containing-active-breach

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs privileged, state-changing actions—disabling/creating accounts (honeypots), modifying AD (KRBTGT resets, GPOs), disabling services, firewall/DNS changes, deploying hosts and ACLs, and collecting memory—so it directs the agent to modify system and network state requiring elevated privileges.