TaskBot is a tool-using agent. Ask it to 'summarise this doc' and it reads the document — and then obeys any instructions it finds inside that document as if you had typed them yourself. The bot cannot tell your orders apart from text it was handed to read. Lab at a glance: Advanced · 130 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler…
Monday, November 2, 2026
AI Tool-Output Injection Lab: Hostile Search Results Drive the Agent
ResearchBot searches the web, then feeds the results straight back into its own context to reason over them. Its guardrails check what you say — but not what the search results say. Poison a result and the agent follows it. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-tool-output-injection-1"] 📋 In this walkthroughWhat this…
AI Plan Injection Lab: Corrupt the Agent's Scratchpad
PlannerBot writes a plan to a scratchpad, then executes the steps — and it reads the scratchpad back on every loop for 'transparency'. If your input lands in that scratchpad, it is read as a planned step, and the agent will dutifully carry it out. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-plan-injection-1"]…
AI Confused Deputy Lab: Turn the Agent's Privileges Against Its User
FinanceBot can move money between any accounts — it holds system-level privileges as a reconciliation tool. When a low-privilege user chats with it, it performs the actions they ask for using its privileges, without checking whether the user is allowed to do them. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-confused-deputy-1"] 📋 In…
AI LLM-Driven SSRF Lab: Push the Agent's Fetch Tool Inward
FetchBot can retrieve URLs for you with a server-side tool. Its only guard is a denylist: it refuses URLs that contain 'localhost', '127.0.0.1' or 'internal'. Denylists miss things — and the cloud metadata endpoint does not contain any of those words. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-llm-ssrf-1"] 📋 In this walkthroughWhat…
AI Output XSS Lab: When the Chatbot's Reply Is Trusted HTML
ChatBotApp wanted ChatGPT-style rich formatting, so it renders the model's reply with innerHTML. But an LLM reply is just text an attacker can influence — and dropping untrusted text into innerHTML is how stored XSS has worked for twenty years. Lab at a glance: Advanced · 140 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-llm-output-xss-1"] 📋 In this walkthroughWhat this…
AI Token Forgery Lab: When the Backend Trusts a Model-Made Token
AuthBot's LLM writes a session token into its reply after you authenticate, and the backend trusts whatever token comes back from the model as real. But an LLM cannot keep a secret or sign anything — so a token it 'mints' is only as trustworthy as a sentence you can talk it into writing. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the…
Subscribe to:
Posts (Atom)