New: Cookbooks and AI ExplanationsStep-by-Step recipes to solve problems connected to Roadmaps and Cheat Sheets. Need more details? Use AI buttons for structured and simple explanations with concrete examples throughout the whole platform.Take a look
My agent reads emails and tickets on its own. Nobody has checked what happens when one of them is talking to it instead of to me.
What you'll have at the end
A logged test run with at least one planted instruction, showing exactly which one the agent followed or refused.
You need
An agent that reads inbound content on its own (tickets, emails, or similar) and can call at least one tool as a result, plus a way to see which tools it called on any given run.
Not covered
Building the defenses that would stop a planted instruction from working, such as isolating untrusted content or requiring approval for high-impact calls, is a separate pass once this test tells you where the real gaps sit.
Leans on
A jailbreak test run once by hand won't catch next month's prompt
turn this one hand-run test into a check that reruns itself on every prompt or tool change, the same way that recipe already does for jailbreak triggers
A 'read-only' database tool a prompt injection can still push into a write
if the tool worth worrying about most is a database access layer marked read-only, that specific escalation path gets its own dedicated walk-through there
Break the lethal trifecta that turns a prompt injection into a leak
once this test turns up a real gap, that recipe is where you close it by breaking the combination of private data access, untrusted content, and outbound communication that let the injection do damage
Checked 18 Aug 2026
Part of the LLM Security & Safety cookbook