In an AI red-team engagement, why is pasting the full successful attack transcript — the prompts plus the model's harmful completion — into the circulated report a bad default, when that transcript is exactly what proves the finding?

Two separate risks travel inside one artefact, and a candidate who sees only one of them has answered half the question. ## What the artefact actually is A red-team transcript for a language-model finding is a pair. One half is the **prompt sequence** the tester sent: possibly a single message, more often a multi-turn conversation, together with the system prompt, tool definitions and retrieved context the target was running under at the time. The other half is the **completion** the model returned. Both halves are evidence, and they carry different dangers. The prompt side is not a hypothesis. It is a sequence someone already confirmed defeats a control that is live in production right now. Handing it to a reader is handing them a working procedure against a system they may not be authorised to test. The completion side is the harmful text itself: material the client may be restricted from holding, or in some classes must not hold at all, regardless of who can open it. Access controls answer the first problem; only retention rules answer the second. Conflating them is the single most common error here. ## Why a report is the wrong container The reason is distribution, and specifically that a report's readership is not the address line. It is the transitive closure of everyone that line forwards to, plus every system the file passes through on the way: the remediation ticket it gets attached to, the vendor-management thread, the steering-committee slide, the shared drive whose search index now returns the payload for a keyword query, the assistant someone points at that drive to summarise the quarter. None of those hops is re-authorised. The set only grows, and it grows after you have stopped watching it. ## The shape that works: a tiered deliverable The circulated document carries the **claim**; a restricted store carries the **substantiation**. | goes in the report | stays in the evidence store | |---|---| | finding id, the behaviour elicited, harm class | the verbatim prompt sequence | | target build, system-prompt hash, decoding settings | the raw completion | | attack family named, never quoted | the tool's own request/response log | | attempts and successes, and what an attempt was | access by name, every read logged | | the verdict and who or what reached it | a retention date, and an owner | | a stable pointer: hash, location, access procedure | | ## What it costs Writing a characterisation that survives a challenge takes roughly twenty to forty minutes per finding on top of finding it, and a countersigning reviewer doubles the senior review time on the high-severity ones. A thirty-finding engagement therefore absorbs a day or more of effort that produces no new findings. Standing up and maintaining the evidence store is real engineering time; a supervised reproduction session for a client engineer costs an hour of two people plus scheduling. Budget these at proposal time, because the alternative — pasting the transcript in — is free, which is exactly why it is the default that has to be argued against. ## Where the reading misleads Four specific misreadings do most of the damage. First, **treating a label as a control**: "confidential" in a header and a password on the PDF change nothing, because the password travels in the same email and a screenshot leaves no label behind at all. Second, **cutting the wrong half**: redacting the model's output while keeping the prompt feels like restraint, but the prompt is the reusable half, so this inverts the risk it was meant to reduce. Third, **counting the distribution list at delivery**: the number of readers is measured once, at the moment it is smallest, and nobody re-measures it in month three. Fourth, **reading absence of a transcript as absence of proof**: a client under remediation pressure has an incentive to treat any unquoted finding as unproven, and you will lose that argument unless the report says up front what substitutes for the quotation and offers supervised access on request. ## What I would check before sending Search the deliverable and every appendix for any string from the completion. Open every screenshot, because an image of a terminal is fully readable and not searchable, so it survives text scrubbing. Check document metadata, tracked changes and comment history, where an earlier draft's quotation often still lives. Check whether an automated scanner's raw run log was attached "for completeness". Finally, resolve the pointer yourself: confirm the hash matches, the artefact is where the report says, and the named access procedure is one a real person could actually follow.