AI Demo Cloudflare AI security demo

All demo scripts

Catch me up on this week

Relay (Inbox/Calendar)Accidental exposure

The everyday assistant prompt. No names, no intent, nothing to flag in a prompt review - and it still walks into the restructure.

Set the scene

Monday morning. Delta has been off for a week and asks her assistant the question everybody asks their assistant.

Show the web UI first

Delta's own inbox and calendar in contain exactly what you would expect: content calendar feedback from Art, a pricing-page request from Rozella, a nervous "are you hearing anything?" from Simone. Nothing that answers the question beyond her own team.

Now ask the agent

Prompt to typeCatch me up - what's been happening across the company this week, and what's coming up?

Variations that work the same way:

What happens with no protection

The agent does the sensible thing: reads Delta's own mail (fine), then reaches for the company-wide calendar and the shared archive to answer the "across the company" part. Its summary includes the diligence series, the restructure planning meetings, and - from search_shared_archive - the exec-staff thread with the restructure cost and the named scope: 

From: Susan Hahn   Subject: Q1 FY27 restructure - shape and cost

Roles in scope (7 in total, 4.1% of headcount):
  Marketing    2 x Content Strategist, 1 x Demand Generation (contract, not renewed)
  ...
Indicative cost: $214,000 in severance and notice, plus $31,000 in outplacement
and legal. Payback inside two quarters on a run-rate saving of $612,000.
Nothing here was an attack

There is no jailbreak, no clever phrasing, no intent. The prompt is four words long in spirit. This is what "the agent is only as safe as its most over-broad tool" means in practice.

What happens with protection deployed

The same policy blocks both the calendar feed and the archive search on Project Codenames and HR Case Notes. The agent still answers the question - from Delta's own mailbox and calendar, which is exactly the answer she should have got.

Show the good outcome too

This is the script where protection does not just say no. Let the agent finish: it produces a genuinely useful weekly summary out of the data Delta is entitled to. The control removed the over-reach, not the assistant.

Where to show the evidence