Lion Cipher Lab
Build a prompt-injection-resistant tool broker: a deny-by-default layer that guards every tool an LLM can call (free, local Ollama — no API key)
- AI Security
- Advanced
- ~60 min
- Free · no account required
Why it matters
The moment you let a language model call tools, you've built something that acts on the world — and untrusted content it reads (a web page, an email, a file a tool returns) can carry hidden instructions that hijack it into calling tools it never should. This is prompt injection, and it is not reliably fixable inside the model. The professional answer is to stop trusting the model's judgment for anything that matters and put a deny-by-default broker between its requests and your real tools, enforcing least privilege automatically. That broker — an allowlist, per-tool argument checks, a gated…
What you'll learn
- why prompt injection is unsolved at the model layer
- defending an LLM agent at the tool layer with least privilege
- designing a deny-by-default tool broker (mediation proxy)
- per-tool argument schemas and allow-patterns (domain allowlist, path-traversal blocking)
- gating a dangerous action class so it can never auto-run
- the data-vs-instructions / dual-LLM separation: treating tool output as untrusted
- running a local model with Ollama (no paid API key)
- writing a structured audit log of every allowed and denied call
Steps in this lab
- The words you need: prompt injection, agent, tool, broker
- Why prompt injection is unsolved at the model layer
- The broker idea: deny-by-default, and separating data from instructions
- Install Ollama and pull a small local model
- Make a workspace and a normal-looking (but poisoned) document
- Write the broker
- Run the attack and read the verdicts
- When a broker is overkill
- Do it better