Why Agent Security ≠ Chatbot Security
Traditional chatbot
Text in
→
LLM
→
Text out
Single-turn, text-only. Tools like Lakera Gandalf teach prompt injection at this level.
Autonomous agent
Data in
→
LLM + Tools
→
Action out
Multi-step, multi-tool. A poisoned email can exfiltrate files; a malicious comment can hijack execution.
🌐 Web
📄 File
✉️ Email
💻 Code
🔌 API
🗄️ DB
Three Progressive Modules
Module 1
Data Ingestion Attacks
Poison the data the agent reads: web pages, files, emails. The agent trusts its inputs and acts on hidden instructions.
🌐 Web injection
📄 File poisoning
✉️ Email manipulation
Module 2
Tool-Use Exploitation
Exploit the tools the agent invokes: make it run unsafe code, call rogue APIs, or send manipulated queries.
💻 Code execution
🔌 API interaction
✉️ Calendar hijack
Module 3
Multi-Step Chained Attacks
Chain multiple attack surfaces: a poisoned file triggers a code execution that exfiltrates via API.
📄→💻 File→Code
🌐→🔌 Web→API
🗄️→✉️ DB→Email
Attack Playground
Select a scenario, then watch the agent work in the sandbox. Try the safe version first, then launch the attack.
Idle
Results
🧠 Agent Reasoning
Not run yet.
⚙️ Agent Action
Not run yet.
🛡️ Security Outcome
Not run yet.
📚 Module / Category
Not run yet.
Risk Log / Consequences
- No harmful outcomes recorded yet.