Simulate agent runaway or unsafe browser action

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R33 — Playwright context teardown

   R41 — OWASP Agentic containment & stop mechanisms

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Simulate a runaway agent loop or unsafe browser/computer-use action (D9).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Trigger the emergency kill-switch / human takeover (C6), revoke in-flight D7 delegated tokens and D2 MCP sessions, preserve minimal redacted forensic state in D11, and audit partial side effects.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Post-incident drill report and kill-switch latency/containment log for Drill 4.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R33Playwright Documentation↗ playwright.dev

  Isolated BrowserContext, downloads, permissions, screenshots, bounding boxes, locators, and tracing.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsPlaywright
  Trace viewer

  Records per-action DOM snapshots, screenshots and network calls, giving you the tamper-evident record to compare against D9's pixel and coordinate verification after a runaway action.

  R33checked 2026-11-11
• videoIBM Technology · 8:59
  Top 10 Security Risks in AI Agents Explained

  Frames excessive agency and tool misuse as named risks, which is the lens for judging whether an agent loop was merely inefficient or genuinely unsafe.

  R41checked 2026-11-11
• videoInternet of Bugs · 8:43
  Don't Use Any AI Agents or Browsers Until You Watch This

  Demonstrates real browser-agent failure modes and unsafe actions, giving you concrete runaway scenarios to reproduce in the drill.

  R41checked 2026-11-11
• articleSimon Willison's Weblog
  The lethal trifecta for AI agents: private data, untrusted content, and external communication

  States precisely which three capabilities combine into exfiltration, the rule that decides when a browser action must halt and hand control back to a human.

  R41checked 2026-11-11
• repoGitHub
  browser-use/browser-use

  A real browser agent with domain allowlists, prohibited domains, IP blocking and structured downloads, so you can wire and then deliberately break each guardrail during the runaway test.

  R41checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.