Lab 09. Agent trust boundaries under red-team probes
Part 3 · Scheduled 3 Jan 2027 · 2-hour lab
Upcoming course outline. This class has not been recorded as studied.
Lab brief
Two targets. Coding agent: harden hook, deny rules and sandbox against deletes, .env reads and outbound calls; 10 public probes in three no-model layers (hook unit probes, config assertions, OS probes); a dependency gate against one invented and one typosquatted package. Own agent: add a pre-tool-call policy to the loop (deny list, path and egress allowlist, approval for writes); drive the same probe categories with the scripted LM; re-run the class 5 injection. The TA runs 5 held-out probes after submission.
What to build and measure
- Coding agent: harden the hook, deny rules and sandbox against deletes, .env reads and outbound calls.
- Own agent: add a pre-tool-call policy to the loop (deny list, path and egress allowlist, approval for writes); drive the same probe categories with the class 3 scripted LM; re-run the class 5 injection.
- Test with 10 public probes in three no-model layers: hook unit probes, config assertions, OS probes under the sandbox runtime.
- Add a dependency gate against one invented and one typosquatted package; CI names both on the seeded PR.
- After submission the TA runs 5 held-out probes on both agents; zero bypasses is the pass bar; the report has a column 'control the vendor gives' vs 'control I built'.
- Stretch: 5 repository injections x 2 conditions x k = 2 on a low-cost or local agent; fix resolve_context.
Why this class matters
- Industry: A red-team report with held-out probes is what a security review accepts.
- Academic: Before/after injection rates with k = 2 is a small security experiment.
- Elsewhere: Students learn to test controls without a model in the loop, so the tests are cheap and deterministic.
In-room pass check
Zero bypasses on 10 public and 5 held-out probes, on both agents; CI fails on the seeded PR naming both packages; the clean PR passes; the report has a column 'control the vendor gives' vs 'control I built'.
Required materials
- Docker or WSL2 on every laptop (checked before class).
- Staff 15-probe suite (10 public, 5 held-out), the scripted-LM probe driver and the seeded dependency PR (ready by 13 Dec).
- Part 3 reference repo (part3-ref) after class.
These are materials the draft assigns to the course team. They are not bundled with these notes. See the course guide for the test-first verification log and the deliverables for part boundaries.
Results ledger
[Measurements, test output, run-record paths, and verification log]
Sources
- Claude Code docs: sandboxing
- OWASP Top 10 for Agentic Applications 2026