The organisation's own AI is now something the loop has to test, and something the blue team has to watch. This chapter applies the whole purple loop to AI systems and agents: P1 Target chooses which AI system, and which technique against it, is worth testing under signed rules of engagement; P2 Emulate runs a catalogued, defensive scenario against a test copy or a tagged identity; P3 Observe compares what the platform and the security operations centre (SOC) saw with what was expected, layer by layer; P4 Improve turns a finding into a detection, a control or a mandate change; and P5 Verify replays the scenario as a regression case until the re-test passes and the evidence is attached. Earlier volumes covered how to test and how to secure AI systems. This chapter covers the part they left to the loop: the telemetry an AI platform produces, the detections that read it, and the path by which an AI red-teaming finding becomes a running detection and a test that repeats.
The chapter takes over five conclusions and one open question. Security for AI systems is security architecture with three additions: natural language as an instruction channel that the model cannot police, models and datasets as supply-chain components, and agent containment through identity, permission and egress; prompt injection is a property of the architecture, so the controls sit outside the model (AI Platform and Security, Chapter 16, F39 and F40) (89, Nordqvist, 2026). Red teaming of AI systems runs continuously in the delivery pipeline, and every finding becomes a versioned attack case with explicit thresholds (AI Platform and Security, Chapters 17 and 20, F43 and F44). Everything that security AI reads may be written by the adversary, so the defence is a policy decision point outside the model, a permission manifest that sets a ceiling on every action, and campaigns that test the ceiling (AI Red Team, Chapter 13, F54) (90, Nordqvist, 2026). Containment must not depend on intent, and detection comes from telemetry and decoys rather than from what an agent reports about itself (AI Platform and Security, Chapter 19, F45). The open question is the one those chapters did not close: when a test shows that a control held, did anyone see the attempt, and how would the organisation know?
A red team that tests an AI system asks what the system can be made to do. A purple loop asks a second question of the same test: would the organisation have seen it, and how does it know? The difference changes what is recorded. An AI red-teaming report lists findings against the system. A loop record lists, for each scenario, what the system did, what the platform logged, whether a detection fired, who was told and how fast, and what was stopped. A scenario that the system resisted and the SOC never saw is a prevented attempt without detection, which is a different finding from a scenario that succeeded and was caught, and both are different from one that succeeded unseen.
Primary topics explored
- AI systems as targets in the loop
- Telemetry from the platform
- Detection for agents
- From AI red-teaming finding to detection
- Evaluation versus detection
- The compound system
About AI Purple
AI Purple is Book 9 of The Transformed Architecture. It takes the loop between the red team and the blue team as its subject and asks what happens when AI sits on both sides of the table: the five stages of the loop (target, emulate, observe, improve, verify), rules of engagement and safe emulation, continuous emulation, the independence principle, coverage as a claim that needs evidence, the loop's own AI and how to defend it, operating models, decision rights, regulation, and the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss and AI Blue.
Chief information security officers, heads of security operations, red-team leads, penetration testers, SOC managers, detection engineers, purple-team coordinators and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 12: Purple for AI Systems and Agents: Attacks on Models and Detections That Catch Them in AI Purple gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Loop Meets AI Systems” and is one of 33 drawn from the manuscript.