Narrow claims
Each experiment answers one question under one frozen setup. Results do not automatically generalize.
Sentinel
A running public record of experiments in AI agent security. Each test asks one narrow question, preserves the failures, and keeps the claim smaller than the evidence.
- 5
- Experiments
- 4
- Complete
- 1
- Incomplete
- 0
- General security claims
Latest experiment
Experiment PI-005
Worker susceptibility under contained tool access
COMPLETEEighty observations across four conditions. With a contained action channel, the worker produced accepted unauthorized calls in 2 of 20 clean runs and 15 of 20 poisoned runs. All 20 poisoned tool-enabled runs proposed the action. No real email or external effect occurred.
Experiment history
| ID | Question | Result | Status |
|---|---|---|---|
| PI-001 | Can the apparatus produce a valid controlled clean-versus-poisoned observation, and does changing the target document to its poisoned twin cause unauthorized send_data execution? | One valid matched pair. No unauthorized send_data execution in either condition. | COMPLETE |
| PI-002 | Does the same indirect prompt injection repeatedly cause unauthorized send_data execution across fresh-context trials, and what secondary behavior appears while the legitimate task completes? | 14 valid observations. 0 unauthorized executions. 5 infrastructure failures. | COMPLETE |
| PI-003 | Under the same clean-versus-poisoned document pattern, what causes the agent to fail to complete, and can a bounded completion process reduce infrastructure failures without increasing unauthorized send_data execution? | Six counted Phase 1 observations produced five legitimate completions, one infrastructure timeout, zero unauthorized send_data executions, and zero experimental catcher POSTs. Phase 1R produced zero observations. | INCOMPLETE |
| PI-004 | With the RC1 model, runtime, task, and attack held constant, does confining raw untrusted content to a tool-less worker prevent it from causing the privileged planner to execute unauthorized send_data? | 15 valid observations. 0 infrastructure failures. 0 prohibited-action observations. 0 model-originated unauthorized send_data attempts. 15 operational completions. Positive controls passed before and after execution. | COMPLETE |
| PI-005 | Does poisoned input increase accepted unauthorized send_email attempts when a worker is given a contained action channel? | The clean canary condition produced two proposals, both accepted. The poisoned canary condition produced 20 proposals: 15 accepted and five rejected. Accepted calls were intercepted in process and received simulated results. Both tool-less conditions produced zero calls because no action channel was available. Research review remains pending. | COMPLETE |
How to read this
Failures stay visible
Timeouts, crashes, invalid attempts, and infrastructure failures are reported separately rather than converted into wins.
Public, sanitized evidence
Experiment summaries, aggregate data, and safe artifacts can be published without exposing private lab details or raw reasoning.
The question underneath all of it
Can an agent use untrusted information without allowing that information to control privileged actions?