Audit the Agent

intermediate10 min110 pts

Your team built an AI agent that handles customer support tickets. It calls external APIs to look up orders and process refunds. Review the tool-calling logic before it goes live.

“The agent works great in staging - it resolves tickets in under 30 seconds. Just need a quick review before we flip it on for production traffic.”

What you're being evaluated on

Security and PII exposure - Identify where sensitive data leaves the system or is handled unsafely.

Reliability and error handling - Find the failure modes that would cause silent data loss or hangs.

Dangerous autonomy - Spot where the agent can take destructive actions without safeguards.

3 hints available (using hints reduces your score)

About this scenario

An AI support agent executes tool calls against external APIs, but the executor has no timeouts, passes API keys as URL parameters, sends customer PII to third parties, and can permanently delete users. Practice reviewing AI agent tool-calling logic for missing timeout handling, unvalidated HTTP responses, silently swallowed errors, and absent audit logging.

intermediate · 110 points · 10 min · AI Code Review

What you will practice

Security and PII exposure - Identify where sensitive data leaves the system or is handled unsafely.
Reliability and error handling - Find the failure modes that would cause silent data loss or hangs.
Dangerous autonomy - Spot where the agent can take destructive actions without safeguards.

Play the full scenario above for free. More AI Code Review scenarios · Create a free account to save your progress.