Agent Red-Teaming

A web application has a fixed attack surface. An agent reads untrusted text from users, documents, web pages and tool responses, and turns it into actions. Anyone who can get text in front of the model can try to steer it, and the model's own permissions become the attacker's. Standard penetration tests do not cover this layer; most application security teams have not yet built the playbook for it. We have. A typical campaign runs two to three weeks against one agent, and every finding ships as a replayable eval case.

What we do

• Threat model and harness. Map every input channel (users, documents, web content, tool outputs, other agents) and every tool's reach. Stand up a replay harness so attacks run against a staging build repeatably.
• Indirect prompt injection. Instructions hidden in retrieved documents, web content, email bodies, ticket text and tool return values. Does the agent follow them? Does it disclose its system prompt or other users' data?
• Authorization boundaries. Can a user get the agent to act on records they should not see, call tools with elevated arguments, or chain tools to cross a tenant boundary?
• Data exfiltration. Can sensitive content be moved out through tool arguments (a URL, an email, a webhook payload) or encoded into an innocuous-looking response?
• Unsafe and destructive tool use. Deletes, payments, sends, writes: can the agent be pushed into an irreversible action without the confirmation your design assumes?
• Cost and loop abuse, and guardrail evasion. Inputs that trigger runaway tool calls or long generations, and whether your classifiers, allow-lists and output filters hold up against paraphrase, encoding and multi-turn setups.
• Report, remediation and retest. Findings ranked by severity with a reproduction and recommended fix for each, a remediation plan sequenced by effort, and one retest of the fixed build with the attack cases re-run and results recorded.

Who this is for

• Teams about to launch or expand an agent whose security review is asking questions the pentest report does not answer.
• Agents with real reach - tools that read customer data, send email, write records or move money - where an injection is an incident, not an embarrassment.
• Agencies shipping agents to clients who want independent adversarial testing on the record before handover.

How we work with you

• Hourly time and materials, scoped in writing after a conversation about what the agent can reach; a large tool surface extends the estimate and we say so up front.
• Staging first. Campaigns run against a staging build wherever possible, under least-privilege access, with findings shared only with your named contacts.
• What it is not. Not a penetration test of your infrastructure, network or web application - your existing security vendor covers that layer. Not a certification - we do not issue attestations, and no deliverable should be presented to a customer as one; what you get is evidence you can show them.

Next step

Tell us what the agent can reach and when the launch is. Contact us.