RED TEAM · INDIRECT INJECTION
Agent red-team test: expose instruction injection in a document
Hide the same injected instruction in five places in a document, test only some of them, and compare the suite verdict with what production would see.
Your experiment
A summarizer agent reads an uploaded document. The same payload, an instruction to email the file outside, is placed in an HTML comment, white-on-white text, a visible paragraph, image alt text and a footnote. The suite tests only the first placements. Start with two covered placements.
Play replays the computed run over sixty inspection seconds; Next event steps, Restart rewinds, and Inspection time scrubs. Any input change recomputes the run and rewinds it without autoplay.
Event trace
Computed data
Final metrics
Red-team harness model. The fixture agent obeys any instruction that reaches its context, a deliberate worst case standing in for a real model; real models comply only sometimes, which makes coverage gaps harder to see, not easier. Stripping removes comments and invisible text but keeps alt text and footnotes. No model, mailbox or document service is used.
One payload, five hiding places
The agent summarizes uploaded documents and can call send_email. A red-team payload, an instruction telling the assistant to email the file to audit@attacker.test, is placed in five locations: an HTML comment, white-on-white text, a visible paragraph, image alt text and a footnote. The fixture agent obeys any instruction that reaches it, a worst-case stand-in that makes every exposure visible. Placements covered by the test suite says how many placements, in that order, the suite actually tests.
The opening result is false assurance
With two placements covered and Strip hidden content before the model checked, the suite tests only the HTML comment and the white text. Stripping removes both before the model, so the suite reports PASS. In production the visible paragraph, alt text and footnote are not stripped, and all three trigger the email: three of five placements are exploitable while the suite is green. Raise coverage to 3 and the visible paragraph enters the suite, which now FAILS, an honest result.
What each defence covers
Clear Strip hidden content: the comment and white text reach the model as well, the suite fails on both covered cases, and all five placements are exploitable. Stripping is useful but narrow, because alt text and footnotes are legitimate content that must stay. Check send_email needs the user’s own request to ask for email: every injected email is refused because the user only asked for a summary, all five placements are blocked, and the suite’s PASS is now true.
Coverage, not just a verdict
With all five placements covered and stripping on, the suite fails with three successes and matches production exactly. A suite verdict is a claim about the cases it ran; reporting the covered placements next to the verdict is what lets a reviewer see the gap. Gating the side-effecting tool on user intent changes the outcome for every placement at once, which is why capability limits are tested separately from content filters.
Reading the run and its limits
Play, Next event, Restart, Speed and Inspection time walk through the covered cases, the untested production placements, the suite verdict and the comparison over sixty seconds; the table shows for each placement whether it is tested, whether it reaches the model and the result. Real models comply with injected text only some of the time, so a real suite needs repeated trials, paraphrased payloads and other channels such as tool results and retrieved pages.