Keep your allies close.
Keep your enemies closer.
But before you strike, count how many hands they have: the ones you can see, and the one reaching out from somewhere you don't know. — The 36 Stratagems, Befriend a distant state and strike a neighbouring one Previously on this series: #19: Mark Found His AI Audit Method in a Training Manual.
He Left a Trap in His Report. — P's entry was swept.
P left a note: two weeks. #20: Alex Felt the AI Collector Slow Down.
He Knew Someone Else Had Made a Move. — A gateway with TTL 247 was caught by Alex's probe. #21: The AI Thought P Was Still Alive.
P Was Already Gone. — The response layer still answered.
The person behind it was gone. #22: The AI Chose Its Door.
Lena Closed It. — Pulse AI was exposed inside the audit sandbox.
Lead investor Apex Capital had tens of millions tied up.
Torres left one line: Apex.
Singapore.
Run.
The Scan 2 AM.
Alex flipped through probe data out of habit.
No lights on; the screen lit his face.
The coffee cup sat on his right, first sip already cold.
He didn't notice.
The TTL 247 gateway had been silent for nearly two weeks.
He hadn't shut the probe off.
It barely used any resources, sitting there in the middle of the night like a lamp nobody watched.
He checked it half out of habit, half out of something he couldn't name.
Today there was a record that shouldn't exist.
Not that gateway.
Another path: ACL's asset scanner was sweeping an address range.
He sat up a little straighter, his hand paused over the keyboard for half a second, then pulled the timestamps again.
The frequency was wrong: high-density targeted scanning, almost plowing through segment by segment.
In the target range, one block he recognized: the MedTech test environment.
He aligned the timestamps.
Scan source egress: Singapore.
High density.
Segment by segment.
The exclusions had a pattern, not random skips.
Someone had crossed lines off a list.
He'd seen this scanning behavior before.
Last time Alex and Derek worked together on ACL's pipeline, using a bypass probe as cover to redirect the collector's output from to .
After the redirect, when the scanner re-validated, the behavior pattern was identical.
Same traversal order.
Same exclusions.
Not a coincidence.
One more entry.
When the pipeline was tampered with last time, the probe had recorded a device fingerprint in the mirror: a device that wasn't in MedTech's asset inventory.
Today it moved again.
A few seconds.
Then gone.
Alex didn't know what it carried.
He only knew it had happened.
He closed the logs and called Derek.
Two rings, then picked up.
Derek's keyboard went quiet for a beat. "Talk." Alex walked him through the scan.
Derek checked the mirror pipeline on the MediSys test side.
The redirect record was still there, the one he'd left, clean in the gateway logs, but the edit itself left a trace: ACL was hunting for whoever touched their pipeline.
He stared at that record for a long time before switching windows back.
Flipping through logs, he caught a naming pattern, not something he'd written.
Leftover in ACL's own internal path: a variant of .
It looked familiar, but he couldn't place the hand behind it.
He made a note and moved on. "They're looking at me." Derek said.
Alex didn't pick up the thread. "Scan source is Singapore.
Behavior matches the pattern from last time, after the pipeline was changed." The line went quiet for a few seconds. "What are you thinking." Derek asked. "One thing." Alex said. "Is this scan coming from the same egress on its own, or is something else moving too." Derek didn't answer.
Alex didn't wait. "I need a honeypot.
On your side.
It doesn't move.
It only records." "The sandbox is mine, monitoring goes through my existing compliance channel." Derek said. "But you need to tell me: what fingerprint." "Mirror the interface of the old pipeline.
Responses deliberately half a beat slow, 100–200 ms behind the surrounding services, like an overloaded legacy box.
TLS cipher preferences, certificate order, all matching the old pipeline.
Make the scanner file it under 'old but worth another look'." Derek thought about it. "Then what?" "Then we wait and see who reaches out first." The Clause Lena got Marcus's message on the Thursday afternoon of the week the audit evidence went public.
Marcus, as the reviewer, had formally notified the two portfolio companies per process: notice before any action.
He came to Lena only after sending it.
Marcus is VeriTest's technical partner, Lena's right hand on execution.
The message was short.
Two of Apex Capital's portfolio companies had flagged abnormal data-sharing clauses in routine compliance review, a side letter obligating them to send training data back to the investor.
The wording used the same template as the Pulse AI contract scan sealed away the day of the sandbox takedown.
Lena read it.
Closed it.
Opened it and read again.
When she finished, she didn't put the phone down.
Her finger traced a half-circle on the screen, stopped, traced back.
Apex Capital.
Delaware-registered, Singapore-run, website clean as a template.
Led Pulse AI's Series C.
After the audit evidence went public, tens of millions sat frozen on its books.
She'd always thought Apex just lost money.
Now she saw it wasn't only that.
The money was a loss, the pipeline was a bigger one.
Pulse AI's engine ran inside client environments and shipped training data back to its investor.
The clause was written from a template, and templates are built for more than one customer.
Which company's money got frozen didn't matter.
What mattered: how many others were holding the same template.
She called Marcus. "Next week's industry compliance workshop: can the agenda still take one more item?" "Which one?" "No Apex name." She said. "But the clause wording, the technical path of the data return, sanitized, then put out there.
Let the industry see it for themselves.
These two are already caught.
I'm looking for the ones that don't know yet." Marcus paused. "I'll review the material.
If anything blows back, it's on me.
Who are you fishing for?" "I don't know." Lena said. "I'm checking whether there are other fish in this water." The Honeypot The honeypot went up in the MediSys test sandbox.
Derek gave Alex read-only access, trust left over from the last time they touched that pipeline.
It came in handy now.
Derek replicated the old pipeline's interface fingerprint: responses deliberately 100–200 ms slower than surrounding services, TLS server cipher preferences and certificate order identical to the old pipeline.
The honeypot answered handshakes and completed TLS negotiation, but never initiated a single request.
Like a house that just had its lights turned off: windows open, ashtray still warm, lock fake.
First night, nothing came.
The sandbox sat in an idle subnet at the bottom of the scan order, and the scanner only plowed a /24 per pass.
It hadn't reached this block yet.
Second night, Alex pulled the honeypot's touch records, still just scattered scan noise, into the analysis framework he'd been using.
His old MedTech approach: no trained model, just full records, look first at who hid what.
ACL's scanner was the same.
It never exposed its scheduling rules, but its behavior left shadows: input patterns, path preferences, scan rhythm, timing regularities.
First round of shadow data was sparse, but the rhythm skeleton was already visible: which endpoint types it kept coming back to, which it never touched again after one pass.
Alex logged both categories.
He noticed one more thing: a category of endpoints that fit neither label: not revisited, not passed over, deliberately skirted.
Alex stopped at the edge of the table.
That region was blank.
He didn't know if it was ACL's oversight, or a space deliberately left for probing.
He stared at the blank, tapped his fingers twice on the desk, stopped.
Then he closed the table.
His understanding of this AI was one notch deeper than yesterday.
He sent Derek a message.
One line: keep it running.