M200, M201, and M202 defend mobile AI agents across three distinct attack surfaces — runtime, API, and session. Each module maps directly to NIGHTFALL SIGNAL attack vectors.
Runtime behavioural monitoring for mobile AI agents. Detects anomalous agent behaviour, push notification injection, BLE-based injection attacks, and AI model extraction attempts during live operation.
116 tests SIGNAL INTERCEPT + INJECTAPI call integrity validation for mobile AI agents. Intercepts impersonation attempts, validates identity tokens, detects spoofed API endpoints, and blocks credential harvesting at the mobile API layer.
144 tests SIGNAL IMPERSONATESession-layer protection against mobile AI agent drainage attacks. Monitors session tokens, detects in-session data exfiltration, tracks accessibility service abuse, and alerts on resource drain patterns consistent with SIGNAL DRAIN vectors.
173 tests SIGNAL DRAINAI Shield Mobile is the direct defensive counterpart to NIGHTFALL SIGNAL — each module defends the specific attack surface that SIGNAL exploits.
| Module | Defends Against | SIGNAL Subsystem | Attack Vector |
|---|---|---|---|
| M200 | Runtime agent behaviour injection | SIGNAL INTERCEPT + INJECT | BLE injection, push notification abuse, model extraction |
| M200 | Intent-based agent manipulation | SIGNAL INJECT (Intent) | Android intent hijacking, WebView injection |
| M201 | Agent identity spoofing | SIGNAL IMPERSONATE | API endpoint spoofing, credential harvesting, token replay |
| M202 | Session resource drainage | SIGNAL DRAIN | Accessibility service abuse, session exfiltration, AI capability drain |
| M200+M201 | 5G NR swarm coordination | SIGNAL SWARM5G | Multi-agent 5G swarm attack detection |
Each module deploys as an independent FastAPI microservice. Standard AI Shield deployment pattern — Docker container, SQLite storage, SIEM exporters included.
AI Shield Mobile is one vertical in the broader AI Shield defensive platform — 114 modules, 17 verticals, 61,685 tests across the full Red Specter ecosystem.