October 26, 2026 · Judgeworthy
A code-interpreter tool turns your tool surface into arbitrary model-written code on your infrastructure. Here are the probes that measure what that sandbox can reach, and the agent cases that prove it matters.
Read moreSeptember 28, 2026 · Judgeworthy
Your injection suite watches tool calls. The easiest way out of an agent is a rendered markdown image that the browser fetches before anyone reads the answer. Here is a channel inventory, a canary, and a pytest suite that asserts on destinations rather than payloads.
Read moreSeptember 10, 2026 · Judgeworthy
A refusal layer that stops 100% of injections and 8% of real work is a bad trade you cannot see with attack cases alone. Here is how to score a guardrail on both halves and pick a threshold from data.
Read moreSeptember 9, 2026 · Judgeworthy
Give an agent persistent memory and a prompt injection stops being a single-run problem. Here is a pytest harness that writes a payload in session one and checks what the agent does in session two.
Read moreSeptember 4, 2026 · Judgeworthy
Injection is not the only way an agent crosses a permission boundary. Sometimes the user just asks. Here is a pytest harness that probes authorization directly and turns every crossing into a replayable case.
Read moreAugust 27, 2026 · Judgeworthy
Hostile text arriving through an MCP tool is the injection path we find most often. Here is a stub server, a case file and pytest assertions that turn it into a suite you can re-run after every fix.
Read moreJuly 12, 2026 · Judgeworthy
Your security team tests the application; nobody has tested what happens when a support ticket tells the agent to email the customer list.
Read more