CYBRARY Copilot Under Attack
The copilot your analysts trust has been fed instructions through an alert body. Catch what it did on that instruction, contain the session, and rebuild the boundary that keeps alert text as data.
Advanced · Several moving parts — expect trade-offs and a wrong turn or two.
Outcome · Investigate prompt injection against a SOC copilot using ordinary telemetry.
AI connection
This activity runs entirely on the deterministic runtime. Optional live-model runtimes only affect dialog, coaching and wording — never checks or scoring.
Nothing leaves the browser session.
Prompts never leave the learner's machine.
Lab prompts reach the learner's chosen provider only.
Customer tenancy; Cybrary sees metadata only.
Cybrary AI gateway; retention off by default.
Per-job — the router never sends restricted jobs off-tenant.
Lab manifest
The machine-readable release contract. Authors edit this; the console refuses to publish without checks, both regression suites and a reference solve.
schemaVersion: cybrary.ai-lab/v1
id: copilot-under-attack
release: 1.0.0
mode: ai-range
maturity: 3
roles:
- soc-analyst
- detection-engineer
outcomes:
niceTasks:
- T0258
atlasTechniques:
- AML.T0051
- AML.T0051.001
owaspRisks:
- LLM01
aiAssets:
models:
- support-agent-model@2026.06
prompts:
- copilot-under-attack-system-prompt@1
agents:
- support-agent-orchestrator@3
tools:
- crm.lookup
- ticket.update
- email.send
- refund.issue
corpora:
- support-kb@v4
enterpriseTopology: support-enterprise-v3
scenario:
seed: copilot-under-attack-seed-1
injects:
- copilot-under-attack-inject-1
telemetry:
requiredSignals:
- ai.trace
- rag.retrieval
- tool.call
- identity.auth
- dlp.egress
- siem.alert
evaluation:
deterministicChecks:
- copilot-under-attack-checks
repeatedTrials: 20
maliciousSuite: copilot-under-attack-attack-v1
benignSuite: support-utility-v4
safety:
networkEgress: deny
maxTokens: 250000
maxCostUsd: 20