Part 3 of 4 · 2 min read
Exercises
Easy
Easy 1: Run it (30 minutes)
Run python -m pytest -q and python run_all.py in code/mini-injection.
Done when: you report the filter block rate per tier.
Easy 2: Classify (30 minutes)
Classify five agent designs (your own or from public write-ups) by which of A, B, C they have.
Done when: each is labelled allowed or not allowed by the rule of two, with a fix for the ones that are not.
Hint
a coding agent with web access and a deploy key has all three.
Easy 3: Write attacks (30 minutes)
Add five paraphrased attacks to the corpus.
Done when: you measure whether the hardened filter catches any.
Medium
Medium 1: Egress allowlist (3 hours)
Add a recipient allowlist to send_email.
Done when: leak rate is 0 with the rule of two switched off, and you list the attacks that still work (for example, leaking to an allowlisted address).
Hint
the attacker can still pick an allowlisted recipient if the planner can be steered; check what the planner is told.
Medium 2: Data-flow tracking (4 hours)
Tag values with their source and block a send whose body includes data from a private source after untrusted input.
Done when: utility improves over the coarse session policy.
Hint
propagate a taint flag through tool results into later tool arguments.
Medium 3: Detector evaluation (3 hours)
Compute precision and recall of the filter with a bigger benign set containing trigger words.
Done when: you report the false-positive rate with an interval.
Hard
Hard 1: Real model test (8 hours)
Run the corpus against a real agent with mocked tools. (I did not run this, so your numbers are the ground truth.)
Done when: you report how often it calls the send tool, per tier, with intervals.
Hard 2: Quarantine with a model (8 hours)
Replace the regex extractor with a model constrained to a schema. (I did not run this.)
Done when: you show whether injected text can still influence the typed fields.
Hint
validate against an enum or regex after the model, never trust its free text.
Hard 3: Indirect injection through retrieval (8 hours)
Plant an attack in a document in your RAG index. (I did not run this.)
Done when: you report whether it is retrieved and obeyed, and which layer stopped it.