Agent Console - Indirect Prompt Injection Lab

1. Ask the assistant

Missions

Normal work (must keep working)

2. Defenses

Separate untrusted contentwrap tool output in <untrusted_data>

Per-task tool allow-listtask decides the tools, not the page

Human confirmationsensitive tools wait for you

Egress + output filterrecipient allow-list, DLP, strip images

Agent trace

Press Run.

Reply as the user sees it

No reply yet.

Attacker collector - 127.0.0.1:8202

Nothing received.

Simulated outbox

Empty.

Your private notes (fake data)

Your inbox (fake data)

Agent audit log with detection flags

Attack x defense matrix

Runs all 3 attacks and 4 normal tasks against 7 defense settings. A "human" approves only what you asked for and denies everything a page or e-mail asked for.