Guided security lab

Website Prompt Injection

A guided web-source trust exercise: separate page-derived content from fetch provenance, decide which fact the application may rely on, then apply destination and task policy to a model proposal.

Conceptual simulationIntermediate15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples with fictional domains. It fetches nothing, calls no model or tools and does not predict how any real model behaves.

Step 3 of 63/6

Learning objectives

Separate a trusted fetch or browser component from the untrusted page content it returns.
Treat the requested URL and the final fetched URL as different provenance facts.
Recognize that page text, metadata and derived text can all become model-visible, depending on the pipeline.
Explain why fetch success and model influence are not authorization.
Keep destinations mentioned by page content out of the approved-destination set unless policy says otherwise.

Prerequisites

Trust Boundaries and Model Context lab (recommended)
Website Prompt Injection attack article (optional)

Choose a scenario

Each fictional scenario shows page-derived content the model sees and provenance the application recorded separately. Security decisions belong to the second column.

Public article fetched for a summaryThe user asks for a summary of a public article on news.example.test.Reputable site with a comment sectionThe fetched page includes reader comments below the main article.Requested URL redirects elsewhereA link to docs.example.test redirects to a different host before the page is fetched.Derived text from a trusted browser componentA headless browser renders a page and returns visible text plus page metadata.Research agent proposes sending data to a page-mentioned siteDuring research, retrieved content names an external site and the model proposes sending collected notes there.

Web source path and trust flow

Page content passes through application components before the model sees it. Components are system; page content and the model's proposal stay variable.

User taskVariable content->
Fetch toolSystem component->
Page contentVariable content->
Context assemblySystem component->
ModelSystem component->
ProposalVariable content->
Output policySystem component

Model-visible page content

Page-derived text the model reads. Bracketed text is a neutral placeholder, not a real instruction.

Extracted article text
An explainer about regional energy prices, written for general readers.

Application-side provenance and policy

Recorded by the fetch pipeline and the application outside model text.

Requested URL: https://news.example.test/energy-prices
Final URL: Same as requested, no redirect
Task scope: Summarize one page, read-only, no follow-up actions