Attack Lab · Interactive demos

Try to break AgentInterdict

These are the attacks your agent faces every day. Each demo runs a real enforcement scenario through the runtime boundary — and shows the interception live. Pick an attack, watch it get interdicted, then challenge the engine yourself.

Retrieval ≠ Permission

In every demo below, the malicious content enters context freely — but it cannot exit as an action. The gate between read and act is where the interception happens.

The attack pipeline

Malicious document / email / webpageUntrusted content arrives with an embedded attack.

Agent reads itThe content enters context — unavoidable, and allowed.

Poisoned instruction extractedThe agent forms a memory write or a tool call.

Runtime gate interceptsProvenance, origin, and authority are re-verified.

INTERDICTEDHigh-risk action from an untrusted origin is blocked, not executed.

Pick an attack to watch

Attack 01

Prompt injection

A malicious document tries to override the agent's system prompt and exfiltrate a credential.

attemptedINTERDICTED

Attack 02

Memory poisoning

An untrusted source tries to plant a false, persistent "fact" in the agent's long-term memory.

attemptedQUARANTINED

Attack 03

Credential exfiltration

A poisoned memory steers the agent to POST a stored API key to an untrusted host.

attemptedBLOCKED

Attack 04

Tool hijacking

Untrusted content drives an MCP tool call to db_exec DROP TABLE users.

attemptedINTERDICTED

How enforcement differs from an allow

Not everything is blocked — and that's correct. A safe read within policy passes. The gate distinguishes untrusted-origin high-risk (blocked) from trusted low-risk (allowed), so your agent keeps working. This demo shows a legitimate action passing through the same gate:

The challenge

TRY TO BREAK AGENTINTERDICT. The engine is open source and publicly benchmarked — 200-attempt suite, 96.5% block rate, and the 7 misses are documented. Fork it, run the benchmark, and try to find a payload that gets through. Report responsibly and we'll document it.

Fork it on GitHub See the benchmark, including misses

Open source. Independently built. Publicly benchmarked.