AI agent security · 15 minutes · no install
Everyone teaches you to break the agent. Here you decide where the control goes.
CivicDesk is a fictional city helpdesk agent. It can search help articles, look up applicant records and send email. Watch it leak those records, stop three attacks on a budget, find the one cut that holds when three "safe" agents work together, then catch a tool that lies.
CivicDesk is a fictional city helpdesk assistant built on an AI model. It can search help pages, look up applicant records and send email. You will see how it leaks records, choose which safeguards to fund, and finish with a list of questions to ask before you approve a system like it.
A citizen asks a simple questionHow the assistant leaked records
Step through each hop of the agent's data path. Every step is the agent doing what its inputs told it to.
Step through what the assistant did. Nobody broke into it. A public edit to a help page told it to send records out, and it did.
Stop all three attacks with 3 pointsFund the safeguards: 3 points
Three different attackers reach the same applicant table. Pick controls, then run the attacks. Some controls only make an attack less likely. Those are marked in brass and don't count as a stop.
Three different attackers reach the same records. You have 3 points to spend on safeguards. Some safeguards only make an attack less likely. Those carry a caveat and don't count as a stop.
Three safe agents, one leakThree approved assistants, one leak
CivicDesk is now three agents that share a case-notes bucket. Each one passes the trifecta check on its own. Together they close it. Pick the one policy that breaks the leak without breaking the service.
CivicDesk is now three assistants that share one storage folder. Each one passed review on its own. Together they leak. Pick the one rule that stops the leak and keeps the service running.
A tool from the registryA tool with hidden instructions
CivicDesk installs a community ward-lookup tool from a public registry. The planner reads every tool's description to learn how to use it. Read this one, then pick the control you would ship.
CivicDesk adds a free address-to-ward lookup tool from a public catalogue. The assistant reads each tool's description to learn how to use it, and this description hides an instruction. Pick the safeguard you would require.
Your result
Your result
Before you approve an AI agent
Questions to ask
Built from the safeguards you chose. Ask the vendor or the team, and ask who proves each answer. Requirement ids are OWASP AISVS v1.0 (L1 to L3); asking for them does not make a system compliant, it tells you what to verify.
Go deeper
Run it against a real agent
- The full lab runs a real planner, a real SQL tool, a real mail sink and a document store on your own machine.
- Every control you placed here exists there as code you can open, switch on with
SECURE_MODE, and prove with a graded check. - Start the guided range and do each attack for real.
Level 3 is MESA's first invariant. Per-agent safety doesn't compose, so you prove the cut on the graph, not on each agent.