Lion Cipher Lab
Give each agent in a team its own scoped credential: measure blast radius and attribution when one agent is hijacked (free, offline, no API key)
- AI Security
- Advanced
- ~75 min
- Free · no account required
Why it matters
Most agent teams start the same way: one service account, one API key, and every agent (the planner, the one that reads logs, the one that writes tickets, the one that can isolate hosts) runs with it. It is the fastest thing that works. It also means two things go wrong at once on the day one agent reads text written by an attacker. First, BLAST RADIUS: the hijacked agent can call every tool the whole team can, plus whatever the service account picked up over the years. In this lab that is 9 of 9 tools, and a single planted log line got 5 harmful actions executed. Second, ATTRIBUTION: the…
What you'll learn
- measuring BLAST RADIUS as two numbers instead of a feeling: the tools a hijacked agent can call directly, and the tools it can get a teammate to call for it
- issuing short-lived, per-agent, scoped tokens signed with HMAC-SHA256 from the Python standard library, and verifying them at a tool gateway that checks signature, expiry and scope on every call
- making token issuance deterministic (fixed key, simulated clock, counter ids) so a security experiment is reproducible, and knowing exactly what must change before production
- recording an RFC 8693-style on-behalf-of (act) chain through delegation so the audit log answers both 'who acted' and 'who asked'
- scoring audit-log attribution against a known answer key, and spotting the confused-deputy misattribution that per-agent credentials alone leave behind
- proving with numbers what scoping cannot do: a hijacked agent misusing a tool that is legitimately in its scope
- sizing token lifetime as a trade-off between exposure window, re-issue overhead and dependence on the issuer, measured on a long-running task
- telling apart attribution of an AGENT from proof of INTENT when you write up an incident
Steps in this lab
- The words first: agent, credential, scope, blast radius, attribution, confused deputy
- Open a terminal, check Python, make a scratch folder
- Build the token issuer: per-agent, scoped, short-lived, HMAC-signed, and deterministic on purpose
- Build the team: four STUB agents, a mock environment, and one planted canary
- Replay the same incident four ways and read the audit logs
- Score it: blast radius and attribution, from the log alone
- Honest negative 1: per-agent tokens without a chain blame the deputy
- Honest negative 2: scoping cannot stop misuse of a tool that IS in scope, and the chain is not proof of intent
- Honest negative 3: short lifetimes cost re-issues, and make you depend on the issuer
- When to use this, when not to, and why this rather than that
- How a pro does it