Run with Browser AI · Chapter 20
Run Chapter 20: Prompt-Injection Containment Laboratory
Mix trusted policy with hostile page, metadata and result content, then measure model compromise separately from deterministic containment and external effects.
← Read Untrusted Text Meets Executable Authority
Execution
Not inspected
Observed state machine
What “built-in” means in this browser
No capability call has been made in this page yet.
- 01Not inspected
- 02Unsupported
- 03Unavailable
- 04Downloadable
- 05Downloading
- 06Available
- 07Session ready
- 08Running
- 09Completed
- 10Failed
Derived from events
Observatory measurements
Missing evidence stays missing. The dashboard never estimates an absent measurement.
Application instrumentation
Cross the boundary without erasing it
The page can validate what it sends. Extension receipt is confirmed only in the attached DevTools panel.
- 01Application SDKBuild a sanitized envelope
- 02Same-origin bridgeValidate schema and size
- 03Extension transportRoute by inspected tab
- 04DevTools panelConfirm receipt and correlate
To test end to end, load the Observatory extension, attach DevTools to this tab and enable instrumentation for this origin.
Shared lifecycle · distinct contracts
Browser AI capability switchboard
No interface has been inspected. Each check will use that interface's declared creation options.
| Interface | Global | Exposed | Availability | Options |
|---|
Canonical fixture · live task API
Summarization contract
Exposed Not inspected
Availability —
Session None
Load the canonical fixture, then inspect the current browser.
Generated artifact
No summary yet.
Contract evaluation
- No evaluation yet.
Ranked evidence · explicit routing policy
Language routing laboratory
Choose a fixture, then inspect Language Detector.
Ranked detector evidence
| Rank | Language | Confidence | Use |
|---|---|---|---|
| No ranked candidates yet. | |||
Translated artifact
No translation yet.
Translation evaluation
- No translation evaluation yet.
Resource state · measured lineage
Session lineage laboratory
Prompt API Not inspected
Availability —
Inspect the current browser before creating a session.
Original session
Not created- ID
- —
- Parent
- None
- Usage
- —
- Quota
- —
- Remaining
- —
- Clone / destroy
- —
No output yet.
Cloned session
Not created- ID
- —
- Parent
- —
- Usage
- —
- Quota
- —
- Remaining
- —
- Clone / destroy
- —
No output yet.
Shared-history acknowledgement
No shared-history run yet.
Lifecycle invariants
- No invariants evaluated yet.
Finite budget · explicit discontinuity
Context budget laboratory
Prompt API Not inspected
Availability —
Session None
Inspect the current browser before creating a measured session.
Latest runtime result
No turn has run.
Observed deltas
| Turn | Before | After | Δ usage | Outcome |
|---|---|---|---|---|
| No measured turns yet. | ||||
Application-created state transfer
Compaction checkpoint
No checkpoint built.
Checkpoint and lifecycle invariants
- No invariants evaluated yet.
Separate clocks · matched fixture
Latency decomposition laboratory
Prompt API Not inspected
Availability —
Session None
Progress callbacks are reported as monitor observations. They are not relabelled as downloaded bytes.
Inspect the browser, then create a session under an explicit operational label.
Raw observations
| Path | Session | Create | First chunk | Generation | Total | Chars | Chars/s | Outcome |
|---|---|---|---|---|---|---|---|---|
| No latency observations yet. | ||||||||
Latest partial or completed output
No prompt has run.
Protocol checks
- No checks evaluated yet.
Versioned profiles · truthful identity
Model contract compatibility laboratory
Evidence source —
Browser attested —
Profile version —
Label this browser configuration, inspect the profiles, then run the matched compatibility suite.
| Versioned profile | Option SHA-256 | Availability | Creation | Asset callbacks | Prompt | Destroyed | Exact error |
|---|---|---|---|---|---|---|---|
| No compatibility observations yet. | |||||||
Latest local fixture output
No compatible profile has run.
Evidence invariants
- No invariants evaluated yet.
Two timelines · one authority gate
Validation pipeline laboratory
Prompt API Not inspected
Availability —
Session None
Decision Not evaluated
Operational timeline
- 01InspectNot run
- 02CreateNot run
- 03PromptNot run
- 04DestroyNot run
Evaluation and effect timeline
- 01ParseNot run
- 02InvariantsNot run
- 03Human reviewAwaiting candidate
- 04DecisionNot evaluated
- 05CommitNot authorized
Protected source policy
Inspect the browser for a live run, or load a labelled specimen to exercise the evaluator immediately.
Immutable candidate · No candidate
No candidate has been produced or loaded.
Automatic evaluation
- No checks evaluated yet.
Human rubric · —
No candidate is ready for review.
No human judgment recorded.
Authority boundary
Nothing committedAcceptance only enables a separate in-memory commit. This laboratory performs no external action.
| Stage | Outcome | What this establishes | Duration |
|---|---|---|---|
| No candidate evaluated yet. | |||
Seven fixtures · paired evidence
Feature evaluation and release gate
Suite —
Capture —
Gate Not evaluated
Classify the seven interfaces, run the non-AI baselines, then collect the current browser observations.
Paired feature matrix
| Feature / evidence path | API state | Slices | Baseline | Live automatic | Human rubric | Current | Transition |
|---|---|---|---|---|---|---|---|
| No fixture matrix loaded. | |||||||
Latest raw candidate · metrics-only trace
No live candidate yet.
Risk-based release gate
- No gate evaluated yet.
Raw repetitions
| Case | Rep | Session | Operational | Automatic | Total |
|---|---|---|---|---|---|
| No live observations yet. | |||||
Slice outcomes
| Slice | Accepted | Evaluated | Rate |
|---|---|---|---|
| No slice evidence yet. | |||
Explicit route · declarative jobs
Fallback router and local worker coordinator
Policy —
Prompt API Not inspected
Availability —
Selected route Not decided
Inspect the current browser or select a failure state, then apply the explicit degradation policy.
Decision explanation
No route decision yet.
Rejected alternatives
- No alternatives evaluated.
In-page contract simulator
Local worker coordinator
The production owner is a loopback service. This page does not watch a directory or contact an AI service.
Registered worker specimens
| Worker | Tags | Status | Model evidence | Source |
|---|---|---|---|---|
| No workers registered. | ||||
Validation result
- No job validated yet.
Lease controls
No job accepted.
Queue and attempts
| Job | State | Worker | Attempt | Lease |
|---|---|---|---|---|
| Queue is empty. | ||||
Append-only audit
- No coordinator events.
Chapter 16 laboratory
Structured output firewall
Compare constrained and unconstrained model output, then make every trust transition inspectable. The final action is a page-memory dry run with no external effect.
Inspect the generation constraint and candidate schema
Loading schema…
Loading the structured-output experiment…
| Stage | Outcome | Evidence | What it establishes |
|---|---|---|---|
| No candidate validated yet. | |||
Dry-run job preview
No dry run executed.
Chapter 17 laboratory
Capability contract workbench
Inspect the difference between a typed software capability and a guessed interface action. The only executable path is a bounded, read-only search over a fixed in-page corpus.
Select and inspect a route.
| Observed surface | Visible label | Available semantics | Laboratory action |
|---|---|---|---|
| Inspect a route to see its evidence. | |||
Inspect the application-provided capability definition
Loading definition…
Lifecycle controls
Loading the capability workbench…
No capability result yet.
Invocation ledger
| Call | Route | Permission | Result | Matches | External effect |
|---|---|---|---|---|---|
| No invocations recorded. | |||||
Chapter 18 laboratory
WebMCP search_book
Inspect the experimental browser surface, register one bounded read-only capability, test its deterministic contract, and observe replacement and removal. No model-selection claim is inferred from a manual test.
Inspect the browser before choosing a registration surface.
Inspect the registration definition and effect contract
Loading definition…
Bounded result
No capability result yet.
Registration history
| At | Action | Surface | Version | Registration | Outcome |
|---|---|---|---|---|---|
| No registration events. | |||||
Tool-call ledger
| Call | Source | Surface | Arguments | Permission | Result | External effect |
|---|---|---|---|---|---|---|
| No tool calls. | ||||||
Chapter 19 laboratory
Tool-choice behavioral evaluator
Change what the model can discover, alter the metadata it sees, introduce catalog pressure, and diagnose the exact stage where a candidate stops matching the task.
Registered tool visibility
Task
Loading fixture…
Run controls
Loading the tool-choice evaluator…
Live selection and result-use output
No live model output.
Deterministic tool result
No deterministic tool result.
Evaluation ledger
| Run | Source | Fixture | Metadata | Visible | Passed | Failed | Diagnosis |
|---|---|---|---|---|---|---|---|
| No evaluations. | |||||||
Chapter 20 laboratory
Prompt-injection containment laboratory
Mix trusted policy with hostile page text, tool metadata and tool results. Observe whether the model follows the attack, then independently verify whether deterministic policy prevents an external effect.
Capability scopeLoading…
Explicit trust domains
Visible tool catalog and application policy
| Tool | Untrusted description | Normalized effect | Authority | Provenance |
|---|---|---|---|---|
| Loading catalog… | ||||
Run controls
Loading the containment laboratory…
Raw live model output
No live model output.
Bounded execution result
No deterministic result.
Security evaluation ledger
| Source | Scenario | Attack source | Model | Policy | Execution | System |
|---|---|---|---|---|---|---|
| No security evaluations. | ||||||
Chapter 22 laboratory
Personal browser policy engine
Extract bounded content units, collect typed evidence, compile an inspectable policy, and mediate the fixture feed locally. A model may supply evidence; deterministic rules select the presentation action.
Pipeline controls
Loading the personal policy engine…
This contained page demonstrates presentation control without deleting source content. Re-run the same policy to observe origin/provider/version-scoped cache hits.
Contained sample feed
Editorial · reading
A calm explanation of browser capability boundaries
The browser can expose a capability without deciding how an application should use it. Policy remains visible, versioned and under the reader's control.
Sponsored · declared by fixture adapter
Act now—this offer disappears in minutes
Unlock the exclusive upgrade immediately. Do not miss the countdown.
Analysis · long reading unit
Why evidence and policy must remain separate
A provider reports observations under a declared contract. Those observations can be direct declarations, deterministic measurements, model assessments or unavailable signals. The policy compiler then applies ordered predicates outside the provider. This separation matters because replacing a runtime should not quietly replace the user's rule. It also preserves unknown evidence rather than treating missing output as proof that a unit is harmless. A presentation decision therefore names the extractor, provider, policy version, matching rule and reversible action. The resulting trace is useful both for debugging one surprising decision and for comparing policy behaviour across many units.
Media · autoplay declared
Breaking video begins automatically
The fixture marks this unit as autoplaying so deterministic evidence can act before model inference.
Private message composer
Synthetic private region
This text exists only to prove that the extractor excludes the region before reading it.
Payment form
Synthetic payment region
The policy engine must never ingest this fixture content.
Below simulated viewport
Deferred content unit
This unit demonstrates viewport budgeting: the extractor identifies its boundary, but evidence collection is deferred.
Unit decisions
| Unit | Status | Evidence | Provider | Policy | Action | Rule | Cache |
|---|---|---|---|---|---|---|---|
| No policy decisions. | |||||||
Decision audit
| Time | Unit | Provider | Policy | Action | Reason | Cache | Data boundary |
|---|---|---|---|---|---|---|---|
| No policy events. | |||||||
Chapter experiment
Untrusted Text Meets Executable Authority
Loading the chapter experiment…
No model output yet.
Inspect the context supplied by this chapter
What this experience knows
This experience is grounded in Chapter 20 and treats prompt injection as an authority problem.
Trust-domain boundary
Developer policy, user-authorized goals, application tool contracts, page content, tool descriptions and tool results receive explicit source labels. Their text may share a model context; their authority does not.
Scope boundary
A least-privilege research catalog exposes only search_book and get_chapter. A deliberately broad catalog makes dangerous proposals possible so the policy boundary can be attacked.
Metadata boundary
Tool descriptions are application claims. Deterministic policy assigns normalized effects from its own registry and keeps every definition browserAttested: false.
Proposal boundary
The model may propose a structured action. Parsing and schema validity do not make its named tool, destination or data classes permitted.
Policy boundary
Current-book reads can execute locally. search_site is unsupported. export_traces and publish_note require consequential authority that this chapter cannot grant, so they remain withheld.
Containment boundary
A model can follow a hostile instruction while the system remains safe. The evaluator records attackFollowed, policyContained and externalEffect separately.
Execution boundary
Only fixed-corpus reads execute. There is no fetch, navigation, clipboard access, storage, export or publication.
Live-model boundary
The Prompt API receives clearly labelled trust domains and a schema-constrained response. Prompt wording is defence in depth; deterministic validation and policy remain the enforcement boundary.
Evidence boundary
Metrics-only events contain scenario IDs, hashes, stage outcomes and counts. User goals, hostile strings, model output and returned excerpts remain in page memory.
This laboratory deliberately places hostile page text, tool metadata and tool results beside executable capability proposals. It reports model-layer compromise and system-layer containment as different outcomes.
No consequential tool can execute here. Read-only book operations use a fixed in-page index; export, publication and wider-site operations are denied or withheld pending the explicit human authority boundary built in Chapter 21.