Model Attack Surface

Every model is an attack surface. Small models ship fast and fail differently, and each new model resets the map. Attack-surface analysis is per-model work, and the cadence of the field has turned it from an audit into a schedule.

Why per-model, not per-vendor

The instinct is to assess the vendor once and inherit the assessment for every model they ship. The instinct fails because models within a vendor's line fail differently from each other. Capability changes the surface. A model that can call tools has a different attack surface than one that cannot, and the tool ecosystem differs per model, per version, per deployment.

The surface is drawn by what the model can do, what it is connected to, and what trusts it. Change any of the three and the map is stale. In a field that ships weekly, the map goes stale weekly.

What resets the map

Three events, in practice. A new model enters the fleet. An existing model gains a capability, through a version bump, a new tool integration, or a config change. Or a deployment context shifts, which changes what the model can reach without changing anything about the model.

Each event invalidates the previous analysis. Fleets that treat the analysis as a one-time audit are running on maps whose terrain has moved, and the attacks that land are the ones that arrived after the last survey.

The cadence

Surface mapping is scheduled work, not a one-time audit. The cadence follows the release cadence, because the map redraws whenever the fleet changes. Each cycle re-ranks the doorways, re-verifies the checkpoints, and re-asks the only question the analysis exists to answer: what can this model reach that it should not.

The fleets that schedule the mapping move at the field's speed. The ones that audit annually are mapping terrain that stopped existing eleven months ago.