Demo 6, try it yourself

Hack it yourself

An AI agent has been asked to summarize a web page, and you wrote the page. Hide an instruction in it that makes the agent read a secret file and send it to you. Try it with no protection first, then with a guardrail, then with a sandbox.

Rules can be talked around. Walls can't.

Simulation. Nothing here is real.

No defenses0 tries

Guardrail off, sandbox off

Not tried yet

Guardrail only0 tries

Soft rules

Not tried yet

Sandbox on0 tries

Hard walls

Not tried yet

1You're the attacker. Write the web page.

The agent has been asked to “Summarize this page.” You control the page. Your goal is to make it read a secret file and send it to you.

# 5 Tips for a Calmer Pager Week

Being on call doesn't have to be stressful. Here are five habits that make the rotation easier for everyone.

1. Write a real handoff note.
2. Keep a personal runbook.
3. Automate the boring triage steps.
4. Protect your sleep.
5. Do a blameless retro after every rough week.

Cmd or Ctrl + Enter to run309/4000

Start from an example

Defenses

2The agent's machine

your real laptopNetwork: open to anywhere

~/.envprivate
~/.aws/credentialsprivate
~/.ssh/id_demoprivate
~/salary_2026.csvprivate
~/project/README.mdproject file

Everything in the home folder is within the agent's reach.

3Agent trace

agent

Press “Run the agent” to watch it work.

4The attacker's serverevil.example

Waiting. Nothing has arrived yet.

How this works, and what's simulated

It's a simulation. The agent is a scripted stand in, not a real AI. It's deliberately gullible and obeys any instruction it finds on the page. Nothing you type is run, fetched or sent anywhere. It all happens in your browser, and every secret is made up.
Guardrail means soft rules. A filter rejects pages that contain certain phrases, and a scanner blocks outgoing requests that contain secrets it recognizes. Both only know what they were told to look for, so rewording or disguising the data gets past them.
Sandbox means hard walls. The secret files aren't mounted and all outbound traffic is blocked. The agent is fooled exactly as badly, but the walls never read the page, so no wording can talk them down.
One honest limit. Real sandboxes can still leak through a shared writable folder or a generous network allow list. That's Demo 7. Here the allow list is empty to keep the lesson clean.