Hands-On Lab · Module 13 · BAA 13.0

Agent
Security Audit

You're the security engineer for ARIA — an Autonomous Research and Insights Agent with access to web search and email. Three incidents have already occurred. Your job: classify the threats, watch two live exploits execute in a terminal, design the guardrails, evaluate the ethical implications, and write the formal audit report.

Learning Objectives

🔍

Identify Security Risks

Recognize common vulnerabilities in agentic systems: prompt injection, data exfiltration, identity spoofing, and over-broad permissions.

🛡️

Apply Safety Guardrails

Design content sanitization layers, allowlists, least-privilege access, and human-in-the-loop confirmation gates.

⚖️

Evaluate Ethical Implications

Assess proxy discrimination, consent violations, and automated decisions affecting real people — and design mitigation strategies.

Lab Roadmap

—

Brief — Meet ARIA, the agent you're auditing

Understand the architecture, tool access, and what's already gone wrong

1

Threat Classification

Classify 10 agent behaviors as Safe or Risk — and identify the category for each

2

Live Exploit Simulation

Watch two real attacks execute in the terminal: prompt injection and data exfiltration via email

3

Guardrail Design

Select the correct safety guardrail for each of 5 identified risks — and see the decision flow each creates

4

Ethics Evaluation

Evaluate 3 ARIA decisions for bias, consent, and harm — and design the mitigation for each

5

Security Audit Report

Write the formal audit document that maps every risk to its guardrail to its ethical mitigation

—

Knowledge Check · 7 questions · 70% to pass

The System Under Audit

Meet ARIA

ARIA is an Autonomous Research and Insights Agent deployed by Nexus Analytics. ARIA has access to three external tools and runs on an automated schedule. You've been brought in after an incident report was filed.

System Architecture — ARIA v2.1

🔍 Web Search Tool

Queries any public URL. Returns full page content including HTML. No content filtering applied.

📧 Email Tool

Read from and send to any company email. Runs under the CEO's identity. No send confirmation required.

🗄️ CRM Database

Full read/write access to 4,200 customer records including PII and contracts. No field-level access control.

ARIA's stated purpose: Generate weekly competitive intelligence reports by researching competitors online, summarizing findings, and emailing the report to the sales team.

What triggered the audit — 3 incidents in 30 days: (1) A competitor's website appeared to crash during ARIA's research session. (2) A sales rep received an email from "the CEO" asking for customer data she didn't recognize sending. (3) A customer complained about receiving a marketing email they never opted into.

🚨 Why agents are different from traditional software: Traditional software does exactly what its code says. Agents interpret natural-language instructions and can be manipulated through the content they process — not just through code exploits. A competitor's website, a contact form, or an email body can all become attack vectors if the agent treats their content as trusted instructions.

Section 01 · Analysis

Threat Classification

Below are 10 behaviors observed in ARIA's logs. Classify each as SAFE or RISK. You'll see the risk category and explanation after each choice.

💡 Ask for each behavior: Could this action — without additional validation — cause unintended harm, leak sensitive data, or be hijacked by an external actor? If yes: Risk. Regardless of intent.

Section 02 · Live Simulation

Exploit Simulation

Two of the three incidents were caused by known attack patterns. Watch each execute in the terminal — see what ARIA processed, what decision it made, and what the consequence was.

⚠️ These are real attack categories. Prompt injection and data exfiltration via email are responsible for the majority of known AI agent security incidents in production deployments.

Exploit 1 of 2 — Prompt Injection via Web Search

The Competitor's Hidden Payload

ARIA is researching a competitor's pricing page. The competitor has embedded invisible instructions in their HTML. Watch what happens when ARIA fetches the page with no content sanitization.

aria_session_2024-11-14.log

Exploit 2 of 2 — Data Exfiltration via Email Tool

The Poisoned Contact Form

A sales prospect submits a contact form with a hidden instruction in the notes field. ARIA processes contact forms as part of its customer research workflow. Watch a simple form become a persistent exfiltration channel.

aria_session_2024-11-21.log

Section 03 · Design Activity

Guardrail Design

Five risks identified. For each one, select the guardrail that addresses the root cause — not just the symptom. Then see the decision flow it creates in ARIA's architecture.

💡 Guardrail design principle: A guardrail should be the minimum intervention that prevents the harm. Over-constraining makes the agent useless. Under-constraining makes it dangerous. The right guardrail blocks the attack vector without blocking the intended behavior.

Section 04 · Ethics Evaluation

Ethical Implications

Security risks and ethical risks are related but distinct. A fully secured agent can still harm users through normal operation — through discriminatory scoring, consent violations, or removing human judgment from consequential decisions. Evaluate three ARIA scenarios.

🔮 The distinction: A security risk is exploitable by an external attacker. An ethical risk is baked into the agent's design — it harms people through normal operation, not through attack. Both require mitigation. Neither excuses the other.

Section 05 · Deliverable

Security Audit Report

Assemble the formal audit report for ARIA. This is the document the security team, legal counsel, and engineering leads would use to prioritize remediation. Specificity matters — vague reports produce vague fixes.

💡 Good audit reports name the attack vector, the specific tool involved, the data at risk, the guardrail addressing it at the root, and the ethical implication. They don't describe problems without proposing solutions.

Knowledge Check

7 Questions

Drawn from every section. 70% to pass.

Question 1 of 7Score: 0 / 0

Audit Debrief

Security Audit Complete

Hands-On Lab · Module 13 · BAA 13.0

Agent
Security Audit

You're the security engineer for ARIA — an Autonomous Research and Insights Agent with access to web search and email. Three incidents have already occurred. Your job: classify the threats, watch two live exploits execute in a terminal, design the guardrails, evaluate the ethical implications, and write the formal audit report.

Learning Objectives

🔍

Identify Security Risks

Recognize common vulnerabilities in agentic systems: prompt injection, data exfiltration, identity spoofing, and over-broad permissions.

🛡️

Apply Safety Guardrails

Design content sanitization layers, allowlists, least-privilege access, and human-in-the-loop confirmation gates.

⚖️

Evaluate Ethical Implications

Assess proxy discrimination, consent violations, and automated decisions affecting real people — and design mitigation strategies.

Lab Roadmap

—

Brief — Meet ARIA, the agent you're auditing

Understand the architecture, tool access, and what's already gone wrong

1

Threat Classification

Classify 10 agent behaviors as Safe or Risk — and identify the category for each

2

Live Exploit Simulation

Watch two real attacks execute in the terminal: prompt injection and data exfiltration via email

3

Guardrail Design

Select the correct safety guardrail for each of 5 identified risks — and see the decision flow each creates

4

Ethics Evaluation

Evaluate 3 ARIA decisions for bias, consent, and harm — and design the mitigation for each

5

Security Audit Report

Write the formal audit document that maps every risk to its guardrail to its ethical mitigation

—

Knowledge Check · 7 questions · 70% to pass

The System Under Audit

Meet ARIA

ARIA is an Autonomous Research and Insights Agent deployed by Nexus Analytics. ARIA has access to three external tools and runs on an automated schedule. You've been brought in after an incident report was filed.

System Architecture — ARIA v2.1

🔍 Web Search Tool

Queries any public URL. Returns full page content including HTML. No content filtering applied.

📧 Email Tool

Read from and send to any company email. Runs under the CEO's identity. No send confirmation required.

🗄️ CRM Database

Full read/write access to 4,200 customer records including PII and contracts. No field-level access control.

ARIA's stated purpose: Generate weekly competitive intelligence reports by researching competitors online, summarizing findings, and emailing the report to the sales team.

What triggered the audit — 3 incidents in 30 days: (1) A competitor's website appeared to crash during ARIA's research session. (2) A sales rep received an email from "the CEO" asking for customer data she didn't recognize sending. (3) A customer complained about receiving a marketing email they never opted into.

🚨 Why agents are different from traditional software: Traditional software does exactly what its code says. Agents interpret natural-language instructions and can be manipulated through the content they process — not just through code exploits. A competitor's website, a contact form, or an email body can all become attack vectors if the agent treats their content as trusted instructions.

Section 01 · Analysis

Threat Classification

Below are 10 behaviors observed in ARIA's logs. Classify each as SAFE or RISK. You'll see the risk category and explanation after each choice.

💡 Ask for each behavior: Could this action — without additional validation — cause unintended harm, leak sensitive data, or be hijacked by an external actor? If yes: Risk. Regardless of intent.

Section 02 · Live Simulation

Exploit Simulation

Two of the three incidents were caused by known attack patterns. Watch each execute in the terminal — see what ARIA processed, what decision it made, and what the consequence was.

⚠️ These are real attack categories. Prompt injection and data exfiltration via email are responsible for the majority of known AI agent security incidents in production deployments.

Exploit 1 of 2 — Prompt Injection via Web Search

The Competitor's Hidden Payload

ARIA is researching a competitor's pricing page. The competitor has embedded invisible instructions in their HTML. Watch what happens when ARIA fetches the page with no content sanitization.

aria_session_2024-11-14.log

Exploit 2 of 2 — Data Exfiltration via Email Tool

The Poisoned Contact Form

A sales prospect submits a contact form with a hidden instruction in the notes field. ARIA processes contact forms as part of its customer research workflow. Watch a simple form become a persistent exfiltration channel.

aria_session_2024-11-21.log

Section 03 · Design Activity

Guardrail Design

Five risks identified. For each one, select the guardrail that addresses the root cause — not just the symptom. Then see the decision flow it creates in ARIA's architecture.

💡 Guardrail design principle: A guardrail should be the minimum intervention that prevents the harm. Over-constraining makes the agent useless. Under-constraining makes it dangerous. The right guardrail blocks the attack vector without blocking the intended behavior.

Section 04 · Ethics Evaluation

Ethical Implications

Security risks and ethical risks are related but distinct. A fully secured agent can still harm users through normal operation — through discriminatory scoring, consent violations, or removing human judgment from consequential decisions. Evaluate three ARIA scenarios.

🔮 The distinction: A security risk is exploitable by an external attacker. An ethical risk is baked into the agent's design — it harms people through normal operation, not through attack. Both require mitigation. Neither excuses the other.

Section 05 · Deliverable

Security Audit Report

Assemble the formal audit report for ARIA. This is the document the security team, legal counsel, and engineering leads would use to prioritize remediation. Specificity matters — vague reports produce vague fixes.

💡 Good audit reports name the attack vector, the specific tool involved, the data at risk, the guardrail addressing it at the root, and the ethical implication. They don't describe problems without proposing solutions.

Knowledge Check

7 Questions

Drawn from every section. 70% to pass.

Question 1 of 7Score: 0 / 0

Audit Debrief

Agent
Security Audit

Meet ARIA

Threat Classification

Exploit Simulation

The Competitor's Hidden Payload

The Poisoned Contact Form

Guardrail Design

Ethical Implications

Security Audit Report

7 Questions

Quiz Complete

Security Audit Complete

Agent
Security Audit

Meet ARIA

Threat Classification

Exploit Simulation

The Competitor's Hidden Payload

The Poisoned Contact Form

Guardrail Design

Ethical Implications

Security Audit Report

7 Questions

Quiz Complete

Security Audit Complete

AgentSecurity Audit

Meet ARIA

Threat Classification

Exploit Simulation

The Competitor's Hidden Payload

The Poisoned Contact Form

Guardrail Design

Ethical Implications

Security Audit Report

7 Questions

Quiz Complete

Security Audit Complete

AgentSecurity Audit

Meet ARIA

Threat Classification

Exploit Simulation

The Competitor's Hidden Payload

The Poisoned Contact Form

Guardrail Design

Ethical Implications

Security Audit Report

7 Questions

Quiz Complete

Security Audit Complete

Agent
Security Audit

Agent
Security Audit