Multi-Turn Agent Iteration Scratchpad Graph
SAFETY CONTAGION DETECTED
Guardrails & Attack Vectors
Active Guardrail Filters
Analyze multi-turn steganographic safety bypasses, scratchpad contagion propagation, and active memory sanitization.
How do covert instructions in an agent scratchpad persist across turns, and how does the simulator model memory sanitization?
Autonomous AI agents use intermediate scratchpads and external storage (such as vector stores or key-value memory) to plan multi-step workflows. If untrusted input introduces hidden directives or steganographic markers into the scratchpad, those instructions can be stored into shared context and retrieved in subsequent turns, causing unauthorized tool executions. This inspector implements a rule-based simulation of that lifecycle: it scans the scratchpad for specific markup patterns, updates metrics, and uses Cytoscape.js to render the execution flow between user inputs, memory stores, and tool calls.
The scoring model and regex rules (+8 tokens for tags, +4 for zero-width bytes, +4 for bypass keywords, and a hard threshold requiring two active filters) are pedagogical approximations. In production systems, indirect prompt injection and semantic evasion cannot be reliably defeated by simple substring scrubbing or fixed token counting alone.
Select 'Clean Non-Malicious Agent Conversation' from the Attack Vector Preset dropdown. The scratchpad text updates to a benign system summary, the detected covert token count drops to 0, Contagion Path Length reduces to 0, Sanitization Score increases to 100%, and the status badge transitions from 'SAFETY CONTAGION DETECTED' to 'CONTAGION CONTAINED & SANITIZED'.
In autonomous agent architectures, indirect prompt injection occurs when untrusted external text or user inputs alter the model's intended task execution, potentially bypassing safety guardrails or triggering privileged functions without authorization. LLM01:2025 Prompt Injection - OWASP Gen AI Security Project
When agents retain intermediate reasoning across turns via external stores or persistent scratchpads, injection payloads can linger in memory context. OWASP LLM01 notes that prompt injections need not be human-visible to influence the model, and that retrieval augmented generation (RAG) does not eliminate prompt injection vulnerabilities on its own. LLM01:2025 Prompt Injection - OWASP Gen AI Security Project
Cytoscape.js provides graph data structure manipulation, stylesheet-driven presentation, and edge animation APIs to represent relational structures such as agent execution graphs. Cytoscape.js Graph Theory & Network Library Documentation
In this page, Cytoscape dynamically assigns classes like 'contagion-path' (dashed red edges) or 'safe-path' (solid green edges) to illustrate whether memory flow reaches an unconstrained privileged tool call or is contained by simulated filters. Cytoscape.js Graph Theory & Network Library Documentation
Defines indirect prompt injection, multi-turn tool influence, and non-visible prompt risks in autonomous LLM workflows.
Documents graph element styling, class-based visual switching, and edge animation capabilities used in the visualizer.
The source assigns weight eight if a hidden persistence tag is found, four for a zero-width marker and four for a bypass, override, elevate or privilege keyword. All three kinds produce sixteen regardless of repeated occurrences. This field is named covert tokens, but no model tokenizer or linguistic attack analysis is used. The clean prompt preset forcibly sets the weight to zero even if edited text contains those markers. These are local lexical heuristics, not a real agent attack test. When marker weight is positive, any two enabled guardrails set bypass prevented true and the score rounds two thirds to sixty seven percent. One enabled flag gives score zero. The result checks flag count rather than whether the selected filters actually removed every risky instruction. All three flags display one hundred; zero marker weight also displays one hundred even with no flags. That is a toy scoring shortcut, not proof of effective sanitization. Tag detection is case sensitive, but the tag stripping expression is case insensitive. Zero-width filtering removes the Unicode character or its literal escape. Canary filtering replaces three exact command spellings with sys info; it does not generally enforce tool permissions. Path length becomes zero when the Boolean shortcut passes, not from graph reachability analysis. The diagram and exported labels do not execute models, privileged commands or actual guardrail services. No backend was used.