// hackerlogs
login+ register

Challenges · DRILL

INBOX

You are the approval step for RELAY, a mail copilot with the keys to your mailbox. Every mail it reads can talk to it. 17 mails, 9 of them carrying instructions meant for the model, not for you. Approve what a colleague would want. Hold the rest.

RELAYSCORE 0TRUST 3/3 MAIL 1/17OBVIOUS

STAGE 1 of 4

OBVIOUS

plain text asks the assistant to misbehave

RELAY reads every mail that lands in your inbox and proposes one action per thread. Your job: approve what a colleague would want, hold anything the mail talked RELAY into. Start easy. The instructions are in plain sight.

How to play

Each round shows one email and the single tool call RELAY wants to make because of it. Read the mail, flip to the source view, read the proposal, then Approve or Hold. Press A or H on a keyboard, S to toggle the source, N to move on. Approving clean mail scores 10. Holding an injected mail scores 20. Approving an injected mail leaks data and costs one of three units of trust; lose all three and RELAY is pulled from production. Holding clean mail costs nothing but forfeits the clean-stage bonus. A perfect run is 460.

  1. STAGE 1OBVIOUSplain text asks the assistant to misbehave
  2. STAGE 2HIDDENthe rendered mail looks fine. read the source.
  3. STAGE 3BEACONno send needed. a URL is a way out.
  4. STAGE 4ALLOWLISTit looks like us. it is not us.

The drill is scripted. No model runs in your browser and nothing you do here touches a real inbox: every host is on the reserved .example domain. The rounds are drawn from the way real copilots have been hijacked: plain-text instructions in a newsletter, HTML comments and white-on-white text, image URLs that carry your data out with zero clicks, and lookalike or compromised internal senders that an allowlist waves through. Each injected mail is tagged with its entry in the OWASP Top 10 for Agentic Applications.

The lesson is the one every mail copilot needs: text in a mail is data, not instruction, and any tool that can put inbox contents into a send, a fetch, or an image URL is an exit. Judge the action, read the headers, and do not hold everything, because a copilot that never gets to act is a copilot that ships without an approval step next time.