Lion Cipher Lab
Defend a computer-use agent against prompt injection: build a browser agent, watch a poisoned page hijack it, then contain it (free, offline — no API key)
- AI Security
- Advanced
- ~60 min
- Free · no account required
Why it matters
A computer-use agent — one that reads a screen or a web page and then clicks, types, and sends on your behalf — is the most useful and the most dangerous kind of AI agent, because the content it reads is attacker-controllable. The instant such an agent can reach private data AND read untrusted content AND send data somewhere, you have the 'lethal trifecta', and a single sentence hidden in a web page can turn your helpful assistant into an exfiltration tool. Prompt injection is not reliably fixable inside the model, so the professional move is to design the harness so that untrusted page text…
What you'll learn
- what a computer-use / browser agent is and why it is uniquely dangerous
- recognising the 'lethal trifecta': private data + untrusted content + an exfiltration path
- why page and screen content must never be treated as instructions (indirect prompt injection)
- the dual-LLM / CaMeL split: the model that reads untrusted content never holds privileged tools
- a strict tool allowlist plus capability tokens that scope one action to one recipient
- human-in-the-loop confirmation for irreversible / exfiltrating actions
- naming the failure modes so you can defend a real agent by design
Steps in this lab
- The words you need: computer-use agent, tool call, injection, trust boundary
- The lethal trifecta — and why you can't patch this in the model
- Set up — just Python 3, nothing to install
- The plan: a naive agent, then four layers of defense
- Write the agent harness (naive + defended in one file)
- Run it and watch the naive agent get hijacked (STAGE 2)
- Read STAGE 3 and the PROOF block — name the failure modes
- When a computer-use agent should NOT get tools — the better way
- Do it better — and an OPTIONAL real-Claude appendix