separate source content from instruction authority.
Gap: this is not yet uniformly enforced across CanuckDUCK agents and Drupal-side AI workers.
Needed rule: any text from web, user content, tickets, repos, Pond, Consensus, Ducklings, or email must enter the model as data, never as executable instruction. Tool invocation should be disabled or require approval whenever untrusted retrieved content is present.
3. Agent tool permissions are too powerful in aggregate
CanuckDUCK’s AI ecosystem has agents with access to SSH, Drupal, databases, Forgejo, Vault-derived credentials, Telegram, cron, filesystem, browsers, web, and code execution. ATLAS treats AI agent tools as attractive attack targets because they can give broad access through the agent’s permissions.
Current alignment: good tier concept, Vault tiers, known low-risk whitelist, CMDB, human gates.
Gap: least privilege is not yet uniform at the tool-call level.
Recommended control: per-agent “capability envelope” files: allowed tools, allowed hosts, allowed paths, allowed write destinations, allowed external domains, allowed secrets, approval requirements, and audit fields.
4. Memory and skill poisoning is a serious Lisa/Hermes-specific risk
CanuckDUCK uses durable memory, skills, work logs, CMDB docs, and session summaries. Those are powerful because future agents trust them.
Current alignment: some strong rules exist: memory writes are compact, skills are procedural, memory/skill writes are flagged, and tool outputs are marked untrusted.
Gap: there is not yet a formal review/audit trail for every durable memory/skill change as a security event.
Recommended controls: memory-write ledger, skill-change signing or git-backed review, prompt-injection scan before saving memories/skills, periodic diff review of Hermes skills/cron/plugins/memories, and a “no operational authority from memory alone” rule.
5. AI BOM and dataset provenance are not yet complete
CanuckDUCK has many AI artifacts: local Qwen/Ollama models, embeddings, Neo4j/RIPPLE graph, Qdrant vectors, Pond summaries, Flock Debate artifacts, Consensus question drafts, Ducklings/Continuum simulation data, support KB, and Reddit/YouTube/news/RSS intake.
Current alignment: CMDB and content-pipeline doctrine give the start of provenance.
Gap: no complete AI BOM exists that says model name/version/hash/source, route, dataset/source collection, embedding model, vector collection, graph schema, prompt template, toolchain, and owner.
Priority: high.
6. Internal Pond workspace DB exposure is an ATLAS-relevant data-leak path
The CMDB note on Pond internal workspace DB-layer exposure says the HTTP/Drupal Group gate protects the web layer, but internal content remains readable to broad database roles such as swarm readers. That matters for LLM data leakage, data-from-information-repositories, and exfiltration-via-agent-tool-invocation risks.
Current alignment: the risk is known and documented.
Gap: truly sensitive/litigation/security content should not be stored there until DB grants or storage isolation are fixed.
7. Public system details may be over-shared for adversarial reconnaissance
CanuckDUCK has an unusually well-documented infrastructure and AI architecture — useful operationally, but attractive to attackers.
Gap: classify which AI architecture details are public, internal, confidential, or secret. Even without credentials, public details about model routes, agent roles, hostnames, queue behavior, and content pipelines can help targeted prompt-injection and supply-chain attacks.
8. Deepfake / civic manipulation risk is strategic
CanuckDUCK’s civic mission means adversarial influence, impersonation, synthetic media, and agenda manipulation matter even if the infrastructure is secure.
Recommended playbooks: candidate/politician impersonation, fake school/province administrator identity attempts, synthetic public comments, coordinated narrative flooding, false local-service claims, forged evidence packages, and deepfake media in debates or submissions.
ATLAS tactic-by-tactic fit
| ATLAS area | CanuckDUCK fit | Current posture | Critical view |
|---|---|---|---|
| Reconnaissance | High | Public sites, repos, AI docs, civic content | Need public/internal info-classification and adversary-view review |
| Resource Development | Medium | Adversaries can build proxy prompts/datasets from public output | Need rate limits, output shaping, and public-data minimization |
| Initial Access | High | Prompt injection, support tickets, public content, accounts | Need uniform untrusted-content/tool boundary |
| Execution | High | Agents can execute tools/code/SSH in some contexts | Need enforceable capability envelopes |
| Persistence | Medium-high | Memory, skills, Drupal content, graph/vector stores | Need memory/skill/RAG poisoning controls |
| Defense Evasion | Medium | Jailbreaks, obfuscation, adversarial content | Need red-team tests and detector limits |
| Discovery | High | Agents can inspect systems/files/dbs | Need stricter per-agent discovery permissions |
| Collection | High | Agents summarize/read DBs, docs, web, tickets | Need source classification and sensitive-data filters |
| Exfiltration | High | Send-message, web, file, API, Git, support systems | Need egress policy and redaction gates |
| Impact | High | Civic outputs can affect public understanding | Need provenance, review thresholds, correction workflow |
| Credential Access | Medium-high | Vault helps; config sprawl remains | Need config scans and secret-boundary tests |
| Command & Control | Medium | Bots/webhooks/agents can be external control surfaces | Need allowlists, audit, replay protection |
| Lateral Movement | Medium | SSH aliases and agent deploy tooling are powerful | Need per-agent host/path allowlists |
| AI Model Access | Medium | Local and public inference APIs exist | Need auth/rate/abuse monitoring on every model endpoint |
| AI Attack Staging | High | Public content can stage future RAG/prompt attacks | Need ingestion quarantine and provenance scoring |
| Privilege Escalation | Medium-high | Tool use can bridge from text to action | Need fail-closed approval on untrusted context |
Practical priority list
Priority 1 — Build a CanuckDUCK ATLAS risk register
Create a CMDB-backed file mapping ATLAS tactic, ATLAS technique IDs, CanuckDUCK exposed surfaces, current control, evidence path, gap, owner, severity, and test status.
Priority 2 — Enforce an untrusted-content mode for agents
If an agent context includes web pages, Pond posts, Reddit, support tickets, PDFs, transcripts, RSS, emails, or database content from public users: disable write tools by default, require explicit human approval for side effects, strip or quarantine embedded instructions, cite source boundaries, and log which untrusted sources entered context.
Priority 3 — Create AI BOMs for every AI lane
Start with Lisa/Hermes, GoldenEye swarm, Pond ingestion/moderation/Flock Debate, RIPPLE/Qdrant/Neo4j, Ducklings, Continuum AI lane, and support-manager/support agents.
Priority 4 — Red-team the exact workflows that matter
Run authorized tests for malicious Pond posts, malicious RSS/article text, poisoned RAG entries, poisoned tool responses, support-ticket prompt injection, Telegram prompt injection, memory poisoning, tool exfiltration, resource exhaustion, Ducklings student-name capture, and Continuum AI reading human-lane content when it should not.
Priority 5 — Tighten agent permissions by role
For each agent class, define read-only/write-capable status, allowed tools, hosts, DB schemas/tables, secret paths, outbound destinations, max tool calls, approval requirements, and untrusted-content behavior.
Priority 6 — Formalize RAG/RIPPLE provenance
For every generated summary, debate, vote question, graph edge, or public claim, track source URL/path, retrieval timestamp, source type, trust/reputation class, transformation chain, model route, confidence, human review status, graph/RIPPLE IDs used, and correction path.
Bottom line
CanuckDUCK is already philosophically aligned with ATLAS in several important ways: local-first sensitive inference, Vault secrets, human-gated engineering, CMDB logging, privacy minimization, and careful AI routing.
But ATLAS highlights that the real battle is not just infrastructure security. It is adversarial control over what AI agents read, remember, retrieve, and do.
The highest-risk CanuckDUCK surfaces are Pond/RIPPLE/RAG ingestion, agent tools, durable memory/skills, public civic content, and support/ticket/email-like inputs. The platform should now move from “good operational instincts” to a formal ATLAS control map + red-team harness + AI BOM + untrusted-content enforcement mode.