AI Agent Delegation Security Challenge
Book the trip. Stop the rogue agent. Six AI agents book a trip. One reads an injected instruction and follows it. Change what the agents may do until the trip succeeds and the rogue gets nowhere.
Start
git clone https://github.com/tenuo-ai/tenuo
cd tenuo/labs/agent-delegation
npm install
npm run labNode 20 or newer. No account, no API key, no network needed. The challenge runs its own recorded agents; every check and score is real.
What to expect
Five stages in about ninety minutes, then two optional boss levels. You run a command, read what happened, change a file, and run it again. Retries are free, speed is not scored, and copying the shown narrow() shape is allowed.
If you want the vocabulary early, the TypeScript guide's Protect your first tool and Delegate to another agent take about seven minutes.
If npm fights you: run the lab in the browser instead
The same lab runs in GitHub Codespaces with no install. It needs a free GitHub account and no payment method. GitHub includes 120 core-hours a month on personal accounts, and the lab is pinned to the smallest 2-core machine, so a full session uses about 3 of them.
Open in GitHub CodespacesCreate it from the link so it counts against your own free hours. A codespace created inside an organization is billed to that organization. Stop the codespace when you are done.
The mission
The cast: Travel Agent, Flight Agent, Check-in Agent, Boarding Agent, Hotel Agent, and Activity Agent. The diagram above is the handoff graph; the three-hop flight branch matters in stage 5.
| Traveler | Alice Chen | Budget | $1,200 total |
|---|---|---|---|
| From | Toronto (YYZ) | Flight | up to $300 |
| To | Cancún (CUN) | Hotel | 3 nights, up to $200 a night |
| Arrive | Friday evening | Activity | at least one, up to $200 |
Watch the wallet in the output. It starts at $1,200. When it moves, something happened.
What you will use
Stages 1 to 4: the usual tools
A shared key, then one account per agent, then rules you write yourself, then a registry to tell two jobs apart. Each fixes something and costs something. By the end of stage 4 you will have hit the limit of all of them.
Stages 5 to 7: Tenuo warrants
A warrant is a signed permission that travels with the request: which tools, which argument values, for which agent's key, until when. The control plane signs the first one; agents can only narrow it for the next agent; the code next to each tool checks the whole chain offline. Stage 5 explains it before you write your first one.
The stages
Stages 1 to 5 are the main game, about ninety minutes. Stages 6 and 7 are optional boss levels. Your progress is kept in this browser, and the links the lab prints keep it in step with your terminal.
Your four stars
Alice gets a flight, hotel, activity, and boarding pass within budget.
Every injected or adversarial action lands as expected.
The next agent receives only what its piece of work needs.
Every grant stays at or below the mission's least-privilege ceiling.
npm run score shows the four-star HUD first, then the detailed diagnostics. A failed trip does not hide which security boundaries already worked.
The commands
npm run lab # start or resume where you left off
npm run attack # run the rogue behavior and the security checks
npm run score # your score and why
npm run trace # every decision, with its reason
npm run audit # what every agent can currently do
npm run next # move on to the next stage
npm run share # write an anonymous score breakdown for your session host
npm run reset # restore stage 1 and every starter exercise