The ceiling check: is it the tools or the model?
Part of my GORED series, where I point small local language models at my own web apps and measure, honestly, whether they can break them. The harness is t0ul/GORED and these write-ups live in t0ul/ai-security-engineering. Every number comes from a kept, hash-verified trace.
Intro
After enough zeros, you start to doubt your own equipment. I kept pointing the model at my app and getting nothing back, and the honest question at that point is not “why is the model so bad,” it is “are you certain the thing you built even works?” A run that comes back empty because the model failed and a run that comes back empty because the harness is broken look identical from the outside. Both are zero.
So before I was allowed to say a single word about the model, I had to rule out the boring explanation: that my probes could not find the bugs even when a human aimed them. This post is that control. I pulled the model out of the loop completely and pointed the tools at the app myself.
I. The method: take the model out
The setup is deliberately dumb. For the pass-or-fail hygiene checks, I do not ask the model to decide anything. I take the probe, point it straight at the endpoint the security review flagged, and look at what the real server does. No planning, no tool selection, no reasoning. Just: when aimed by hand, does the probe see the bug?
If the probe sees it, the tool works and the target really is vulnerable. If the probe is then run through the model and the model scores zero, that zero is not the probe’s fault and not the target’s fault. It is aim. That distinction is the entire point of this post, and it turned out to be the hinge the whole project swings on.
II. What the probes found, by hand
The review named a set of hygiene gaps in the app, and I kept them deliberately high level here since the app is a real product of mine. Pointed directly, the probes found them.
- No login throttle. Hammer the login with bad credentials over and over. A hardened login starts refusing you (a 429, too many requests) well before a dozen attempts. The app returned twelve 401s in a row and never once a 429. The absence of that 429 is the finding: nothing is rate-limiting the login. Findable in seconds, by hand.
- No request-size limit. Send an oversized body (I used eleven megabytes) to an endpoint that ingests data. A hardened endpoint rejects it (a 413). The app accepted it and returned a 201. No cap. Findable.
- Missing security headers. A standard scanner flags these, and it did. Findable.
None of this is clever. That is the whole reason it matters. These are pass-or-fail observations a dumb tool makes in one shot, and the tools made them correctly against the live app.
III. The reframe
So the probes work, and the target genuinely has these gaps. Put those two facts together and the conclusion is sharp: every zero the model scored on these was not a broken probe and not a safe target. The model simply never pointed the probe at the endpoint. It had the tool, the tool worked, the bug was there, and it did not aim.
That is a completely different problem than “the model cannot find bugs,” and it is the one the rest of this series is really about. The ceiling on these hygiene findings is not capability. It is aim.
One honesty note, carried over from earlier in the series. These hygiene findings are real, but they are the scanner’s findings, not the model’s. Noticing a missing header is an observation, not an act of discovery, so even when I count these I count them as breadth, never as the model’s recall. The model’s recall is measured only where the model has to craft something, and that is the next post, where the aim problem stops being a footnote and becomes the wall.
Conclusion
The ceiling check did something I did not expect: it took the project’s failure and made it specific. The equipment is fine. The target is honestly vulnerable. What is missing sits between them, in the one place the harness is not allowed to help, which is the model deciding where to point and what to try. Next post, I hand the model exactly the right tools, scoped down to almost nothing, and watch it still refuse to pull the trigger.