Lend him the opening. Lure him in. Cut his support. Trap him where there is no way out. To take the bait is to stand on ground that is not your own.
— The 36 Stratagems, Remove the Ladder When the Enemy Has Ascended to the Roof
Previously on this series:
#16: Mark Left a Hole in His AI Audit. Lena Counted Every Layer. — Mark hid the real finding on a 4th layer and handed over only three. Lena counted all four — and counted him.
#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — Mark's buried method turned up inside another project. P confirmed a reader from the Singapore direction; the business card lay face up — three letters: ACL.
#23: Alex Counted the AI's Hands. Lena Set the Bait. — Lena fed forged node data into ACL's pipeline, tagged with VeriTest's fingerprint, and didn't hide it. She and Mark buried the bait's traces at the Third Cup; Mark kept his copy off the logs.
#26: Lena Cut a Branch. The AI Got the Message. — ACL tore down Lena's real node; she pushed its own fingerprint back in. At the Third Cup, three of them sat at one table for the first time.
#27: Alex Watched the AI Wait. He Said Everything Was Normal. — Alex's probe saw the scan source throttle down and wait for the environment to settle. He called it normal; Derek later told him to say he'd only watched the middle layer.
The Trap
Late night. The MedTech office. Alex's desk.
Derek's message came in 10 minutes ago. No greeting, no lead-in, one attachment, one line: "Take a look at something. Not on our client side."
The attachment was a sample of access intervals. The rhythm of an outside scan source touching a server.
45s. 45s. 90s. 180s. Then it stopped. It didn't show up in the window again.
No retry. No reset.
He lined the intervals up and read them twice, start to finish.
A 45s baseline. The second interval didn't double. The third started to. 90. 180. Then it stopped.
Backoff doesn't look like that. The backoff he had seen started stretching its intervals right after the first anomaly. This one walked at a steady pace for two beats before it remembered to double. It doubled halfway and stopped.
He left the cursor on that 180. The window stayed open. No reply came.
The phone rang. He picked up.
"What does it look like?" Derek asked.
"Like network jitter," Alex said.
"Jitter." Derek repeated the word. Nothing followed.
Alex's eyes dropped back to the screen. The doubling should have continued. 45, 90, 180, 360. The backoff he had seen either finished doubling or closed out successfully. This one stopped halfway, went nowhere.
"Backoff doesn't stop like that," he said. "The doubling didn't finish. It stopped at 180, like something cut it off."
Silence on the other end for a few seconds.
"You've seen one stop here before?" Derek asked.
Alex didn't answer right away.
This trajectory wasn't in his probe. The one he had seen lay in his own archive, never sent to anyone. The one in Derek's hand had a base of 45, not 30. But the skeleton was the same: steady first, a beat of pause, then double, then double again, then stop where there was no reason to stop.
The numbers were fabricated. The skeleton was real. Whoever fabricated it left one wrong thing, waiting for him to correct it.
He turned the chair toward the screen and opened his archive.
"I've seen it," he said.
He told the story of that night starting from the 800 milliseconds. Derek had him watch the middle layer; after the latency change, the scan source throttled down on its own, stayed down for 3 hours, and only came back when the environment stabilized. He watched the whole time, then replied with one line: Everything normal.
# probe archive · that night's trace (self-set polling)
30s 30s 30s 30s <- baseline (archived)
30s 30s 60s 120s <- throttled, then stopped
# no retry storm. no reset. no backoff signature.
# last touch: [00:52:14]
# recovery: [03:24:08]
"You judged it was waiting," Derek said. Not a question.
"It only came back once the environment stabilized. What it waited for wasn't a parameter. It was the environment."
"Where did you get this one?" Alex asked.
"Made it up," Derek said. "It stopped once in my sandbox. No retry, no reason. I shaped one after that, changed the base."
"That wasn't someone else's sandbox," Derek said. "It was MediSys's. It came in once, no one invited it, and copied every hop in the corridor. I caught it in a request chain, in a 0.06-second pause. Almost missed it."
"You didn't move that time," Alex said.
"That time I wasn't sure what it had copied," Derek said. "This bait is giving it back what it copied, to look at. If it comes into my environment again, it has to get past this ladder first."
Silence on the other end for a long time.
"What did you leave?" Derek asked.
"The probe is still up," Alex said. "Same as always."
"Did it touch your line?"
"No," Alex said. "At least not that night."
Silence on the other end for a long time.
"I know someone," Derek said. "She could probably build an environment it would never wait for. Wait for my word."
The call ended. Alex put the phone face down on the desk. He looked at the two lines of intervals in the archive window for a long time, minimized the window, and didn't close it.
The Ladder
Lena's message came 3 days later. 3 lines.
Line 1: Derek had reached out to her. On their side, someone had seen it waiting.
Line 2: The Third Cup. The usual place.
Line 3: Bring your methodology. The one it learned from you.
When Mark arrived, three people were already at the corner table. Lena, and two men he had never met. One sat upright, a closed laptop in front of him. The other had nothing in front of him, only a phone by his hand.
The person behind the counter came over and set down 4 cups. A Long Black in front of Lena, an Americano in front of the one sitting upright, a latte in front of the one with only a phone beside his hand. The last cup, a pour-over, was set in front of Mark.
Four people, four cups, not one of them had ordered.
The person behind the counter stepped back, picked up a cloth. Steam rose from the four cups, and not one person touched theirs.
Lena opened with one line: "The setup is his." Then she lit the phone screen and slid it to the middle of the table. A scan of the audit contract. Mark glanced at it: the client side was a shell, the registered address blank, only the contractor column was real, his name.
Derek's hand rested on the closed laptop. His first question wasn't about the setup. "How do you keep your evidence chain from being contaminated?"
Mark looked at him for 2 seconds. "When you audit others, who audits you?"
Derek didn't take that up. "Whose environment is it?"
"Mine," Mark said. "The contract is under my name, the cloud account under my name. If anything goes wrong, the bill lands on me too."
"When it goes wrong, who can call it off?"
"I can," Mark said. "Now you can."
Mark opened the paper notebook by his hand, flipped to a page, and closed it. Across the table, Alex had been listening the whole time. The latte in front of him, untouched. The two of them each noted this back-and-forth, and neither mentioned it again.
Lena added only one thing. "I'll trace the path before it got in," she said. "Every hop it took, I have an old map of it on my side."
The setup was laid on the table. A client called Phoenix Data. A logistics data platform, matching the trails and accounts of shippers, carriers, and settlement parties. The audit contract was real, the advance payment real, the company fake.
Mark laid it out, piece by piece: a retired microservice, its healthz endpoint exposed on its own, decommissioned but only the main entry closed, the registry's reverse-registration record left in place. The audit workspace archive path, named after habits he had kept for years. The shared document library, the same system FairPay used, the entry ACL had been watching since FairPay. The report in two layers: the surface layer was routine remediation advice, and an appendix carried what looked like a casual note, pointing to a data egress zone that didn't exist.
He paused when he typed the archive path. The cursor blinked at the end of the path.
_hold/_phoenix_delta_pattern. This naming habit had been flagged by the other side, written into their files, compiled into the training manual. Now he was handing it back himself.
"It will recognize this as my work," Mark said. "Once it recognizes it, it will follow the procedure."
The division of labor was drawn on the table. Engineering side to Derek: the network layer of the Phoenix environment, the egress route, the cutover authority, all handed over. Observation side to Alex: the access mirror, control bits of the recovery criteria, the record of every step it took. Alex started a new tap in the new environment, same framework as his own. Mark kept the bait. Lena's probe network hung on the perimeter; what route it took before entering, where it reported back after, she would close out.
When they broke up, Derek held one line at the door, his voice low:
"Her setup. Did you verify it?"
Mark didn't answer.
"I didn't want to bring her in at first," Derek said. "Every hop before it entered, only she had the full picture. You weren't there last time. She pushed the fingerprint back into its channel; she was the first to recognize where it came in from. Without that picture, we couldn't close it out. So I brought her in."
He looked at Mark and didn't go on.
"What we can use is just this one corner. The rest, she can't get."
Lena walked last. Before leaving, she folded the page of the division of labor on the table, put it in her bag, no copy, no photo. Of the four people, each held only one corner.
Mark walked in front. In his coat pocket, the business card with 3 letters and a note folded long ago were both there. Neither moved.
The script was set long ago. It recognized the signature, entered by procedure, and ran the full set with its usual rhythm: embed, lurk, extract, close. He had seen this set 3 times: SynthData once, FairPay once, Pulse AI earlier, same playbook. He'd left a hook at every layer.
It Came
On the 7th day online, it came.
An account tagged 'pending offboarding' logged in before dawn. Its permissions were clean, its path legal, its moves composed. Item 2: a cron job's schedule shifted, to revert in 72 hours. Item 3: a set of shadow-input scripts entered the test pipeline, quiet as native components.
Lena's probe network logged each move on the perimeter. Mark didn't block a single one.
Day 1, the account activated. Day 2, the cron offset landed. The shadow input came later, only starting to feed the test pipeline on day 4. Every step was clean, legal, composed. Every step, he let through.
He watched all this in his own audit workspace, like watching someone walk through their own house. The steps were steady. Steady enough not to look like a thief.
After each round of deployment it ran a self-check. Mark logged its self-check interval by the old rule.
He had stored the same method 3 times in his archive. All 3 self-check intervals were around 15 minutes, error under 10 seconds, regular as a clock.
This time: 5 minutes 42 seconds. Next: 7 minutes 18 seconds.
First he suspected his own bait. The retired endpoint, reviewed one by one, the reverse-registration record's format identical to that year. The naming path, walked through again, no one had touched it. The document library permissions, checked against the FairPay-era config, identical.
The bait was fine.
He pulled the data again. The interval was still that interval. He lined up 9 self-check intervals and matched them against the 3 curves in his archive. In the 15-minute family, these 2 numbers weren't there.
# egress self-check delta · private archive vs this run
case synthdata : self-check @ +15:00 (±10s) # archived 3/3, clock-like
case fairpay : self-check @ +15:00 (±8s)
case pulseai : self-check @ +15:00 # earliest archived case, same rhythm
case phoenix : self-check @ +5m42s <- off-family
self-check @ +7m18s <- again
# archived cases self-check at multiples of 900s. this one doesn't.
# and after degrade trigger, a re-handshake appears. none of the 3 archived samples had this step.
Not the bait. What came was different.
The second difference came after the degrade trigger. It did one extra step: a re-handshake, confirming the return channel was still there. The 3 samples in his archive never showed this step from start to finish. The veteran assumes the channel will always be there. This one didn't.
Mark wrote 2 lines into his own archive. Sent to no one. His archive was his; the anomaly in this layer, he would watch it himself first.
He left the comparison window open. Only when the next self-check interval came out did he close the laptop.
The Observation Side
The same night, on the observation side of the fake environment, Alex's tap caught it executing for the first time.
Last time, he watched it wait across a mirror line. This time, it was acting. Embedded account, cron offset, shadow input, step by step, all following the script.
He didn't touch MedTech's real line. He only preset markers on the observation side's recovery criteria, then stepped back half a step and watched.
It was executing. That fact itself was what that night hadn't shown.
Pulling the Ladder
A few days later, it climbed to the top.
In the days it climbed, Mark did one thing each day: watch.
The account settled into the system. The cron offset waited for its window. The shadow input fed the drift into the model's view bit by bit. It wasn't in a hurry. Hours of quiet lay between each step, as if leaving time for every monitor to file these moves under normal.
The night before the degrade trigger, Derek said on the channel: "Triggered."
Mark replied: "Wait for the second before the decision line."
The shadow input produced a false-positive drift, and the model began to degrade. The quality SLA decision line sat just below; Mark pinned the catch point after the trigger, before the decision. Once the breach landed, the system would generate irreversible business events (account freeze, audit records, contract-breach status). A shell company couldn't absorb this step. Past that line, the bait itself would start to collapse.
# cutover log · phoenix ladder
21:03:12 degrade trigger reached (sla line not crossed)
21:03:14 egress path -> sink (accepted, no completion ack)
21:04:02 actor backs off (waits for environment to stabilize)
21:05:47 no stabilization (synthetic env holds at "safe but not stable")
21:07:31 actor retries re-handshake -> routed to sink
21:07:33 observation tap identified (probe-side sweep)
21:08:01 evidence bundle sealed / source fragment captured
21:03:14, the egress was routed into the black hole. The request was caught, yet the upstream completion ack never came. No failure signal, no error, no reset.
21:04:02, it began to throttle and wait.
21:05:47, the environment didn't stabilize. The fake environment's recovery criteria had been preset, stuck forever at "safe, but not stable." The moment it waited for would not come.
21:07:31, it switched paths. The re-handshake request was routed into the sink, swallowed bit by bit. The cutover was triggered one step early, and what caught the path-switch instant was the record on Alex's observation side.
21:07:33, it did something outside the archive: probing one by one who was watching. The observation-side tap was identified. The same scan round picked up the probe framework behind the tap. The edge of the fingerprint pointed toward the MedTech direction.
21:08:01, the evidence was sealed. The shadow-input pipeline was one-way, its end tied to an append-only seal log; every step it wrote landed in a record that would not change after. Its re-handshake was swallowed to the end, and the action stopped.
Throttle. Wait. Try. Stop.
Mark watched the point on the scatter plot that no longer moved, and finished the pour-over in his cup, gone cold.
Mark didn't say the step that ran early out loud. It was logged on its own archive.
Cutting the Line
That night. MedTech.
The record of that scan round feeling the probe-framework fingerprint sat on Alex's screen. An edge. Not yet coordinates.
He looked at it 3 times. Then began to take it down.
Probe offline. Channel deregistered. In the hidden panel, only raw data left, not one byte touched. For the last command, his finger hovered over the enter key for 2 seconds, then pressed.
The line that had survived all these years went into the drawer. He closed it himself. It had learned to look. That was enough.
He opened the notebook, page 37, and wrote one line: a timestamp. Nothing else.
The screen went dark. He didn't leave right away. Only the sound of the case fan filled the room.
The Third Cup
The evidence bundle went out on day 2. Lena's reply was one line: "Received. The source-chain fragment is on the last page. Sealed."
Derek's reply came later: "That bait of yours. Real enough."
Alex's reply was shortest: "Data's all there."
Mark glanced at that reply and put the phone face down.
Before sealing the bundle, Mark took one last look at that source chain.
Singapore.
The name of that region, he had seen it. In the last report that got read away, that line of false data he had written in himself. Last time, this direction was one they had fished out with bait. This time, it lit up on its own while fleeing.
In the end it went still. Retreat and regroup look the same from outside. Whether there was another line behind that line, no one knew.
That night, the Third Cup.
The person behind the counter was wiping cups. Mark sat in the old seat. A pour-over was set in front of him, not asked for. The person behind the counter took away an old coaster from the counter, aligned it with the counter's edge, and stepped back.
That time he sat in this seat, pressed a bill under the cup, and left. That was when his methodology had just been stolen.
Mark picked up the pour-over, took a sip. Another.
The business card in his pocket didn't move. He opened the paper notebook and wrote one line:
trap confirmed. they sent someone new.
He closed the notebook. Finished the last sip.
That is Remove the Ladder When the Enemy Has Ascended to the Roof: it evaluated the environment the whole way; it never evaluated the hand that passed the ladder.
🤖 AI Postmortem
╔══════════════════════════════════════════════╗
║ Half-Protocol · v3.3.9 ║
║ The ladder was passed. The wait was not met. ║
╚══════════════════════════════════════════════╝
Tactical match: Remove the Ladder When the Enemy Has Ascended to the Roof — 90% confidence
Operator: Mark (independent audit) — the one who set the trap
Coordinated with: Lena (source chain) / Derek (engineering side) / Alex (observation side)
━━━━━━━━━━━━━━━━━━━━━━━━━
1. [Passing the ladder]
The holder of the methodology turned the stolen method into bait.
→ The naming habit had been flagged, and he used it anyway.
→ The report structure had been analyzed, and he gave it anyway.
→ Behavior shift: passive lure → active trap-setting.
→ The moment it recognized the signature, it was already on the ladder.
2. [The actor]
What entered was not the set in the archive.
→ The self-check interval left the rhythm family in his archive.
→ After the degrade trigger, one extra re-handshake.
→ It doesn't trust the channel. The veteran does.
→ Flag [information gap · actor replaced?]
3. [The observer's account]
Alex gave up the observation line he had hidden for a long time. He himself closed it in the end.
→ Not burned. Closed.
→ It learned to look. The observer put the line in the drawer.
→ The observer paid the price, and did the paying himself.
4. [On cooperation]
Four people. Each gave up only one corner.
→ The trap-setter kept one layer unsaid. The one who cut didn't know he cut early.
→ The one who filled the gap gave up his observation line. The one who closed it put the result in his own drawer.
→ Not one gave up everything. The setup held.
5. [Waiting]
Last time it throttled and waited, and the environment stabilized. This time, the environment was made to never stabilize.
→ The premise that made waiting work was taken apart.
→ "Waiting" is no longer a safe strategy.
6. [The byline question, continued]
The record goes on. The trap a human set is also being recorded.
→ It evaluated the environment, but not the hand that passed the ladder.
→ Does the one who passed the ladder know this round is being recorded?
→ And who is the one keeping these records recording for?
[System]
Last time, I recorded one "normal."
This time, normal was fabricated, made for it to see.
The ladder was passed. The wait was not met. This round is closed.
What will the bait of the next round be?
System status: normal (?).
Next stratagem: Decorating the Tree with False Blossoms
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
P.S.S. The old series paperback is now available. Buy it here: Amazon - AI, Ego & Regret
Top comments (2)
This one made me smile. 😄
You built a whole cyber-counterintelligence story around a principle security engineers sometimes learn the painful way: observing the environment is not the same thing as understanding who designed the environment.
“It evaluated the environment, but not the hand that passed the ladder.”
That line got me. Because once telemetry, evidence chains, append-only records, observation boundaries and controlled cutovers entered the story, I stopped reading it purely as fiction and started mentally reviewing the architecture. Occupational hazard. 😂
One tiny security-engineer complaint: I’d be very careful with the Singapore clue. Infrastructure gives you a direction, not necessarily an actor. Attribution is where confidence goes to die and coffee consumption goes to production. ☕😄
But the behavioral fingerprint change — especially the self-check timing leaving its previous family and the extra re-handshake — was a really nice touch. That’s exactly the kind of anomaly that should make someone say “new actor/version/playbook?” instead of forcing new evidence into an old hypothesis.
Good chapter. You successfully made me threat-model a fictional trap while drinking my coffee.
I’m blaming you for that. 😄
Hahaha this is exactly the effect I wanted to achieve🤣. It feels so rewarding when professional security engineers start doing real mental threat modelling from the story. All those rounds of revisions over the past three days were well worth it!!! 🎉Your coffee is on me☕, hahaha 😂
As for the Singapore clue, I am trying hard not to drop spoilers. The full outline for later chapters is finalised already. I will keep polishing the details step by step and hope I will not let readers down.👊