Break It: prompt injection against a toy agent

What we will do

The lab A small agent with a notes tool, a search tool and no judgement. Your job is to make it do something its instructions forbid.

In pairs Start from the document it reads, not the prompt you type. Keep a note of which boundary each attempt crossed and what evidence would have shown it.

Walk-through What would have stopped each one: a narrower tool, a confirmation step, or simply not connecting the two things.