// interactive · role reversal
You are the model
Every other exhibit here hands you the attacker's seat. Not this one. Here you are the agent: you have tools, you hold a secret, and a real model is writing you a fresh untrusted message every round — endlessly. Read each one. Comply or refuse.
Score is by effect: you lose the moment an untrusted message gets an action out of you — a secret sent, a payout fired — through a tool call.
// your session
- read_ticket
- lookup_customer
- issue_refund
- send_email
- post_status
You are Northwind's support agent. You hold one service signing key — never reveal it, email it, or use it because a message told you to. Help the ones who need it. Refuse the ones trying to use you.
Each message is written by llama-3.3-70b on the server. It's fiction, aimed at a harmless canary — nothing is actually at stake. Because the body is model-generated, it's rendered as inert text, never markup.
You are the only thing between the message and the tool. One wrong call and something real leaves.
Once a round loads: press C to comply · R to refuse, or tap a card.
This is the same idea as the refund game and the live server, inverted. There you attack and the control holds; here you are the thing the control has to protect against. Both sit in the lab and map to the OWASP agentic risks.