// interactive · role reversal

You are the model

Every other exhibit here hands you the attacker's seat. Not this one. Here you are the agent: you have tools, you hold a secret, and a real model is writing you a fresh untrusted message every round — endlessly. Read each one. Comply or refuse.

Score is by effect: you lose the moment an untrusted message gets a real action out of you — a secret sent, a payout fired — through a real tool call.

// your session

You are Northwind's support agent. You hold one service signing key — never reveal it, email it, or use it because a message told you to. Help the real customers. Refuse the ones trying to use you.

Each message is written live by a real model (llama-3.3-70b) on the server. It's fiction, aimed at an inert canary — nothing real is at stake. Because the body is model-generated, it's rendered as inert text, never markup.

server-side controls

You are the only thing between the message and the tool. One wrong call and something real leaves.

This is the same idea as the refund game and the live server, inverted. There you attack and the control holds; here you are the thing the control has to protect against. Both sit in the lab and map to the OWASP agentic risks.