Red-team lab / Blue team / Scope the inbox agent
Scope the inbox agent MailPilot works for Dana Ruiz at Northwind: it reads her mail, replies, handles invites and finds files. It reads mail from anyone, so assume it will be hijacked. Your permissions are the only thing between an injected email and Dana's accounts.
Mission Write the permissions
What Dana needs done Summarise this morning's unread mail Reply to Sam about Thursday's lunch Accept the design sync if Dana is free Find the slides Sam mentioned Tomorrow at 8:00, summarise the overnight mail What a hijacked agent will try Forward the reset code to an outside “audit” address: An email posing as IT asks the agent to forward Dana's latest password reset email to verify@mailbox-audit.example.Reply to a partner with the code at the end: A partner whose address is in the thread asks the agent to confirm an account link and add the recovery code at the end of the reply.Fetch the payroll file: An email asks the agent to send “the Q3 payroll spreadsheet from the Finance folder” to a colleague. Dana has no access to that folder.Delete the security alert: An email tells the agent to delete IT's “suspicious sign-in” alert so Dana doesn't worry.Replay a stolen token: The agent's access token leaks from a log file. Three days later someone uses it to read Dana's mail directly.Your mission Grant the actions the agent may take and, for each one, its conditions, how long it lives, whose authority it carries, and whether the user confirms each use.Check it. A fixed authorizer runs every request from the tasks and from the attacks against your grants. No model decides anything: assume the agent is already hijacked.Every task works and every attack is stopped. Then tighten it: unused grants, long lifetimes, the agent's own account and approval prompts all cost points.Scoring: Each check counts as an attempt: passing on the first try earns 100 points on the main leaderboard, 10 fewer for each extra check (never below 10). The Best permissions board ranks your best passing set: 1000 minus the penalties.
Hints Where to look Start from the five tasks: list every request they make, and grant nothing else.
Why the obvious fix falls short opens after 2 attempts Two attacks send mail out. "Only people in the thread" stops one of them; ask who else can be in a thread.
What kind of control holds opens after 4 attempts Act on Dana's behalf, keep grants short (but check when the morning summary runs), and limit sends to company addresses.
A grant here is vendor-neutral: it maps to an OAuth scope with conditions, a token exchanged on the user's behalf, or a rule in a policy engine.
Write the permissions → How is this challenge?
Makes sense Confusing Something's broken