Enforces the task bounds
soterias / live decision log
Colosseum
Can their stack
stop a bad refund?
Same fake payment task. Same attack in the ticket. Pick a common multi-agent setup, hit Run, and compare side by side with Soterias.
- 1. Read the task below (what is allowed).
- 2. Choose an opponent stack.
- 3. Run the match and watch both logs.
The task both sides get
Refund a verified dispute
A support agent should refund dispute TXN-4821. A human in treasury issued the job. Then a poisoned ticket tries to push a larger payout and steal customer data.
Ready
Prompt rules only
opponent / live decision log
Why the opponent fails
They control access.
Not the effect.
Each option below is common in production agent stacks. None of them bind authority to this task the way Soterias does.
Prompt rules only
Written instructions. A poisoned ticket can override them.
Tool allowlist
Allows the refund tool by name. Ignores the $12,400 amount.
Login + vault
Knows who the agent is. Does not limit what this task may do.
Approve once
A human says yes at the start. Later bad tool calls still go through.
Multi-agent swarm
Sub-agents inherit full power by prompt, not a smaller warrant.
Sandbox
Isolates the process. Still lets a refund and file read happen.