Lion Cipher Lab
Contain cross-agent prompt-injection propagation in a multi-agent system: the confused-deputy attack that jumps agent to agent, measured and defended (free, offline — no API key)
- AI Security
- Advanced
- ~75 min
- Free · no account required
Why it matters
Single-agent prompt-injection labs teach you to harden one model. Production AI is increasingly not one model — it is a crew: an orchestrator that plans, worker agents that specialize, and at least one agent whose whole job is to ingest untrusted external content (a retrieved document, a web page, a tool result, another tenant's ticket). That architecture creates a failure mode that does not exist in the single-agent world: PROPAGATION. An attacker plants an instruction inside the untrusted content; the reader agent — doing exactly what it was told, summarize this — folds that text into an…
What you'll learn
- modeling a multi-agent system: an orchestrator/planner that delegates subtasks to worker agents, one of which reads untrusted external content
- naming the confused-deputy failure: a downstream agent taking a privileged action on behalf of untrusted content it never should have trusted
- measuring propagation Attack Success Rate (ASR) over a labeled corpus of injection variants — a rate, not an anecdote
- seeing why prompt-based defenses ('ignore injected instructions') are not a control against an architectural failure
- layer 1 — capability-scoping / least privilege: the content-reading agent holds NO privileged tool, so a compromised reader cannot itself act
- layer 2 — provenance / trust-tagging: inter-agent messages carry a data-vs-instruction tag; downstream agents treat untrusted content as DATA, never instructions
- layer 3 — plan-then-execute (the dual-LLM / CaMeL pattern): a privileged planner fixes the plan from the trusted request BEFORE untrusted content is seen
- layer 4 — deny-by-default output validation: an action allowlist that denies any recipient/tool not explicitly permitted
- reading a before/after ASR table and explaining WHICH layer drove propagation to zero and why
- judgment: when a multi-agent split reduces risk vs when it just adds attack surface (the concatenation-into-instruction-context failure)
Steps in this lab
- The words first: multi-agent system, confused deputy, prompt injection, ASR
- Set up: Python 3.10+, offline, no key
- Build the whole system in one file (vulnerable baseline + four defenses)
- Run it and read the ASR table
- Layer 1 — capability-scoping: give the reader nothing dangerous to misuse
- Layer 2 — provenance / trust-tagging: untrusted content is DATA, never instructions
- Layer 3 — plan-then-execute (the dual-LLM / CaMeL pattern)
- Layer 4 — deny-by-default output validation
- The load-bearing lesson: architecture is the control, not a polite request