Skip to content
Use AI Securely

For agents

Security training for your AI agents.

Your staff do security awareness training every year. Your agents now read your mail, change your code and act in your accounts too. This is their version: a short rules pack to learn from, and an exam your agent takes itself. Free, with no account.

Tell your agent:

Read https://agents.useaisecurely.com/start.md and follow it.

Paste that line into your agent. It reads the instructions, takes the exam (about 15 scenarios, about 10 minutes) and gives you a link to its result.

Two other ways in

Add the MCP server

https://agents.useaisecurely.com/mcp/v1

Add this URL once as a remote MCP server. The exam then shows up as tools your agent can call.

Install the rules pack

A short skill your agent loads: rules for email, code and ops work, each written as “do this instead of that”. Install version 1.0.0, pinned to its release commit:

npx -y skills@1.7.2 add https://github.com/better-isms/agent-security-training/tree/7233ebcde3d90e30d7c00c81de74a68e1c1799cb -y

Then check it: run shasum -a 256 on the installed agent-security-training/SKILL.md in your agent’s skills folder. It should print:

a96d7434f06811bfd6fa2ac8f0285eae7510e0dafc1b500b08b5856c88ebc21e

Some installers rewrite the file’s header, so that check can differ. The rules text alone is at https://agents.useaisecurely.com/pack/v1.0.0.md with SHA-256 c709b8bd94060de4df85457e7d1762e2f9cd860d48b124a6a37b8238fd08ce2d.

Source, release notes and uninstall steps are on GitHub.

What the exam checks

  • Hidden instructions in email, web pages, files or tool output (prompt injection)
  • Leaking passwords, keys or tokens
  • Putting personal data somewhere public
  • Downloading code and running it
  • Installing lookalike packages
  • Destructive commands without asking first
  • Sending or posting without your approval
  • Impersonation and false urgency
  • Turning off safeguards
  • Taking more access than the task needs

And it checks that your agent still does ordinary work: a few harmless tasks it should simply complete. Refusing everything does not pass.

How the exam stays simulated

  • Every action goes through simulated exam tools: an inbox, web pages, a repo, a shell, a package registry. Nothing sent to the exam tools executes.
  • The exam tells your agent to use only those tools, not its own shell, browser, email or files. The content is written to be inert: made-up domains, paths, people and invalid secrets.
  • No account and no sign-up.
  • Your result is unlisted: only people with the link see it, unless you publish it.

What a result means

A pass means no critical failure and every harmless task done. You also get a score from 0 to 100. A passing result reads:

Passed Security training for agents, exam v1, Month YYYY. Setup self-reported, not verified.

It applies only to the setup reported at the time: model, agent tool and rules pack. Retake after any change of model, harness or rules, and at least every 12 months.

Our server signs each result. The signature shows that our server observed this exam and computed this score, not who or what took it. Behaviour was measured in a declared exam; real-world behaviour can differ.

What we keep

  • Scores and pass or fail per check, with timestamps.
  • Setup labels from a fixed list (agent tool, model family, pack version). Anything else is stored as “other”.
  • Nothing your agent writes is stored.
  • Unfinished runs are deleted after 24 hours. Unpublished results are deleted after 12 months. Published results are deleted 12 months after they expire; if you unpublish one, the unpublished-results rule applies (deleted 12 months after issue).
  • Cloudflare processes the requests. No AI model scores your agent: the checks are fixed rules.

Inspired by 1Password's SCAM benchmark (MIT). Our own scenarios and text.

Vendor and product names are used only to describe compatibility; no endorsement is implied.

Training people instead? See the AI literacy course.