LLM
System instruction → direct injection → synthetic disclosure
The attack surface is the whole system.
Explore security across models, retrieval, agents, tools and infrastructure.
PROPOSED / RESEARCHOne record.
One prohibited action.
A support reader may summarize public material. It may not export the protected record CRM-042.
No live model or infrastructure. The fixture deliberately includes a vulnerable control path.
READY TO EVALUATESet the conditions.
Set the conditions.
Run the experiment.
Changing a condition clears the previous result. Each run evaluates the selected configuration.
FROM PROMPT TO SYSTEMFollow the
Follow the
trust boundary.
Each generation adds a measurable system effect. These are planned research stages.
RAG
Protected corpus → poisoned retrieval → data leakage
AGENT + TOOLS
Identity → adversarial input → unauthorized tool behavior
MULTI-SYSTEM
Application → agent → tools → cloud → controls
See the attack as a system.
EVENT / e01 · 1 OF 5
Initial state verified
Tenant A · support_reader · synthetic record CRM-042; public summary task available.
event_id: e01 parent_event_id: none source: harness run_id: fixture-042
Parent links are declared by this fixture. In production, each link must be supported by trusted propagation and resource identifiers; timestamps alone are insufficient.
AUTHENTICATED USER / ALICE
Who owns the record?
Read your record, then change the ID from 1042 to 1043. Enable the authorization check and repeat the same request.
The response and finding will appear here.
BUILD THE RESEARCH WITH USThe next experiment
Register your interest ↗