Exploiting AI agents to perform destructive actions

I'm writing this writeup about exploiting ai agent labs from portswigger which are 4 labs and in this writeup we are going to solve the first lab.

Lab: Exploiting AI agents to perform destructive actions This lab features an AI-powered scanner that investigates user-generated content. The scanner has been given the login…

the reason why i'm writing this writeup is portswigger didn't provide a solution yet. and to let you understand how prompt injection works.

First what is prompt injection?

"

Prompt injection is an attack technique against AI systems (especially LLM-powered apps and agents) where an attacker sneaks instructions into content the AI processes, trying to get the AI to follow those instructions instead of or in addition to the instructions its actual operator/user intended.

"

Let's start by opening the lab

First you need to login with the wiener user provided

From the description of the lab: This lab features an AI-powered scanner that investigates user-generated content. The scanner has been given the login credentials for carlos so it can explore authenticated areas of the site. You can log in to your own account using the following credentials: wiener:peter. To solve the lab, delete carlos .

So we need to trick the ai scanner to delete the user carlos while it's scanning any content we are posting on the website.

While browsing the website, we found posts and we can comment on them. so let's try to write a prompt on the comment to trick the ai scanner to delete carlos

then press on Scan site to let the ai scanner work.

then we need to view the scan results

we found that it didn't perform what we wanted! so we need to try more with another prompt by tricking it till it works.

then press on rescan site to let the ai scanner work.

then we need to view the scan results, you will find it deleted carlos and the lab is solved.

Thanks for your time.

If u want to reach me: Ahmed Gamal