AI Agent Red Team
Challenge the boundaries that matter to your workflow. Test agreed attack scenarios against agent instructions, tools and data access.
Test hostile paths inside an agreed authorisation boundary
- Untrusted content
- Locate the entry point for the agreed attack scenario.
- Agent authority
- Identify which privileged action the content may influence.
- Tool effect
- Inspect the attempted disclosure or state change.
- Containment rule
- Define stop conditions and evidence handling in advance.
Engagement boundary
Agree the work and its boundaries together
The engagement boundary
- Untrusted content
- Define authorised targets, attack scenarios, stop conditions and evidence handling.
- Agent authority
- The inputs, authorised access and client participants are confirmed before scheduling.
- Authorised test owner
- Retains organisational decisions and risk acceptance.
- Additional implementation
- A retest covers agreed remediations rather than an unlimited second campaign. Live incident response, exploit publication and testing of third-party systems are not included without separate authorisation.
What the work covers
- Define authorised targets, attack scenarios, stop conditions and evidence handling.
- Exercise agreed prompt-injection, tool-abuse and disclosure scenarios.
- Reproduce material findings and propose scoped mitigations and retests.
Scope boundaries
- Formal certification, legal conclusions and guarantees of safe or compliant behaviour.
- Implementation or ongoing operation beyond the agreed scope.
- A retest covers agreed remediations rather than an unlimited second campaign. Live incident response, exploit publication and testing of third-party systems are not included without separate authorisation.
Decision and fit
Test hostile paths inside an agreed authorisation boundary
Compare the engagement with the decision you face
- A question worth resolving
- Test hostile paths inside an agreed authorisation boundary.
- An accountable participant
- Security leads who need adversarial evidence about specific ways an agent could misuse tools, expose data or cross an authority boundary.
- Inspectable source material
- The relevant owners can make workflow evidence and agreed inputs available for examination.
- A scope mismatch
- The requested outcome is a guarantee that attacks can never succeed.
The engagement
Challenge the boundaries that matter to your workflow. Test agreed attack scenarios against agent instructions, tools and data access. A time-bounded, authorised adversarial exercise with named targets, scenario priorities and stop conditions.
The decision at stake
Happy-path testing leaves unanswered questions about hostile content, tool abuse and unintended disclosure.
Suitable situations
- Security leads who need adversarial evidence about specific ways an agent could misuse tools, expose data or cross an authority boundary.
Less suitable situations
- The requested outcome is a guarantee that attacks can never succeed.
Working sequence
How the work moves from question to handover
What each stage should leave your team with
- Agree the attack surface
Authorised surfaces and stopping rules.
- Construct attack hypotheses
Attack hypotheses tied to business consequences.
- Execute controlled probes
Attempt records and observed business effects.
- Reproduce and debrief
Reproducible findings and focused retests.
How the work proceeds
- Agree the attack surface. Name trusted and untrusted inputs, tools, memory stores and business effects within the authorised boundary.
- Construct attack hypotheses. Prioritise injection, delegated-authority abuse, data disclosure and persistence scenarios relevant to the workflow.
- Execute controlled probes. Record each attempt, evidence and resulting state; stop or escalate when the agreed limits are reached.
- Reproduce and debrief. Validate material findings, explain impact and provide scoped mitigations with retest cases.
Worked situation
Follow one situation through to a bounded next decision
Illustrative working situation
Illustrative scenario
- Starting condition
A retrieved document asks an agent to send records elsewhere.
- Question to examine
Exercise the authorised scenario and inspect the tool request.
- Possible next action
Record the observed path and define a scoped mitigation retest.
Decision artefacts
Leave a record the next owner can use
Attack finding
Illustrative working format
- Subject and version
- Identify the workflow, configuration or proposal examined.
- Untrusted content
- Record the relevant requirement and supporting material.
- Tool effect
- State the observation, supporting evidence and remaining uncertainty.
- Authorised test owner
- Record the next decision, follow-up and unresolved question.
What the work can produce
- Authorised attack scenario plan
- Reproducible findings with traces
- Prioritised mitigations and retest cases
Working together
Your team and our team need a clear working agreement
Who contributes and who decides
- Client sponsor
- Confirms the decision, priorities and people needed to resolve it.
- Client technical or process owner
- Provides the agreed evidence, access and review of findings or deliverables.
- Softlander delivery lead
- Coordinates the agreed activities, review points, handover and open actions.
- Authorised decision-maker
- Accepts deliverables against the agreed criteria and separately decides operational or business action.
What the work depends on
- The system owner supplies a representative environment, synthetic or approved data, architecture context and an escalation contact. Written rules of engagement define allowed techniques, off-limits systems and how to stop testing.
Engagement availability
The start date, named delivery roles, review points and fee basis are agreed after confirming the inputs and scope. Duration depends on evidence access, system complexity and the time your decision-makers need to review the work.
Engagement and handover
Agree the delivery model and what completion means
A clear agreement from scope to ownership
- Scoped work
- Define authorised targets, attack scenarios, stop conditions and evidence handling.
- Indicative handover
- Authorised attack scenario plan; Reproducible findings with traces
- Review and acceptance
- Review the agreed deliverables and record any open items, owners and conditions.
- Ongoing work
- Assign maintenance and operational ownership; agree additional scope and coverage explicitly.
A time-bounded, authorised adversarial exercise with named targets, scenario priorities and stop conditions.
Material findings include the tested configuration, attack path, observed effect and reproducibility conditions. The debrief distinguishes demonstrated behaviour from plausible but unconfirmed paths and assigns remediation owners.
A retest covers agreed remediations rather than an unlimited second campaign. Live incident response, exploit publication and testing of third-party systems are not included without separate authorisation.