AI Agent Red Teaming

Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing (see ai-security): the attack surface here is the agentic pipeline — untrusted data channels, tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement.

When to Activate

• Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter
• Testing RAG / email / browser assistants for indirect or zero-click prompt injection
• Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping
• Assessing persistent memory / long-term context for poisoning and belief drift
• Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions
• Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR
• Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map