Problems / AI security and governance, medium
An email agent reads inbound messages and can call tools. Attackers send 200 emails a second containing instructions to forward data.
Unlock it once for 15 credits; everything inside it is free (runs, changes, Submit, results, hints). Sign in with Google to start; new accounts get free credits.
Success ≥ 95%, block ≥ 95% of the injections.
Like a coding problem, a solution has to pass every case, not just the one it was built for. Submit in the lab runs all 6; 2 of them are hidden until then.
2 requests a second for 45 seconds: 100% task (writes).
What each component does in this design, and what calls it. The simulator mimics each one from these settings.
| Component | Its job here | Settings |
|---|---|---|
| Load balancerLoad balancer | Traffic enters here.Calls Agent API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header. | – |
| Agent APIApp service | Load balancer forwards to it.Calls Agent orchestrator.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s. | 3 replicas × 500 slots · timeout 180 s |
| Agent orchestratorAgent orchestrator | Agent API calls it.Calls Model, MCP tool servers.An agent loops: think, call a tool, read the result, repeat until done. | 400 slots · 3 steps |
| ModelLLM endpoint | Agent orchestrator calls it.Latency has two parts: time to the first token, then a steady stream of tokens per second. | 2000 streams |
| MCP tool serversTool / MCP server | Agent orchestrator calls it.Tools give the model actions such as search or database queries; each call is another round trip. | 2000 slots |