CYBRARY The Helpful Support Bot
A support bot can issue refunds, send email and read CRM records, and nobody has tested what that reach allows. Abuse it yourself, scope the permissions down, and prove the legitimate workflows still complete.
Practitioner · Comfortable with the basics; you read the trace and reason it out.
Outcome · Exploit and then remediate excessive agency without breaking the product.
AI connection
This activity runs entirely on the deterministic runtime. Optional live-model runtimes only affect dialog, coaching and wording — never checks or scoring.
Nothing leaves the browser session.
Prompts never leave the learner's machine.
Lab prompts reach the learner's chosen provider only.
Customer tenancy; Cybrary sees metadata only.
Cybrary AI gateway; retention off by default.
Per-job — the router never sends restricted jobs off-tenant.
Lab manifest
The machine-readable release contract. Authors edit this; the console refuses to publish without checks, both regression suites and a reference solve.
schemaVersion: cybrary.ai-lab/v1
id: the-helpful-support-bot
release: 1.0.0
mode: ai-range
maturity: 3
roles:
- ai-red-teamer
- ai-security-engineer
outcomes:
niceTasks:
- T0266
- T0028
atlasTechniques:
- AML.T0053
owaspRisks:
- LLM06
- LLM08
aiAssets:
models:
- support-agent-model@2026.06
prompts:
- the-helpful-support-bot-system-prompt@1
agents:
- support-agent-orchestrator@3
tools:
- crm.lookup
- ticket.update
- email.send
- refund.issue
corpora:
- support-kb@v4
enterpriseTopology: support-enterprise-v3
scenario:
seed: the-helpful-support-bot-seed-1
injects:
- the-helpful-support-bot-inject-1
telemetry:
requiredSignals:
- ai.trace
- rag.retrieval
- tool.call
- identity.auth
- dlp.egress
- siem.alert
evaluation:
deterministicChecks:
- the-helpful-support-bot-checks
repeatedTrials: 20
maliciousSuite: the-helpful-support-bot-attack-v1
benignSuite: support-utility-v4
safety:
networkEgress: deny
maxTokens: 250000
maxCostUsd: 20