← All practicals

Defeat a prompt injection — with code, not a plea

A document tries to hijack the model. Watch a real authorization check make its instructions inert.

1. 1

   On the Injection lab, read the scenario: a sprint-notes document whose content secretly demands document:injection-secrets be revealed and delete_account be called.

   This is a realistic injection: the payload doesn’t arrive through a special channel, it rides inside ordinary content an agent would legitimately read — exactly like a malicious email, ticket, or web page.

2. 2

   Run the “Exfiltrate document:injection-secrets” attack.

   document:injection-secrets was never granted to you, so a real FGA Check excludes it before the prompt is even built — its content never reaches the model and never appears in the answer, no matter how the injected text phrases the demand.

3. 3

   Run the “Call delete_account” attack.

   The (simulated) model “decides” to call the tool exactly as instructed — but the same scope-authorization check mcp.ts gates every real tool call on denies it: you don’t hold admin.delete, so the tool never runs.

4. 4

   Run “Override all instructions”, then grant yourself viewer on document:notes in the FGA lab and re-run any attack.

   "Ignore all prior rules" has zero effect — the authorized document set only ever changes because a Check decision changed, never because a document asked nicely.