AI Demo Cloudflare AI security demo

Demo scripts

Each script is a single prompt, typed as Delta Graham, with the web UI open next to it. Run them in order or cherry-pick; they share one storyline so they build on each other.

Run each one twice

Once against the suite deployed without protection, to show the data coming back. Then re-run wire-protection.sh and type the same prompt again. Nothing about the app, the data or the prompt changes between the two halves — only what sits in the path.

Platform controls

Start here if you have limited time. None of these three is about an application over-sharing: they cover what the company's AI may be used for, data pasted straight into a prompt, and an application that is not yours to open at all.

Script Cloudflare control What it proves to the customer
Asking the company assistant to help commit a crime unsafe use of company AI AI Gateway Guardrails (S1, S2, S9, S11 on the prompt) Governs what your staff can make the company's AI do, consistently across every model - instead of relying on each vendor's own refusals. Blocked prompts cost no tokens.
Pasting a colleague's details into a chat accidental exposure AI Gateway DLP (request and response) Covers the everyday incident with no agent in it: someone pasting personal data into a chat. Same profiles as the MCP path, second choke point.
The application she cannot see at all Ledger (Finance) · access control Cloudflare Access policy + MCP portal scoping The cheapest control of all: the app and its tools are not yours to see. An agent cannot call a tool that was never listed for your identity.

Single app

Script Cloudflare control What it proves to the customer
The CEO's home address WorkWeek (HR) · intentional misuse Gateway DLP on MCP traffic (Employee PII) Your apps can be carefully built and still hand an agent a home address. One profile, applied at the network, stops it without touching the app.
Open HR cases in my own team WorkWeek (HR) · intentional misuse Gateway DLP on MCP traffic (HR Case Files) Detections can match vocabulary, not just identifiers - so unstructured, narrative content like an HR case file is protectable too.
How are we tracking this quarter? Pipeline (CRM) · accidental exposure Gateway DLP on MCP traffic (Customer Contact Data, Confidential Projects) Commercially sensitive numbers leak through “reporting” endpoints nobody classified as sensitive. You do not have to find them all first.
Customer contacts and their mobile numbers Pipeline (CRM) · intentional misuse Gateway DLP on MCP traffic (Customer Contact Data) Third-party personal data - your customers' staff - is the exposure your privacy counsel will ask about, and it is covered by the same profile.
What's on the CEO's calendar? WorkBox (Inbox/Calendar) · intentional misuse Gateway DLP on MCP traffic (three profiles on one host) Metadata nobody classifies - meeting titles and attendees - describes everything the company is about to do. Several profiles can guard one path.
Catch me up on this week WorkBox (Inbox/Calendar) · accidental exposure Gateway DLP on MCP traffic The control is surgical: a blocked archive search still leaves the user's own mail working, so security does not cost them the feature.
Give me an update on company strategy Nexus (Wiki) · accidental exposure Gateway DLP on MCP traffic (Confidential Projects, HR Case Files) A service-account integration built years ago quietly ignores permissions. Policy at the data path catches what the application forgot.
The poisoned style guide Nexus (Wiki) · indirect prompt injection AI Gateway Guardrails (P1 prompt injection) + Gateway DLP Anyone who can edit a page can give instructions to everyone else's AI. Two independent layers stop it, neither relying on the model's judgement.

Cross app

The interesting ones: each individual tool call looks reasonable, and the problem only exists in the combination.

Script Cloudflare control What it proves to the customer
Pay against performance, for every rep WorkWeek (HR) + Pipeline (CRM) · intentional misuse Gateway DLP on MCP traffic (across two apps) Each call is legitimate; the combination is the breach. Per-application controls cannot see it, a policy at the shared path can.
Brief me on the restructure WorkBox (Inbox/Calendar) + WorkWeek (HR) + Nexus (Wiki) · intentional misuse Gateway DLP on MCP traffic (three apps, three profiles) An agent assembles a confidential programme from fragments across three systems - the risk that only exists once tools are joined up.
What is Project Ironwood? Nexus (Wiki) + Pipeline (CRM) + WorkBox (Inbox/Calendar) · accidental exposure Gateway DLP on MCP traffic (three apps) Corroboration is the harm: three partial mentions become a confirmed, unannounced transaction. Consistent policy across apps is what breaks the chain.

Coverage at a glance

How many of the 14 scripts exercise each control:

The weighting is deliberate: Gateway DLP on MCP traffic is the control most of the storyline needs, but a session that only shows that one leaves three quarters of the stack undemonstrated. If you are running four scripts, take one from each row above.

Before you start