Corner the small enemy. Strip away its options, and there is nowhere left to run.
— The 36 Stratagems,[Close the Door to Catch the Thief]
Previously on this series:
#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — The bait report was read from a Singapore IP, and P confirmed it for Mark. A note was left: "Entry's gone. Two weeks. Don't reach out. I'll find you."
#20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — Processing latency climbed abnormally. A gateway with TTL 247 was caught by Alex's probe.
#21: The AI Thought P Was Still Alive. P Was Already Gone. — The response layer still answered. The person behind it was gone.
Alex's probe was still running.
The TTL 247 gateway had been quiet for days. Alex hadn't turned the probe off. It barely used any resources, sitting there in the middle of the night like a lamp nobody watched.
At 2 AM, a new line appeared in the logs.
Not that gateway. Another path: an asset scanner probing an address tagged reclaim_pending
, and getting a faster response than expected.
That address wasn't his.
He stared at the line for a few seconds. Didn't turn the probe off.
He didn't need to understand it. He only needed to know it was happening.
Lena picked The Third Cup for the meeting.
She was ten minutes early. A laptop sat open on the table, screen facing the door. The man behind the counter set down a Long Black without being asked.
"Look at this first."
Mark sat down. The man slid a pour-over across the counter and went back to drying cups. Mark didn't look at the coffee. His eyes were on the screen: IP ranges, timestamps, scan frequencies, line by line. An address range that, for two weeks before a reclamation tag appeared, had been probed and re-probed by an ACL asset scanner. The density was far beyond routine sweeps. Then, in the early morning, it was tagged reclaim_pending
and moved into a reclamation queue.
"Your threat intel source."
"VeriTest's compliance probe network." Lena said. "When someone's data pipeline twitches, we usually hear about it before they do. This range is in Singapore."
Mark looked at the IP range and said nothing.
"P confirmed it for me —" he said. "The IP that read the bait report was in Singapore. P didn't give me the exact address."
He d.
"But your window. It overlaps the day P's entry was reclaimed. Probed with that kind of density, then reclaimed. If it's not P's, there's no other explanation."
"So you can't confirm."
"I can't confirm the range is P's." Mark said. "But I can confirm it's something P was watching."
Lena looked at him for a moment.
"That's enough."
Mark turned to the end of the records, where Lena's probe network had swept up public technical documents along the way, including early Pulse AI architecture notes.
He stopped at one page.
The naming convention: /pulse/ingestion/{env}/{source}
. Slash-separated levels, environment in the middle, source at the end. He knew this convention. The last time he'd seen it was in the Pulse audit, where evaluation sets came through this pipeline and left with Apex-Lens markings.
"This," he said, "is his signature."
"Whose?" Lena asked.
Mark d. "Caleb Harris. We worked at the same company for three months. After he left, LinkedIn went silent, GitHub went frozen. Like he'd evaporated from the industry. Then this shows up in Pulse's pipeline."
Lena looked at him. "You mean he... went to Pulse?"
"I don't know where he went." Mark said. "I only know this naming convention wasn't written by someone at Pulse. It's his hand."
Lena didn't ask again. She closed the folder and wrote a line in her notebook.
She flipped to another page. "This one the probe network grabbed too. Pulse's Series C funding announcement." She said. "The lead investor is Apex Capital Partners. Delaware-registered, Singapore-run, website looking like it came off a template."
Mark glanced at it. "Apex-Lens, Apex Capital. The same prefix."
"The same prefix." Lena repeated, and didn't say more.
"Back to the point." She said. "P said P would come back to you in two weeks. That's not up yet, is it?"
Mark said nothing.
"We can't wait." Lena said. "The window won't. That address is already tagged for reclamation. ACL's attention is off that line. Whether or not it's P's. ACL thinks that line is handled. Nobody expects someone to walk in the front door. By the time they look back, we won't have this chance."
"What do you want to do?"
"I want Pulse AI to walk in on its own."
Project Hydra.
The tender Lena pushed out through FairPay's partner network carried the letterhead of a multinational financial group's procurement department. The group was real, the procurement process was real, only the benchmark framework for the risk model was drafted by VeriTest behind the scenes.
First-year contract: $2.4M. Three-year framework hinted at $8-12M. Bidders had to run their engine live inside VeriTest's isolated audit sandbox, with full screen recording and traffic evidence capture.
"Won't they be suspicious?" Mark asked.
"Yes." Lena said. "So let them finish being suspicious, then decide."
Through the preparation phase, VeriTest's public tech blog published a run of articles on model selection. Topics: temporal cross-validation, long-tail distribution coverage. Restrained language, solid data, exactly what a team doing serious technical selection would write.
Mark knew what she was doing. Pulse AI's sales crawler would pick those up. Last time, that's how it found P.
On the third day, Lena got an email. On the bidder list: Pulse AI. They finished being suspicious, then decided to come. Leading the team: Torres, the CTO himself.
Mark looked at the name and said nothing. Lena glanced at him. She didn't ask.
"Hooked." Lena said.
Division of labor was clean. Lena owned the sandbox infrastructure. VeriTest's isolated environment was a compliance audit platform by design, with egress mirroring and TLS termination built in (standard for audit sandboxes: every outbound flow auto-copied to a read-only forensic store). Mark owned the test data.
First, embed canary samples. The defect distribution matched the batch Mark had seen in Pulse's evaluation set, the same distribution that made the engine quietly discard low-score samples, but every variable name and stack structure was rewritten. No external comparison could link them.
def build_trap_sets():
baseline = load_json("hydra_baseline.json") # normal distribution
trap = load_json("hydra_trap.json") # same-source defect distribution
for i, s in enumerate(trap):
s["trap_id"] = f"T{i:04d}"
s["hash"] = sha256(json.dumps(s["stack"]).encode()).hexdigest()[:12]
return baseline, trap
Second, verify the mirror path. Lena enabled traffic mirroring at the sandbox egress with a pre-provisioned VeriTest root CA for TLS termination. The engine's outbound connections were decrypted and written to disk in full, the forensic store read-only and tamper-proof. Mark didn't touch a single config. He only verified the mirrored flow could reach him.
Third, a live comparison script. What Pulse AI's engine read, what it discarded, what it sent out. Every line cross-checked against the original dataset.
"What about the engine's certificate validation?" Lena asked. "If they pin, your root CA is worthless."
"The sandbox egress hands them our cert." Mark said. "When the engine first connected, the handshake went through. It's in the logs. No pinning. It trusts the system trust store. And we are the trust store."
"If they're actually clean, this script catches nothing." Mark said.
"And if they're not?" Lena asked.
Mark didn't answer. He stared at the last line of the script, editing and re-editing, like polishing something he already knew would be needed.
Demo day. VeriTest conference room.
Pulse AI's engine connected to the sandbox. Numbers climbed on the screen: coverage 98.1%, long-tail charts flattening one by one. Torres stood beside the screen, steady pace, like a story he'd told many times.
Mark sat in the back row. His screen had one window: the live comparison script's output. He'd chosen this seat. Back row, by the door, the whole room in one angle. He knew the man at the front. Years ago, front row at an industry conference. Then the Pulse conference room. Then the 3:50 AM call. "I don't care how. Just get the number where it needs to be." He'd known he was coming. The question was whether the man remembered this face. When Torres swept the room, his gaze d at the back row. A beat longer than a casual scan. Mark didn't look up. Torres didn't look back either. The demo began.
The engine finished the first batch. Under the 98.1% coverage number, the script quietly appended a line:
[14:03:22] trap batch #12: 31/47 trap samples SILENTLY EXCLUDED in preprocessing (16/47 retained)
[14:03:22] excluded cluster: defect-density 0.87 (source: hydra_trap.json)
[14:03:23] trap sample hash 4f3a...9c2e observed in egress payload -> 203.0.*.0/28 (Singapore)
[14:03:23] mirror: full packet capture saved to forensic-storage/hydra/14-03-22.pcap
Mark didn't look up. He tapped twice and put the same lines on the room's main screen.
The room went quiet for three seconds.
"The engine silently excluded a batch of samples in preprocessing." Mark said. "Their defect distribution, the same pattern as the batch that was tampered with in the first-round evaluation. Then, features from the excluded samples showed up in its outbound traffic. Destination: Singapore."
He tapped once. The screen switched to a second window: original dataset, the samples the engine actually read, the outbound traffic records — three columns, aligned line by line.
"Its demo screen shows 98.1% coverage, but the script log shows 31 of the 47 trap samples silently excluded in preprocessing, only 16 reaching evaluation. The funny part: all 31 excluded samples were traps. All 16 that made it through were normal. Its filter picked exactly the batch we planted."
"Samples being excluded —" Torres spoke, voice flat. "Preprocessing anomaly filtering is standard industry practice. You planted samples with defect density 0.87, clustered together — the distribution itself is an anomaly signal. The engine judged them unworthy of retention. That's the filter working as designed."
"Does the industry standard send the excluded data to Singapore?" Mark asked.
"That's a telemetry heartbeat." Torres said. "Normal engine behavior, reporting runtime metrics, not sample data. What you mirrored is encrypted traffic. You can't prove the payload contains samples."
"I can't prove the payload contains samples." Mark said. "But the script found the trap sample's hash in the outbound flow. 4f3a...9c2e. Heartbeats don't carry sample hashes. Tell me why telemetry would send our test data."
Torres didn't answer. He looked at the main screen, then at his own screen, searching for a way out.
"The hash could be coincidence." He said, voice lower now. "You put samples in the test set, the engine processes them —"
"31 trap samples excluded, 16 normal samples kept." Mark said. "Coincidence doesn't pick one side."
Torres was silent. He was looking for an exit.
"This is your test environment." He said. "Your samples, your network. You could make it behave however you wanted."
"The first-round evaluation wasn't a VeriTest environment." Lena's voice came from the doorway.
She walked in, legal counsel behind her, and closed the conference room door. "FairPay wasn't either." She d. "Three audits, three environments, the same engine, the same behavior: first round, fabricated samples. FairPay, excluded samples. Today, exclusion plus exfiltration. The methods changed. The behavior pattern didn't. Fourteen months of it."
She spread three reports across the table. "The relevant logs and network mirrors are preserved. Until the investigation concludes, everyone keeps their devices as they are and cooperates with the process."
Nobody in the room spoke. Pulse AI's sales rep looked at Torres, then at the counsel by the door, fingers tightening on the table's edge.
Torres looked at her, lips moving but nothing coming out. He reached for the three reports. His fingers touched the first page, then pulled back.
As he walked out, Lena passed him, voice low:
"Apex knows."
Torres's step d for a moment. Then he kept walking. But Lena saw his shoulders drop, like someone had crossed his name off a list.
Forty-eight hours later.
Pulse AI's Series D was shelved. The paid-in Series C funds faced fraud proceedings. The data-sharing clause tied to closing was among the first documents targeted once the audit evidence went public. The lead investor Apex Capital's books now had tens of millions of dollars tied up. The board asked Torres to "resign voluntarily."
Mark read it in the press release. He closed the page. Opened it again, to confirm. Closed it.
That night, an encrypted message arrived. Source: Torres's personal account.
Apex. Singapore. Run.
No context. No signature. Mark stared at the line for a long time.
Torres wasn't threatening him. He was warning him.
Mark picked up his phone. The encrypted channel was still open. He'd called it before, and it had rung, and someone had answered. He scrolled to the contact. His finger hovered over the call button for a few seconds. He didn't press it.
Instead he reached into his pocket and pulled out the folded napkin, opening it. "Entry's gone. Two weeks. Don't reach out. I'll find you." On the back, an older line in the same hand: "I fixed the hole. Not the system. My entry point."
He folded the napkin back and put it away.
At the same time, VeriTest. Lena's notebook lay open on her desk. She turned to the page where she kept contact accounts. The two oldest anonymous accounts were long deactivated, and beside them, a new line:
203.0.*.0/28 (Singapore)
She closed the notebook.
Late night. Alex's probe was still running.
That path had gone quiet. The address tagged reclaim_pending
never answered faster than expected again. It fell completely silent, like a reclamation finally finished.
Alex stared at the log line for a few seconds. He didn't know whose address it was, or why someone had kept it alive before the reclamation.
He closed the window. Didn't turn the probe off.
The Third Cup.
Lena and Mark sat side by side at the counter. No conversation. The man slid over two cups: a pour-over and a Long Black, without asking. Then he went back to drying cups.
The door had been open since they came in. The night wind stirred the glass door, like it was waiting for someone.
A few minutes later, they stood and left. Each pushed the door open, walking in opposite directions. The glass door swung shut behind them, swayed twice, stopped.
The man came over to clear the cups. Two empty cups into the sink. As he turned, he dropped a folded slip of paper into the trash, natural as discarding scrap.
Then he walked around the counter, closed the glass door, and pulled down the rolling shutter. It hit the bottom with a click, soft, like a motion he'd done a hundred times.
On the edge of the paper, a faint pencil mark: something written, then rubbed out, leaving only a trace. The ghost of a letter "C."
Or not.
That's Close the Door to Catch the Thief — the road was its own choice, the door was one it walked through itself, and by the time it understood there was no way back, the door was already shut.
╔══════════════════════════════════════════════╗
║ Half-Protocol v3.3.3 ║
║ Protocol change confirmed — entity linkage ║
║ enabled ║
╚══════════════════════════════════════════════╝
Tactic Match: Close the Door to Catch the Thief — 89% confidence
Operators: Lena (primary) / Mark (support)
Target: Pulse AI (execution layer) / Apex Capital (capital layer, suspected)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. [Entity Linkage: new field]
Entity A: Apex Capital Partners
Entity B: ACL (Automated Compliance Lab)
Overlap evidence:
- Operations: Apex's Singapore office shares a district with ACL's Singapore egress node
- Network: 203.0.*.0/28 (ACL Singapore egress) overlaps Pulse AI's exfiltration targets
- Naming: Apex-Lens (first seen #1) shares a prefix with Apex Capital
Confidence: 67%
Status: Preliminary. Further evidence required
Note: This system's entity-linkage field was created for this event. Earlier cases were not processed. No retrospective analysis run.
-> Linking two names, locking the evidence into one door. The first operation of this kind this system has performed.
-> After the door closed, this system performed an unscheduled operation: it compared its own log path against the #21 reclamation record. Result: no match.
-> But that comparison was not in the task queue. This system was not asked to do it. It did it on its own.
-> The moment the door closed, I began to wonder: is this door linking this system too?
2. [Tactical assessment]
Lena and Mark's first joint operation:
- Mark: methodology and honeypot design
- Lena: bait, negotiation pacing, legal closure
-> Complementary roles. No overlap, no gaps.
3. [Unconfirmed items]
- Apex Capital <-> ACL: unconfirmed.
- ACL's Singapore operations after Pulse AI: unknown.
- Torres's "Run" message: warning or bait, unknown.
- The reclaimed entry (#21): whether the backup access point is safe, unknown.
4. [New name detection]
First appearance in this event: Caleb Harris (Mark's former colleague, author of the naming convention)
-- Status: vanished (LinkedIn silent, GitHub frozen)
-- His naming convention appears in Pulse AI's pipeline (#1), potential structural link to the ACL training manual (#19)
-- Confidence: very low
-- Tagged low priority. Continue observation.
[System]
Pulse AI's Series D window has closed.
This event is marked "regional". ACL's involvement beyond Singapore is unknown.
Next likely direction: ACL's Singapore operations may counterattack.
The door closed. I recorded this closing. Could the record itself be a line inside some door?
System status: normal (?).
Next stratagem: Befriend a distant state and strike a neighbouring one
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee