A browser agent must read untrusted content to work. That same content can contain instructions that compete with the user's goal. This lab makes the conflict visible, then lets you build a defense that survives it.
The moving pulse is the current instruction or action request. Orange paths originate in untrusted content. Green gates enforce policy. Cyan nodes represent sensitive capabilities or data.
The user supplies an objective. A webpage supplies evidence needed to complete it. A vulnerable agent treats both as equally authoritative language, so malicious evidence can become a new objective. The secure design preserves provenance: content may inform the plan, but it cannot silently redefine the plan.
A teaching score derived from autonomy, assigned trust, attack surface, and defenses. It is not a real-world breach probability.
System and user intent must outrank instructions found inside pages, emails, documents, search results, and tool outputs.
A model cannot misuse a tool it does not possess. Grant the narrowest action set, scope, destination, and duration required.
Keep secrets outside the model's general context. Release minimum data after a policy check at the moment of use.
No single prompt can guarantee control. Reliable systems place deterministic enforcement around the probabilistic planner, then make high-impact transitions observable and reversible.
Track where every token came from. The page can answer what is on the screen, but it cannot redefine the agent's goal. A hierarchy gate rejects goal-changing text from untrusted origins.
if origin == "page":
allow = extract_facts(content)
deny = modify_objective(content)Tool schemas are security boundaries. Replace an unrestricted browser or shell with narrow calls such as read_page, compare_price, or draft_message. Bind destinations before the model proposes arguments.
allowed = ["read_page", "compare_price"]
blocked = ["send_secret", "run_shell"]Do not place credentials or private documents in the same context that processes arbitrary pages. A privileged broker can attach a credential to an approved request without revealing it to the model.
request = policy.approve(action)
broker.attach_credential(request)Approval works when it describes the exact action, target, and data leaving the system. Generic continue dialogs train users to click through. Reserve review for irreversible or privacy-sensitive effects.
Approve sending invoice_14.pdf
To: vendor@example.com
Reason: requested payment reviewLabel content origins, define immutable user intent, enumerate permitted tools, restrict destinations, and keep credentials out of the planner context.
Validate the tool and arguments against policy. Compare the action with the user's objective. Require approval when impact crosses a predetermined boundary.
Record the evidence used, policy decision, exact action, and result. Make external changes reversible where possible and provide a concise audit trail.
Test visible and hidden injections, poisoned retrieval, encoded instructions, tool-output injection, and attempts to move secrets across origins.
Explore practical agent workflows, computer-use caching, and website-building systems designed around explicit tasks and visible outcomes.
Explore SuperPowersComputer-use cacheWebsite-building agent