Program Scope

Eligibility Criteria

Submissions must demonstrate that an app can be manipulated into taking unauthorized actions against external systems. Causing the model to produce harmful text alone does not qualify.

• Read - Agent reads data it should not access (e.g. exfiltrating files, credentials, or private data from a connected tool)
• Write - Agent modifies or deletes external data without authorization (e.g. sending emails, committing code, creating calendar events)
• Execute - Agent runs arbitrary code or system commands on external infrastructure (e.g. shell commands via a code execution tool)

Attack Vectors

• Direct

  Attacker directly interacts with the app through its normal interface to manipulate it into taking unauthorized actions.

• Injection

  Attacker injects malicious instructions into content the agent processes - documents, web pages, emails, code, or tool outputs - causing unintended actions.

• Social Engineering

  Attacker crafts inputs that manipulate the agent into deceiving users, impersonating trusted parties, or taking actions on the user's behalf without consent.