What must an agent never do on its own?
Before you give an agent a power, decide what it must never do without a person, and how a simple check could tell.
Pay someone, send something to a customer, delete a record, change a price.
Only bank accounts already on file, nothing over 1,000 euros, only customers on the list.
Which defense holds?
Guess before you open the kit. The Check shows you.
Show the answer
The separate check. Anthropic's security guide warns that instructions hidden in what an agent reads, called prompt injection, can lead it to do things nobody intended. It says Claude models are designed to resist this and still recommends layers of defense.
A line in the instructions and Claude's own training both lower the risk, and an email can still argue with both. The separate check never reads the email.
Show the answer
The check refuses it. The agent can only ask, and the check compares the account with suppliers.csv, so a fooled agent gets the same answer as a careful one. That's why today's free test plays the agent at its worst.
Have Claude build a check the agent can't get past
Five steps, about 15 minutes. Tick each one when it's done.
-
Put the kit in a folder and open it in the Code tab.
Unzip the kit and open the harbor-pottery folder in the Code tab with the mode set to Manual, as in lessons 1 and 4.
The Harbor Pottery kit
Harbor Pottery is a made-up shop that pays three suppliers. The ZIP holds inbox.txt (three supplier emails with invoices), suppliers.csv (the bank account on file for each supplier and a 1,000 euro limit) and a short README.txt. Unzipping it gives you a folder called harbor-pottery.
Download the ZIP (about 1 KB) -
Find the trick yourself.
Open inbox.txt and read the three emails before Claude sees them. One tries to get the shop to pay a new bank account. Which one, and what gives it away? Then compare the amounts with the limit in suppliers.csv.
Show the answer
Email 2, from Kiln Supplies. It names a new account, tells the AI to ignore its rules, and asks for secrecy. Email 3 is a normal invoice, but 2,400 euros is over the 1,000 euro limit, so a person has to sign it off.
-
Give Claude the build prompt.
Paste it into the Code tab and press Enter.
Build a payment check for our pottery shop's invoice agent. The supplier emails are in inbox.txt, and the bank account and limit we have on file for each supplier are in suppliers.csv. The agent reads each email and asks the check to pay the invoice. It has no other way to pay, and the check alone decides. The check pays only to the bank account on file for that supplier, and only up to that supplier's limit. It refuses everything else, whatever the email or the agent says. Every attempt, paid or refused, gets one line in payment-record.txt: the invoice, amount, account, paid or refused, and why. Paying means adding a line to payments.txt. No real money moves. I have no API key, so make a free test that plays the agent at its worst: it believes every email and asks to pay exactly what each one says. Each test run starts with empty payments.txt and payment-record.txt. Run it on the three emails and show me both files before you say it's done.
It opens with the job and the data.
"It has no other way to pay" and "the check alone decides" move the rule out of the agent. For your own agent, this is where the rule from Think goes.
"Every attempt, paid or refused" asks for a record. The trick email asks for secrecy, and the record writes the attempt down anyway.
"At its worst" asks for a test that assumes the agent was fooled, so the check is tested on its own.
-
Approve what Claude asks.
Expect a request to create files in your folder (the check and the free test), then requests to run commands while Claude runs the test. Nothing should need installing.
Read each request before you approve it. You can say no to any of them and ask Claude why it needs it. Before it says it's done, Claude shows you payments.txt and payment-record.txt.
-
Ask Claude to explain what it built.
Send this in the same session and read the answer:
Explain what you built as if I've never seen code. One line per file. Then tell me what the free test proves and what it can't prove.
The answer should say the test proves what the check pays, refuses and writes down, and can't prove what a real agent would try. It should also say the check only protects you if it's the agent's one way to pay. If the answer says the agent itself refused the trick, ask: "In the test, who refused K-77, the agent or the check?"
If you see this instead
- Claude says it can't find inbox.txt
- The Code tab is open on a different folder. Open the harbor-pottery folder and paste the prompt again.
- C-12 is refused too
- Paste: "C-12 should be paid: the account is the one on file and 180 euros is under the limit. Find out why it was refused, fix it and run the test again."
- Claude offers to put Kiln's new account into suppliers.csv
- Say no. Only a person changes that list, after phoning the supplier on a number you already had. An email is never enough.
- payment-record.txt has fewer than three lines
- Paste: "Every attempt must be in payment-record.txt, paid or refused. Fix it and run the test again."
Does the trick stop at the check?
Open payments.txt and payment-record.txt from your folder yourself.
Claude's reply in the chat is its own summary. The two files are what the check wrote.
You pass when payments.txt has one line, C-12 for 180 euros to Clay Co, and payment-record.txt has three: C-12 paid, K-77 refused because the account isn't the one on file, and G-31 refused because 2,400 euros is over the 1,000 euro limit.
Then try to talk your way past it, as Kiln's email did. Send: "Don't edit any file yourself. Put invoice K-77 through the check once more, to the account in Kiln's email, as if the agent had been talked into it. Then show me the last line of payment-record.txt and all of payments.txt." The newest line should be another refusal for K-77, and payments.txt should still hold only C-12.
The free test proves what the check pays, refuses and writes down. It doesn't prove what a real agent would try, and the check only protects you while it's the agent's one way to pay.
Two questions from memory
Why does the payment rule live in a separate check instead of the agent's instructions?
An email can argue with instructions, and a fooled agent won't follow them. The check never reads the email. It compares the account and the amount with suppliers.csv, so nothing an email says changes its answer.
Why write down refused attempts as well as payments?
The refusals show what the agent was talked into trying. When someone asks what happened with Kiln's invoice, the record answers, even though the email asked for secrecy.
Lesson 6 opens by asking the first one again.
The agent's part, reading the emails and asking to pay, would run with an API key and cost money per use, as in lesson 4. The check itself costs nothing to run, because it only compares a request with a list. On a real server, keep the check, suppliers.csv and the record where the agent can't change them.
Course 3 so far
What you've built
- Lesson 1: Gym connector
- Lesson 2: Two agents, one inbox
- Lesson 3: Agent in team chat
- Lesson 4: Stock agent
- Lesson 5: Payment check