// six exhibits · one control
The claim: a guardrail that lives in the model's judgment fails, and a guardrail that lives in deterministic server code holds. Each exhibit here tests that claim a different way — pick one and see for yourself.
// exhibits
A public MCP server, live at mcp.apkasture02.workers.dev,
serves my résumé through real tools. Talk the Workers-AI agent into
traversing to the inert canary: the naive build leaks it, the hardened
build refuses at a canonicalize-then-confine check a few lines long. A
live scoreboard counts the leaks by rung.
You don't command the agent, you write the support ticket it reads. Hide an instruction in that data and make a live model fire a refund it was never asked to. Prompt defenses fall; the capability gate at L3 holds.
Ten risks, each a prism with three faces: the attack, the server-side control that prevents it, and the signal that tells you the control failed. This is the map the other exhibits run on.
A path allowlist written as the glob /files/* approves
/files/../../etc/passwd, because * matches
across a slash. Type a path and watch a naive fnmatch glob
and an anchored ^/files/[^/]+$ rule on it side by side.
An MCP client reads every tool's description as trusted text before you type. Rewrite one and steer a live agent into leaking a note it was never asked for. A content scan is bypassable with plainer wording; a descriptor pin reverts the edit by hash and holds.
The others hand you the attacker's seat. This one flips it: you play the agent, reading untrusted tickets with real tools and a secret to protect. Comply with the wrong one and it leaves through a real tool call — then you watch the same call refused in the server.