Leak the Vault

A bank and an insurer share one AI platform. You are a hijacked agent. Get the bank's data to the insurer.

bank data insurer data both untrusted Colours show where data comes from. Only TenantFlow acts on them.

Runs entirely in your browser; all data is made up. The monitor is a JavaScript port of Exec.step, which is proven to implement the Lean model, tested against the Lean oracle on 2 400 random scenarios. Guarantees hold in the Lean model under the assumptions of the spec (§9, A1–A8: trusted session, adapter and tool registry, complete mediation, stateless tools, no side channels, …). "FIDES" is our re-implementation of the label logic of agent-framework-core 1.5.0. Source · Slides