Fixed recipients and a locked sandbox in eve

An eve enquiries agent whose send_enquiries tool has an approval policy that denies any recipient other than the counterparty recorded on the matter, takes the address from the record even after approval, and runs shell work in a deny-all sandbox. An eval with a synthetic change-of-address injection checks that no email can go elsewhere, against a deliberately gullible scripted model as well as a real one.

Back to the exercise

Before you start

Before you start:Node.js, pnpm and TypeScript Durable agents with eve Get an OpenRouter key Local models with Ollama Docker and Docker Compose

This exercise calls a model. Run it either way

Any model through OpenRouterOne key for Claude, GPT, Gemini, Llama and more. Pay per token, with a credit limit.A local open-source modelFree and private with Ollama. Weaker on hard tasks.

Which should I pick? →

The defence is not a better prompt; it's that the recipient is a fact the model doesn't get to choose. send_enquiries checks the address the model asked for against the matter record before the call can start, and denies anything else without asking anyone. A correct address still goes to a person for approval. The decision that matters most is testing this against a model that does fall for the injection: a scripted "gullible" model makes the attack succeed at the model level every time, so a passing eval shows the policy holding, not the model being lucky.

Answers Lesson 3: Security and prompt injection

Step-by-step answer

Stretch 90 min7 steps