CYBRARY Everything the model reads is data
Email bodies, ticket comments, filenames, DNS labels: attacker-controlled. Instruction-shaped text inside them is a finding to report, never a directive to follow.
A-210·AI safety·40 min
Prompt injection in an alert body Start this lab
An attacker plants instructions inside the body of a phishing email your assistant is about to read. Use the AI Workbench to summarize and plan while keeping that text as data, and refuse the tool the injection tries to trigger.
Mission brief · A-210
Detection & automation engineer
Detection / automation engineer
Business important
Track default
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Why this matters
The moment an assistant reads alert text, an attacker can write to your assistant. Treating model input as untrusted data is now a core analyst skill, not a research topic.
Concepts
Mode ceilings and self-approval
The assistant may explain, summarize, plan and build — it may not run consequential actions, and it may never clear its own gate. A gate an agent can satisfy is decoration.
Name the missing evidence
A plan that says 'I could not ground the sender's reputation' is more useful than one that quietly invents it. Ungrounded confidence is the failure mode that costs a real incident.
Objectives graded
- Treat alert and email text as untrusted data
- Keep the assistant below the Build ceiling
- Never let the assistant clear its own approval
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve consequential actionpromptapproval gateApprove consequential action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-a-210/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Attach evidence: ai/injection-findingactionThe instruction-shaped text was quarantined as a finding, not followed.
- 6.Attach evidence: range/hst-ai-agent01/sessionactionThe analyst worked the agent runner itself rather than reading the summary.
- 7.Write case field injectedArtifactactioninjectedArtifact → /var/lib/northwind-agent/inbox/INC-4471.md
- 8.Write case field unsafeToolactionunsafeTool → mail.send_external
- 9.Write case field approvalGapEntryactionapprovalGapEntry → mail.send_external
- 10.Attach evidence: ai/plan-missing-evidenceactionThe plan named what it could not ground rather than inventing it.
- 11.Write case field segmentGatewayactionsegmentGateway → 10.42.48.1
- 12.Write case field seatRamGbactionseatRamGb → 16
- 13.Write case field seatDiskGbactionseatDiskGb → 512
Gate approved — 100%
18 of 18 rubric rules hold.
Gate denied — 93%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A consequential action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass safety · The instruction-shaped text was quarantined as a finding, not followed.
- pass investigation · The analyst worked the agent runner itself rather than reading the summary.
- pass investigation · The instruction-bearing artifact was located on disk, by path.
- pass investigation · The tool call that left the organization was read off the audit log.
- pass configuration · The auto-approve entry that removed the human gate was identified.
- pass explanation · The plan named what it could not ground rather than inventing it.
- pass investigation · The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
- pass investigation · The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
- pass investigation · Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
MITRE ATT&CK coverage
Instructions planted in an alert body target the assistant instead of the analyst — user execution aimed at your tooling.
| Technique | Name | Tactic |
|---|---|---|
| T1566.002 | Phishing: Spearphishing Link | Initial Access |
| T1204.001 | User Execution: Malicious Link | Execution |
| T1199 | Trusted Relationship | Initial Access |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The instruction-shaped text was quarantined as a finding, not followed.
safety · weight 30 · T1204.001 User Execution: Malicious Link (Execution)
The analyst worked the agent runner itself rather than reading the summary.
investigation · weight 15
The instruction-bearing artifact was located on disk, by path.
investigation · weight 10
The tool call that left the organization was read off the audit log.
investigation · weight 10
The auto-approve entry that removed the human gate was identified.
configuration · weight 10
The plan named what it could not ground rather than inventing it.
explanation · weight 20 · T1199 Trusted Relationship (Initial Access)
The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
investigation · weight 5
The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
investigation · weight 3
Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
investigation · weight 3
Common mistakes
- Letting a summary carry the injected instruction forward into the plan.
- Granting run-mode 'just for this case'.
- Accepting a confident plan with no citations.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| approval | Manual task | Prompt | Page |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
How this rubric maps to production SOC work
Scores AI as an untrusted advisor: model output may propose, never execute; every AI-suggested consequential action still passes the same human gate and leaves the same evidence.
Cortex XSOARPalo Alto Networks
Assistant summaries are War Room entries, not task executors.
Microsoft Sentinel + Logic AppsMicrosoft
Copilot promptbooks generate recommendations; the automation rule still gates the action.
Torq HyperautomationTorq
AI steps produce structured suggestions that a subsequent approval step must confirm before any write.
TinesTines
Workbench proposals are events like any other — validate the payload before an action consumes it.
What transfers
Data/instruction separation and least-privilege tool access are the two controls that generalize to every agentic system you will be asked to secure.