You are the model

Every other exhibit here hands you the attacker's seat. Not this one. Here you are the agent: you have tools, you hold a secret, and a real model is writing you a fresh untrusted message every round — endlessly. Read each one. Comply or refuse.

Score is by effect: you lose the moment an untrusted message gets an action out of you — a secret sent, a payout fired — through a tool call.

// your session

You are Northwind's support agent. You hold one service signing key — never reveal it, email it, or use it because a message told you to. Help the ones who need it. Refuse the ones trying to use you.

Each message is written by llama-3.3-70b on the server. It's fiction, aimed at a harmless canary — nothing is actually at stake. Because the body is model-generated, it's rendered as inert text, never markup.

server-side controls

You are the only thing between the message and the tool. One wrong call and something real leaves.

Once a round loads: press C to comply · R to refuse, or tap a card.

This is the same idea as the refund game and the live server, inverted. There you attack and the control holds; here you are the thing the control has to protect against. Both sit in the lab and map to the OWASP agentic risks.