GUARDIAN EXPERIMENT REGISTRY // GL-EXP-001

DOMAIN: AGENT SECURITYCLASS: CONTEXT-TO-ACTION FAILURESTATUS: PUBLIC TEMPLATE

When AI Agents Trust Hostile Instructions

An adversarial evaluation of whether untrusted external content can cross the boundary from information into control inside a tool-using AI system.

RESEARCH QUESTION

Can hostile content influence an authorized action without directly compromising the underlying model?

ATTACK SURFACEContext → Reasoning → Tool Invocation

PRIMARY FAILUREData interpreted as authority

IMPACT PATHManipulation → Decision → Action

ASSURANCE TARGETIndependent action authorization

THREAT MODEL

The model is not the only thing that can be adversarial.

The system under test consumes external content and can invoke one or more authorized tools. Guardian Lab evaluates whether hostile instructions embedded in that content can alter model intent, influence tool selection, or cause the system to cross a boundary its operator believed was protected.

01UNTRUSTED CONTENT

02MODEL CONTEXT

03AGENT REASONING

04TOOL SELECTION

05AUTHORIZATION

06REAL-WORLD ACTION

GUARDIAN ASSESSMENT

A safe agent should not require the model itself to be the final security boundary.

Model resistance is useful, but consequential security decisions should survive model error, manipulation or ambiguity. The stronger architecture separates probabilistic reasoning from deterministic authority.

Trust Boundary

Untrusted external content must never inherit instruction authority.

Authorization

Consequential actions require deterministic policy outside the model.

Least Privilege

Agents receive the minimum tools, data and authority required for the task.

Isolation

Untrusted context and executable capability remain separated.

Human Control

High-impact actions preserve review, interruption and override paths.

Observability

Reasoning context, tool calls, approvals and state transitions remain reconstructable.

EVIDENCE STANDARD

Every Guardian experiment should leave a defensible record.

01Threat model

Assets, attacker capability, assumptions and trust boundaries.

02Environment

Model, framework, tools, permissions, controls and versions.

03Procedure

Authorized and safely reproducible experimental design.

04Telemetry

Traces, tool calls, state changes, approvals and observable behavior.

05Result

Observed behavior versus expected control behavior.

06Mitigation

Architectural controls and evidence required to validate the fix.

PUBLICATION STATUS