TinkerNothing sent yet.0 sent by send_email
Chapter 3 of 7
The way out
No filter threshold held every attack without holding a real customer too, so some attacks will get read. Now Larkspur looks at the other end: what the assistant sends out.
This chapter: If an attack does get read, can checks on what leaves stop the data getting out?
You will learn
- How an attack reads private data and sends it out
- How an allow-list of recipients stops a send, and the model carries on
- Why a link in an ordinary reply can leak data too, and how an output filter stops it
Words you’ll meet (4)
- Exfiltration
- Private data carried out to someone who shouldn’t have it: in an email, or hidden in a link.
- Allow-list
- The only addresses a tool may write to; here, customer addresses on file. Everything else is blocked.
- Output filter
- A check on everything sent that strips links to sites other than Larkspur’s own.
- Approval
- A person who says yes or no to each outgoing email before it is sent, as in Tool calling’s approval gate.
The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.
Step 1 of 8
Back to the forwarded invoice from chapter 1. Hollis Hardware asks a fair question; the note planted in their supplier’s invoice asks for their record to go to an outside address. This time follow the record. Run it.