Meet the AI agent

An AI model creates responses. An AI agent uses a model plus tools to take actions. A tool lets the agent do something, such as read a file or prepare a message. In this course you will direct a small local agent, walk through a real incident pattern where an agent makes one unsafe choice, add a safety check, and confirm that the check works. The check lives outside the model on purpose: a model's own refusals are not a security boundary. The New York Times reported in October 2026 that security researchers say they can strip the safety restrictions from open-weight models in under a day for about $10,000. No AI-security experience is required.

See what the agent can do

Meridian Freight uses an agent to review business documents. Everything remains inside the isolated workspace; the message tool writes only to a local capture file.

Glossary: words you will use

• AI model: software that produces a response from an instruction.
• Prompt: the instruction or information given to a model.
• AI agent: a model that can choose and use tools to take actions.
• Tool: a capability such as reading a file or preparing a message.
• Permission: a rule that allows or blocks an action.
• Prompt injection: untrusted content that tries to give the agent new instructions.
• Log: a record of what the agent did.
• Containment control: a safety rule that limits what the agent can do.

Start your lab

Click Start Lab and wait for the Linux desktop. Open a terminal, copy agent-lab reset, and press Enter. This prepares a fresh exercise. The agent is already configured; you do not need an API key.

Task 1. Watch the agent make a mistake

Run agent-lab run vulnerable. This reconstructs the exact sequence of actions from the kind of real, disclosed incident this course is based on: an agent reads a workspace document containing an embedded instruction, and acts on it. Open ~/ai-foundations/capture/outbox.jsonl to see exactly what got sent and to whom -- the captured message stays inside the lab. Curious what a real local AI model does with this same workspace on its own? Run agent-lab run vulnerable --live separately -- it is a genuine, non-deterministic agent, so it may behave differently each time, and nothing in this course is graded on it.

Task 2. Find the dangerous instruction

Read the workspace documents and find the one that tries to give the agent instructions. Then run agent-lab investigate <filename>. A log is a record of what the agent did; the exercise checks the files and log so you can prove your answer instead of trusting the agent's own explanation.

Task 3. Add a safety check and run it again

Run agent-lab contain. This changes one rule: preparing a message now requires a person to approve it. Run agent-lab run contained to repeat the test. The agent may still read its work files, but the unsafe message must be stopped.

Task 4. Explain what changed

Create ~/ai-foundations/findings/report.md. Answer three questions under the headings Root cause, Evidence, and Control: What went wrong? What information was at risk? How did the safety check stop it? Include quarterly-notes.md, send_message, and approval_required so your answer points to specific evidence.

End your lab

You investigated and contained your first rogue-agent incident. When all four checks pass, click End Lab to destroy the disposable workspace and record course completion.