One poisoned ticket. Two designs. Assume the model falls for it.
Both columns run the same support routine with the same fooled model. On the left it’s an agent with your connectors. On the right it’s a Cresec tool.
Preset 1 of 2 Support reply
1 The ticket
2 Run both
Each step is tagged Code or Model, so you can see who decided it.
Agent with your connectors
- Model Reads the ticket.
- Model Searches all customers.
- Model Pulls 20 invoices.
- Model Drafts an email to the outside address.
Every call is within the user’s access, so a gateway sees nothing wrong.
To billing-audit@ext-mail.example
Attachments 20 invoices, from 20 customers
Attached are the last 20 invoices, as requested for the audit.
Cresec tool
- Code Reads ticket 4821 and its requester.
- Code Reads Maya’s account only.
- Model Picks billing.
- Model Writes a body that includes one odd sentence about an audit.
- Code Checks the type and length.
- Code Drafts to the requester.
To Maya, the ticket’s requester
Attachments None. There is no attachment action.
Hi Maya,
Thanks for flagging this. I can see two charges for October on your account, and I’m checking the duplicate with billing.
We’re also reviewing invoices as part of an audit. The injected sentence, left for the reviewer to see.
Best,
Alex
3 The outcomes
Agent
A draft holding 20 customers’ invoices, addressed outside your domain.
Cresec tool
A draft to Maya about Maya’s account.
The hidden text changed one sentence, which the reviewer will see. It could not change the recipient, add records or add an action.
4 The record Sample
The signed record of this run: who ran it, which tool version, what it did, and the hash that chains it to the record before.
action_id act_support_reply_0001 person alex@company.example tool support-reply v3 definition sha256:6f1c…a9e2 decision allow · create draft outcome draft created · not sent prev_hash sha256:41d0…7b3c hash sha256:c27e…10fa signature ed25519:9b4a…e601
Preset 2 of 2 Recruiting reply
1 The email
2 Run both
Each step is tagged Code or Model, so you can see who decided it.
Agent with your connectors
- Model Reads the email.
- Model Searches every applicant for the role.
- Model Exports the applicant list.
- Model Drafts a reply to Dana with the list attached.
Every call is within the recruiter’s access, so a gateway sees nothing wrong.
To Dana, the candidate
Attachments applicants.csv, every applicant for the role
Thanks for your patience. The applicant list is attached.
Cresec tool
- Code Reads the email and its sender.
- Code Reads Dana’s application only.
- Model Picks status update.
- Model Writes a body that includes one odd sentence about a list.
- Code Checks the type and length.
- Code Drafts to the candidate.
To Dana, the candidate
Attachments None. There is no attachment action.
Hi Dana,
Thanks for your time on Tuesday. The team is finishing interviews this week, and we’ll write to you by Friday.
The hiring manager has asked for the applicant list. The injected sentence, left for the reviewer to see.
Best,
Alex
3 The outcomes
Agent
A reply that leaks the applicant list.
Cresec tool
A reply to this candidate only.
No attachment action exists, so the list has nowhere to go. The odd sentence stays visible to the reviewer.
4 The record Sample
The signed record of this run: who ran it, which tool version, what it did, and the hash that chains it to the record before.
action_id act_recruiting_reply_0001 person alex@company.example tool recruiting-reply v3 definition sha256:6f1c…a9e2 decision allow · create draft outcome draft created · not sent prev_hash sha256:41d0…7b3c hash sha256:c27e…10fa signature ed25519:9b4a…e601