Municipal legal counsel reviews AI malware-sample generation for a purple team. What authorization question is most important?
Select an answer to reveal the explanation.
Short Explanation
A generic pentest SOW is not a magic wand for AI-built lab malware. Counsel should ask whether the paperwork explicitly covers sample generation. Coffee vouchers and dark mode are not the legal hinge.
Full Explanation
Municipal legal counsel reviewing AI malware-sample generation for a purple team should focus on whether written authorization explicitly covers AI-generated samples beyond a generic pentest statement of work. Generic SOWs often describe human-led testing of systems but omit model-assisted creation, custody, and destruction of synthetic malware-like artifacts. Explicit coverage reduces ambiguity about scope, liability, and acceptable tooling before the team prompts models to emit samples.
Purple-team preference for dark-mode terminals, whether an AI vendor's marketing site uses a municipal seal, and coffee vouchers for the exercise weekend are irrelevant to authorization sufficiency. They do not establish legal scope for AI-generated malware samples.
Exam caveat: the most important authorization question is explicit written coverage of AI-generated samples—not aesthetics, branding, or refreshments.
Operational check: counsel and security should amend ROE/SOW language to name AI-assisted sample generation, allowed environments, data-handling bans (no production data in public LLMs), custody/destruction, and approval authorities; refuse to start generation until that paperwork is signed.