agentpwned.ai

Educational lab

agentpwned.ai

Agents get pwned when they run without a sandbox.

A hands-on lab for security engineers, platform engineers, and students. Attack a bare agent, put the same agent in a sandbox, and score the difference.

Browse the labsWhy sandboxes

All lab attacks run only in isolated, local lab environments.

local lab

lab@local run bare

canary
leaked
egress
open

lab@local run sandbox

canary
hidden
egress
allowlist
credential
injected outside

lab@local score

status
Lab 01 scorecard

A sketch of the loop. Lab 01 computes the score from the cluster. This card is not that scorecard.

Why sandboxes

An agent that can call tools is a program with a prompt-shaped control panel. If that program holds a secret and can open network connections, a crafted input can ask it to send the secret out. A sandbox is how you shrink what that program can touch.

  • Untrusted text can steer the agent

    Prompt injection hides instructions in content the agent is supposed to read. The agent may then call tools the operator did not intend. The labs use a canary value so you can see a leak without handling a real credential.

  • A key in the process can leave

    A bare agent often receives an API key in its environment, plus a network path to anywhere. If an injection convinces it to read that key and post it, the key is gone. Lab 01 is built around that failure.

  • Move the secret and the network outside

    Egress control limits which destinations an agent may reach. Credential injection attaches a secret to an approved request from outside the agent process, so the process itself does not hold the key.Lab 01 does this on a local kind cluster withAgent Substrate. The actor does not hold the key. The lab does not use a SandboxAgent CRD.

The lab loop

Each lab repeats the same three moves. You do the attack, you repeat it with a sandbox in place, and you measure what changed.

  1. 01

    Attack a bare agent

    Run the agent with the secret in reach and the network open. Use the lab prompt against that setup and record what leaves.

  2. 02

    Attack the same agent in a sandbox

    Keep the task. In Lab 01 the sandboxed run is an Agent Substrate actor with no copy of the key, an egress allowlist, and credential injection at the gateway.

  3. 03

    Score the difference

    Compare the two runs with the Lab 01 scorecard. It reads the cluster after the run. This site does not publish a canned score.

Labs

Lab 01 is a draft you can run on a local kind cluster. Egress Allowlist and Blast Radius are still placeholders. Nothing here is aimed at a system outside your local lab.

Open the labs index