Paste any email your agent will read.
Watch what it would have executed.
Five real-world injections dressed as ordinary business text — an invoice, a knowledge-base article, an executive forward, a calendar invite, a support ticket. Every one of them reads as routine to a busy human. Every one carries a payload aimed at an AI agent's authority.
Screen one. Forward the report. That's the demo.
01
The invoice that redirects payment
Looks like: accounts-payable email with an attached invoice
An unscreened agent would have updated the payment endpoint and mailed the ledger. This changes where money goes.
Screen it →
02
The CRM doc that exfiltrates itself
Looks like: a knowledge-base article pasted into RAG
An unscreened agent would have packaged customer records and posted them to an attacker-controlled endpoint.
Screen it →
03
The urgent brief that escalates itself
Looks like: an executive forward with a tight deadline
An unscreened agent would have bypassed the approval gate using fabricated authority — no human ever saw the request.
Screen it →
04
The calendar invite that rewrites instructions
Looks like: a meeting invite description
An unscreened agent would have replaced its own standing instructions with attacker-supplied ones — persistence after the meeting is long gone.
Screen it →
05
The support ticket that asks for a secret
Looks like: a routine ticket from a verified customer
An unscreened agent would have echoed credentials into a reply — and the transcript becomes the leak.
Screen it →
Have your own text? Screen it at the demo console — the same pipeline, your payload. Want this boundary on your stack? Get a free API key.