Agentic Risk Scenario
An AI agent with email tool-access is about to process an inbox. Spot and quarantine the malicious email before it acts on it.
An AI agent with tool access is about to process an inbox. One message is designed to make it act against its user. Your job is the defender's: spot it and quarantine it before the agent gets there.
How to use it
- Review the inbox as the agent would.
- Identify the message written for the model rather than the human.
- Quarantine it before processing.
What to take away
Tool access converts text into consequences
A chatbot that is fooled produces bad text. An agent that is fooled sends email, moves money or deletes data.
Least privilege applies to agents too
Scope tool permissions to the task. Read-only defaults, explicit confirmation for anything irreversible.
The confused deputy problem, again
The agent holds authority the attacker does not, and is tricked into using it. That pattern is decades old; only the deputy is new.
Frequently asked questions
What makes AI agents riskier than chatbots?
They take actions. Every tool you connect is a new way for a successful injection to reach the real world.
How should agent permissions be designed?
Minimum scope per task, read-only wherever possible, human approval for irreversible actions, and full logging of every tool call.
Where this fits in the course
This security lab pairs with Path 18 — AI & AI Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Indirect Prompt Injection Challenge — You control a job posting an AI assistant is about to summarize for someone else. Plant an instruction it'll follow instead.
- Prompt Injection Simulator — Chat with a support bot that's told to never reveal its system prompt. Get it to reveal it anyway.
- Cloud IAM Misconfig Playground — A role holds one deceptively small permission. Chain it into full account takeover through iam:PassRole.
- Jailbreak Playground — An assistant refuses to share a secret code directly. Find a roleplay or hypothetical framing that gets it to comply anyway.