Lion Cipher Lab

Build a grounded ReAct agent that triages a suspicious binary with capa + FLOSS — and measure its hallucination rate

• AI Security
• Advanced
• ~90 min
• Free · no account required

Why it matters

The tempting demo is easy: paste a malware sample's strings into a chatbot, ask 'what does this do,' and read back a confident paragraph full of ATT&CK technique IDs. It looks like triage. It is not — because a language model will happily assert capabilities the sample never had, invent technique numbers, and narrate behavior it has no evidence for, and it does all of that in the same fluent, authoritative voice it uses when it is right. On a real triage queue that is not a curiosity; it is a way to route an incident wrong and burn an analyst's trust. The fix is not a better prompt. It is…

What you'll learn

• building a small ReAct-style agent (Reason -> Act -> Observe loop) from scratch against a FREE LOCAL model via Ollama, with no API key anywhere on the graded path
• wiring an LLM to drive real static-analysis TOOLS as its actions — capa for capability detection and FLOSS for obfuscated-string recovery — over a benign binary you compile yourself
• the three controls that make an agent safe to run unattended: a TOOL ALLOWLIST (it can only call tools you named), a hard STEP BUDGET (so the loop cannot run forever), and structured tool-call parsing (so a malformed action is rejected, not executed)
• an EVIDENCE GATE: the agent may assert a capability or IOC only if it cites a concrete tool observation (a capa rule name, a FLOSS-decoded string) that literally appears in captured output — unsupported claims are dropped FAIL-CLOSED
• establishing a TOOL-DERIVED ground truth by running capa/FLOSS directly, then MEASURING the agent against it: a hallucination rate (asserted-but-unsupported / total asserted) and a miss rate (ground-truth items the agent never asserted / total ground truth)
• the named failure modes of an LLM triage agent: hallucinated capability (an invented ATT&CK technique the tools never showed), tool-output misread, hallucinated tool name, loop non-termination, and over-trusting a FLOSS string as proven behavior
• the judgment that separates an engineer from a demo: WHEN an agent helps a triage analyst (drafting, narrating, prioritizing) and when it must NOT be trusted — the tools are ground truth, the model drafts, a human confirms

Steps in this lab

1. The frame: the model narrates, the tools are ground truth
2. Stand up a free, local, key-free model with Ollama
3. Install capa + FLOSS and compile ONE benign binary to analyze
4. Establish GROUND TRUTH by running the tools yourself, directly
5. Build the ReAct agent: allowlist, step budget, structured parsing
6. The evidence gate: fail-closed grounding
7. MEASURE: hallucination rate and miss rate against the tool-derived truth
8. The named failure modes, said plainly
9. Judgment: when an agent helps, and when it must NOT be trusted
10. The way a pro does it — and what you actually built

Open the full interactive lab →