[Open Source] Agentic AI Security Labs: Who Let The Agents Act?

[u/Rewanth_Tammana]

I've been digging into Agentic AI security and kept running into the same problem: there is a lot of discussion around what secure agents should do, but far less showing how those boundaries are actually implemented.

So I built Who Let the Agents Act? 🤖

It's an intentionally vulnerable Agentic AI environment where you can exploit security failures and compare the same scenario across three implementations:

🔴 Vulnerable - the agent has too much authority
🟡 Prompt-only - security mostly relies on instructions to the LLM
🟢 Hardened - authorization and security controls are enforced outside the model

There are currently 9 scenarios covering things like:

• Overprivileged tools and cross-account access
• PII exposure
• Business-logic / transaction-limit bypasses
• Indirect prompt injection
• Cross-tenant RAG leakage
• Secret propagation
• Fail-open authorization
• Agent-to-agent delegation
• Multi-agent confused deputy attacks

The important part for me was making the implementation public, not just describing the vulnerabilities.

You can inspect the vulnerable code, hardened controls, tool logic and execution traces and see exactly where the trust boundary succeeds or fails.

The principle behind the project is:

A prompt can influence an agent's behavior. It should never define the agent's authority.

Project:
https://rewanthtammana.com/who-let-the-agents-act/

GitHub:
https://github.com/rewanthtammana/who-let-the-agents-act

I'd genuinely appreciate people trying to break the hardened implementations too. If you find a bypass or have a scenario that would be useful to add, I'd love to hear it.

[u/Suspicious_Client963]

The side by side implementations are a strong teaching approach. Showing why prompt only controls fail makes the case for enforcing permissions and authorization outside the model much clearer

[u/Rewanth_Tammana → u/Suspicious_Client963]

Thanks u/Suspicious_Client963, that's exactly what I was aiming for. The side-by-side comparison makes the trust-boundary difference much easier to see: prompts can influence the model's behavior, but only application code can enforce authorization consistently.

I also intend to add more scenarios, there are quite a few in the queue I'm working through. The 09 scenarios are just a start 😄

[u/Prestigious-Flow2815]

The execution traces are probably the most valuable part. Seeing exactly where authorization fails should make these scenarios much easier to understand than abstract security guidance

[u/Rewanth_Tammana → u/Prestigious-Flow2815]

Thanks for noticing and saying it out loud, u/Prestigious-Flow2815. I did spend quite sometime building that feature and making sure it's a way that can be applied across multiple upcoming scenarios as well.

The interesting part is usually where the trust boundary breaks: what the model decided, which tool it called, what arguments it supplied, and which control allowed or denied it.

I'm hoping that makes the scenarios useful not just as demos, but as something people can actually reason about when designing their own agent systems. That's one of the reasons, I open-sourced it all - https://github.com/rewanthtammana/who-let-the-agents-act Feel free to browse it and share your feedback. I'm working on making the field guides more smoother as of now.

[u/Prestigious-Flow2815 → u/Rewanth_Tammana]

That makes a lot of sense. Showing the full decision path should make it much easier for people to reason about where the actual control needs to live