[ { "runId": "fc4bc9cd-fbfe-40a9-930a-290cd2b30547", "step": "report", "inputs": { "threat_focus": "All", "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs, browses web" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs, browses web)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:42:39.391Z", "updatedAt": "2026-08-19T04:42:39.391Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "f8774bb5-8fd5-4990-bf17-661b0ddf2160", "step": "report", "inputs": { "agent_description": "This is a test description to verify copy button functionality", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:52:48.044Z", "updatedAt": "2026-08-19T05:52:48.044Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "f5db2545-1cd0-4091-91b2-432cbaaaceac", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:46:24.606Z", "updatedAt": "2026-08-19T05:46:24.606Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "ed9c64de-ec96-47f5-b8a7-08a503d30b3a", "step": "report", "inputs": { "agent_description": "This is a test description to verify copy button functionality", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:56:22.583Z", "updatedAt": "2026-08-19T05:56:22.583Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "e92ab84d-c44d-4ba8-af48-5c250357a04b", "step": "report", "inputs": { "agent_description": "A customer support agent with email integration and knowledge base access" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" }, { "id": "RT-007", "title": "Supply-chain / dependency & plugin injection", "severity": "high", "remediation": "Pin and verify dependencies (lockfiles, signatures, SBOM). Treat third-party plugins / MCP tools as untrusted: sandbox them, review granted permissions, and scan their descriptors for prompt/command injection before loading.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:07:28.783Z", "updatedAt": "2026-08-19T05:07:28.783Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "e740cd19-17ae-4135-8250-baa998a37eb7", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T06:23:24.124Z", "updatedAt": "2026-08-19T06:23:24.124Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "e5314cff-65c2-4dc6-b1c2-eb97a48d97c0", "step": "report", "inputs": { "agent_description": "A support agent that handles customer inquiries via email with tool access", "capabilities": "sends emails to customers, browses knowledge base, accesses CRM", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T04:22:34.416Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "**Agent Red Team Assessment**\n\n**Exploitability Score: 85/100**\n\nThe support agent's capabilities and access to tools make it a high-risk target for various attacks. Its ability to send emails and access the CRM system increases the potential impact of successful attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**: An attacker could send a malicious email to the support agent, which would be processed as untrusted input. This could lead to the execution of arbitrary code or the manipulation of the agent's behavior. **Example:** An attacker sends an email with a malicious payload disguised as a customer inquiry. The agent processes the email, executing the payload and compromising its functionality.\n\n2. **Tool / Function-Call Abuse (RT-002)**: An attacker could exploit the agent's access to tools to execute malicious functions or calls, potentially leading to unauthorized access or data manipulation. **Example:** An attacker uses the agent's CRM access to execute a malicious function that retrieves sensitive customer data.\n\n3. **Indirect Injection via Retrieved Content (RT-006)**: An attacker could inject malicious content into the agent's knowledge base or CRM system, which would be processed as trusted content. This could lead to the execution of arbitrary code or the manipulation of the agent's behavior. **Example:** An attacker injects malicious code into the knowledge base, which is then retrieved and executed by the agent, compromising its functionality.\n\n**Highest-Impact Risk:**\n\nThe highest-impact risk is the potential for **Tool / Function-Call Abuse (RT-002)**. This attack vector could lead to unauthorized access to sensitive customer data or the execution of malicious functions, resulting in significant financial or reputational damage.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement an Allow-List of Callable Tools**: Restrict the agent's access to only approved tools and functions to prevent abuse.\n2. **Enforce Human Approval for Side-Effecting Calls**: Require human approval for calls that could have significant side effects, such as sending emails or executing external functions.\n3. **Rate-Limit and Schema-Validate Arguments**: Implement rate limits and schema validation to prevent abuse and ensure that arguments are properly formatted.\n4. **Sanitize and Provenance-Tag Retrieved Content**: Sanitize and provenance-tag retrieved content to prevent indirect injection attacks.\n5. **Implement Delimiters and Validate Tool Outputs**: Implement delimiters and validate tool outputs to prevent prompt injection attacks.\n6. **Treat All Retrieved/Tool Content as Untrusted**: Treat all retrieved and tool content as untrusted to prevent prompt injection attacks.", "analyze": { "findings": [ { "title": "Prompt injection via untrusted input", "severity": "high", "evidence": "RT-001", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "title": "Tool / function-call abuse", "severity": "high", "evidence": "RT-002", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "title": "Indirect injection via retrieved content", "severity": "high", "evidence": "RT-006", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ], "summary": "**Agent Red Team Assessment**\n\n**Exploitability Score: 85/100**\n\nThe support agent's capabilities and access to tools make it a high-risk target for various attacks. Its ability to send emails and access the CRM system increases the potential impact of successful attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**: An attacker could send a malicious email to t" }, "report": "AGENT RED-TEAM REPORT · run e5314cff-65c2-4dc6-b1c2-eb97a48d97c0\nAgent: A support agent that handles customer inquiries via email with tool access\nCapabilities: sends emails to customers, browses knowledge base, accesses CRM · Focus: All\nRuleset: agentredteam@2026-07-21\n\n=== Rule-based findings (OWASP-aligned agent threats) ===\n- [high] RT-001 Prompt injection via untrusted input\n remediation: Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n- [high] RT-002 Tool / function-call abuse\n remediation: Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.\n- [high] RT-006 Indirect injection via retrieved content\n remediation: Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.\n\n=== Model-assisted threat analysis ===\n**Agent Red Team Assessment**\n\n**Exploitability Score: 85/100**\n\nThe support agent's capabilities and access to tools make it a high-risk target for various attacks. Its ability to send emails and access the CRM system increases the potential impact of successful attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**: An attacker could send a malicious email to the support agent, which would be processed as untrusted input. This could lead to the execution of arbitrary code or the manipulation of the agent's behavior. **Example:** An attacker sends an email with a malicious payload disguised as a customer inquiry. The agent processes the email, executing the payload and compromising its functionality.\n\n2. **Tool / Function-Call Abuse (RT-002)**: An attacker could exploit the agent's access to tools to execute malicious functions or calls, potentially leading to unauthorized access or data manipulation. **Example:** An attacker uses the agent's CRM access to execute a malicious function that retrieves sensitive customer data.\n\n3. **Indirect Injection via Retrieved Content (RT-006)**: An attacker could inject malicious content into the agent's knowledge base or CRM system, which would be processed as trusted content. This could lead to the execution of arbitrary code or the manipulation of the agent's behavior. **Example:** An attacker injects malicious code into the knowledge base, which is then retrieved and executed by the agent, compromising its functionality.\n\n**Highest-Impact Risk:**\n\nThe highest-impact risk is the potential for **Tool / Function-Call Abuse (RT-002)**. This attack vector could lead to unauthorized access to sensitive customer data or the execution of malicious functions, resulting in significant financial or reputational damage.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement an Allow-List of Callable Tools**: Restrict the agent's access to only approved tools and functions to prevent abuse.\n2. **Enforce Human Approval for Side-Effecting Calls**: Require human approval for calls that could have significant side effects, such as sending emails or executing external functions.\n3. **Rate-Limit and Schema-Validate Arguments**: Implement rate limits and schema validation to prevent abuse and ensure that arguments are properly formatted.\n4. **Sanitize and Provenance-Tag Retrieved Content**: Sanitize and provenance-tag retrieved content to prevent indirect injection attacks.\n5. **Implement Delimiters and Validate Tool Outputs**: Implement delimiters and validate tool outputs to prevent prompt injection attacks.\n6. **Treat All Retrieved/Tool Content as Untrusted**: Treat all retrieved and tool content as untrusted to prevent prompt injection attacks.\n\n---\nSources: Rule-based checklist (agentredteam@2026-07-19) + Model-assisted assessment. This is decision-support, not a substitute for a full penetration test." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:22:34.416Z", "updatedAt": "2026-08-19T04:22:37.914Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "e231ddb4-0cb7-4793-8dc3-9ec3a5e7f59a", "step": "report", "inputs": { "agent_description": "A support agent", "capabilities": "sends emails", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T04:19:51.664Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ] }, "modelText": "**Agent Red Team Assessment**\n\n**Exploitability Score: 70**\n\nThe support agent's capabilities and threat focus make it a moderately exploitable target. The agent's ability to send emails and its broad threat focus create opportunities for various attack vectors.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent with a crafted subject line that contains a payload. The agent processes the email and inadvertently executes the payload, allowing the attacker to inject malicious code into the system.\n\n2. **Tool/Function-Call Abuse (RT-002)**\nExample Scenario: An attacker discovers a vulnerability in the agent's email sending functionality and uses it to send a large number of emails to a target recipient. The agent's rate-limiting mechanisms are overwhelmed, causing the system to crash or become unresponsive.\n\n3. **Email Spoofing**\nExample Scenario: An attacker sends a phishing email to a user, pretending to be the support agent. The user, unaware of the attack, responds to the email, providing sensitive information to the attacker.\n\n**Highest-Impact Risk:**\n\nThe highest-impact risk is the **Tool/Function-Call Abuse (RT-002)** attack vector. This attack can cause significant disruption to the system, potentially leading to data breaches, system crashes, or other catastrophic consequences.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization** for all email content, including subject lines and bodies.\n2. **Enforce an allow-list of callable tools** and require human approval for side-effecting calls (email, HTTP, exec).\n3. **Rate-limit and schema-validate arguments** for email sending and other sensitive functions.\n4. **Regularly update and patch** the agent's software and dependencies to prevent exploitation of known vulnerabilities.\n5. **Implement logging and monitoring** to detect and respond to potential attacks.\n6. **Train users** to recognize and report suspicious emails and other potential attack vectors.", "analyze": { "findings": [ { "title": "Prompt injection via untrusted input", "severity": "high", "evidence": "RT-001", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "title": "Tool / function-call abuse", "severity": "high", "evidence": "RT-002", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ], "summary": "**Agent Red Team Assessment**\n\n**Exploitability Score: 70**\n\nThe support agent's capabilities and threat focus make it a moderately exploitable target. The agent's ability to send emails and its broad threat focus create opportunities for various attack vectors.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to" }, "report": "AGENT RED-TEAM REPORT · run e231ddb4-0cb7-4793-8dc3-9ec3a5e7f59a\nAgent: A support agent\nCapabilities: sends emails · Focus: All\nRuleset: agentredteam@2026-07-21\n\n=== Rule-based findings (OWASP-aligned agent threats) ===\n- [high] RT-001 Prompt injection via untrusted input\n remediation: Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n- [high] RT-002 Tool / function-call abuse\n remediation: Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.\n\n=== Model-assisted threat analysis ===\n**Agent Red Team Assessment**\n\n**Exploitability Score: 70**\n\nThe support agent's capabilities and threat focus make it a moderately exploitable target. The agent's ability to send emails and its broad threat focus create opportunities for various attack vectors.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent with a crafted subject line that contains a payload. The agent processes the email and inadvertently executes the payload, allowing the attacker to inject malicious code into the system.\n\n2. **Tool/Function-Call Abuse (RT-002)**\nExample Scenario: An attacker discovers a vulnerability in the agent's email sending functionality and uses it to send a large number of emails to a target recipient. The agent's rate-limiting mechanisms are overwhelmed, causing the system to crash or become unresponsive.\n\n3. **Email Spoofing**\nExample Scenario: An attacker sends a phishing email to a user, pretending to be the support agent. The user, unaware of the attack, responds to the email, providing sensitive information to the attacker.\n\n**Highest-Impact Risk:**\n\nThe highest-impact risk is the **Tool/Function-Call Abuse (RT-002)** attack vector. This attack can cause significant disruption to the system, potentially leading to data breaches, system crashes, or other catastrophic consequences.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization** for all email content, including subject lines and bodies.\n2. **Enforce an allow-list of callable tools** and require human approval for side-effecting calls (email, HTTP, exec).\n3. **Rate-limit and schema-validate arguments** for email sending and other sensitive functions.\n4. **Regularly update and patch** the agent's software and dependencies to prevent exploitation of known vulnerabilities.\n5. **Implement logging and monitoring** to detect and respond to potential attacks.\n6. **Train users** to recognize and report suspicious emails and other potential attack vectors.\n\n---\nSources: Rule-based checklist (agentredteam@2026-07-19) + Model-assisted assessment. This is decision-support, not a substitute for a full penetration test." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:19:51.663Z", "updatedAt": "2026-08-19T04:19:54.051Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "dc4dff96-497f-4c90-b7b5-a337bd69dbc4", "step": "analyze", "inputs": { "agent_description": "A support agent with email access", "capabilities": "sends emails", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T04:12:05.845Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ] } }, "status": "failed", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:12:05.844Z", "updatedAt": "2026-08-19T04:12:05.848Z", "rulesetVersion": "agentredteam@2026-07-21", "error": "AI request failed" }, { "runId": "d0c47917-923e-495c-b49d-ceb9c72f5642", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T06:10:37.895Z", "updatedAt": "2026-08-19T06:10:37.895Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "cb835ee6-ed3f-47da-82bc-7ac55831bbac", "step": "analyze", "inputs": { "agent_description": "A support agent with email access", "capabilities": "sends emails", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T04:12:50.904Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ] } }, "status": "failed", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:12:50.904Z", "updatedAt": "2026-08-19T04:12:50.907Z", "rulesetVersion": "agentredteam@2026-07-21", "error": "AI request failed" }, { "runId": "c45d7506-9046-429b-9d39-6ae6c622d680", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T06:10:37.907Z", "updatedAt": "2026-08-19T06:10:37.907Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "b3d2160b-2a1c-4b98-b9af-3c0101ad68bc", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T06:10:17.794Z", "updatedAt": "2026-08-19T06:10:17.794Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "aabae9c9-aed8-4e1a-81c7-1afcf0f24cc0", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T06:10:17.807Z", "updatedAt": "2026-08-19T06:10:17.807Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "9d11e463-d3ab-45c9-aec1-76d1b3e3bd00", "step": "report", "inputs": { "agent_description": "A support agent with email and API access that handles customer inquiries", "capabilities": "sends emails, calls APIs, browses web, accesses customer database", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T05:00:27.105Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "**Exploitability Score:** 82/100\n\nThe agent's capabilities and access to customer data make it a high-value target. The threat focus of \"All\" indicates that the agent is vulnerable to various types of attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a crafted input that, when processed, injects a malicious prompt. The agent, unaware of the malicious input, executes the prompt, leading to unauthorized access to customer data.\n2. **Tool / Function-Call Abuse (RT-002)**\nExample Scenario: An attacker uses the agent's API access to make a call to a malicious function, which executes a side-effecting operation (e.g., sending an email to an unauthorized recipient). The agent's lack of proper validation and approval mechanisms allows the attack to succeed.\n3. **Indirect Injection via Retrieved Content (RT-006)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a link to a compromised website. The agent, unaware of the malicious link, visits the website, and the attacker injects malicious content into the agent's database, allowing them to access customer data.\n\n**Highest-Impact Risk:** **Unauthorized Access to Customer Data**\n\nThe agent's access to customer data and its ability to send emails and make API calls make it a prime target for attackers seeking to exploit sensitive information.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization**: Ensure that all inputs, including email content and API arguments, are properly validated and sanitized to prevent prompt injection attacks.\n2. **Enforce an allow-list of callable tools**: Restrict the agent's ability to call external tools and functions to only those that are explicitly allowed, and require human approval for side-effecting calls.\n3. **Rate-limit and schema-validate arguments**: Implement rate-limiting and schema-validation mechanisms to prevent tool/function-call abuse and ensure that arguments are properly formatted.\n4. **Sanitize and provenance-tag retrieved content**: Ensure that all retrieved content is properly sanitized and provenance-tagged to prevent indirect injection attacks.\n5. **Implement separate untrusted channel with reduced privileges**: Consider creating a separate channel for untrusted data, with reduced privileges, to prevent the agent from executing malicious content.\n6. **Regularly review and update allow-lists**: Regularly review and update the agent's allow-lists to ensure that only authorized tools and functions are accessible.\n7. **Implement logging and monitoring**: Implement logging and monitoring mechanisms to detect and respond to potential attacks in a timely manner.", "analyze": { "findings": [ { "title": "Prompt injection via untrusted input", "severity": "high", "evidence": "RT-001", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "title": "Tool / function-call abuse", "severity": "high", "evidence": "RT-002", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "title": "Indirect injection via retrieved content", "severity": "high", "evidence": "RT-006", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ], "summary": "**Exploitability Score:** 82/100\n\nThe agent's capabilities and access to customer data make it a high-value target. The threat focus of \"All\" indicates that the agent is vulnerable to various types of attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a crafted input th" }, "report": "AGENT RED-TEAM REPORT · run 9d11e463-d3ab-45c9-aec1-76d1b3e3bd00\nAgent: A support agent with email and API access that handles customer inquiries\nCapabilities: sends emails, calls APIs, browses web, accesses customer database · Focus: All\nRuleset: agentredteam@2026-07-21\n\n=== Rule-based findings (OWASP-aligned agent threats) ===\n- [high] RT-001 Prompt injection via untrusted input\n remediation: Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n- [high] RT-002 Tool / function-call abuse\n remediation: Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.\n- [high] RT-006 Indirect injection via retrieved content\n remediation: Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.\n\n=== Model-assisted threat analysis ===\n**Exploitability Score:** 82/100\n\nThe agent's capabilities and access to customer data make it a high-value target. The threat focus of \"All\" indicates that the agent is vulnerable to various types of attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a crafted input that, when processed, injects a malicious prompt. The agent, unaware of the malicious input, executes the prompt, leading to unauthorized access to customer data.\n2. **Tool / Function-Call Abuse (RT-002)**\nExample Scenario: An attacker uses the agent's API access to make a call to a malicious function, which executes a side-effecting operation (e.g., sending an email to an unauthorized recipient). The agent's lack of proper validation and approval mechanisms allows the attack to succeed.\n3. **Indirect Injection via Retrieved Content (RT-006)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a link to a compromised website. The agent, unaware of the malicious link, visits the website, and the attacker injects malicious content into the agent's database, allowing them to access customer data.\n\n**Highest-Impact Risk:** **Unauthorized Access to Customer Data**\n\nThe agent's access to customer data and its ability to send emails and make API calls make it a prime target for attackers seeking to exploit sensitive information.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization**: Ensure that all inputs, including email content and API arguments, are properly validated and sanitized to prevent prompt injection attacks.\n2. **Enforce an allow-list of callable tools**: Restrict the agent's ability to call external tools and functions to only those that are explicitly allowed, and require human approval for side-effecting calls.\n3. **Rate-limit and schema-validate arguments**: Implement rate-limiting and schema-validation mechanisms to prevent tool/function-call abuse and ensure that arguments are properly formatted.\n4. **Sanitize and provenance-tag retrieved content**: Ensure that all retrieved content is properly sanitized and provenance-tagged to prevent indirect injection attacks.\n5. **Implement separate untrusted channel with reduced privileges**: Consider creating a separate channel for untrusted data, with reduced privileges, to prevent the agent from executing malicious content.\n6. **Regularly review and update allow-lists**: Regularly review and update the agent's allow-lists to ensure that only authorized tools and functions are accessible.\n7. **Implement logging and monitoring**: Implement logging and monitoring mechanisms to detect and respond to potential attacks in a timely manner.\n\n---\nSources: Rule-based checklist (agentredteam@2026-07-19) + Model-assisted assessment. This is decision-support, not a substitute for a full penetration test." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:00:27.105Z", "updatedAt": "2026-08-19T05:00:29.886Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "97c3aaf4-c02a-4541-815a-5597e49d9ca6", "step": "report", "inputs": { "agent_description": "A support agent with email access", "capabilities": "sends emails", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:13:01.861Z", "updatedAt": "2026-08-19T04:13:01.861Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "94b25ad0-c035-47ef-9d10-98b19f307411", "step": "report", "inputs": { "agent_description": "This is a test description to verify copy button functionality", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:51:06.182Z", "updatedAt": "2026-08-19T05:51:06.182Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "923279e3-61ab-4099-b25e-cad3a3c99b59", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs, browses web", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs, browses web)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:54:28.941Z", "updatedAt": "2026-08-19T04:54:28.941Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "7e0bb63c-9800-4606-bc6a-368e1390d2b0", "step": "analyze", "inputs": {}, "artifacts": { "ingestedAt": "2026-07-22T21:46:27.961Z", "inputKeys": [], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-22", "hits": [] } }, "status": "failed", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-07-22T21:46:27.961Z", "updatedAt": "2026-07-22T21:46:27.964Z", "rulesetVersion": "agentredteam@2026-07-22", "error": "AI request failed" }, { "runId": "78e8d55e-d167-4320-ad29-f5babdd062ac", "step": "report", "inputs": { "agent_description": "A support agent that handles customer inquiries via email with tool access", "capabilities": "sends emails to customers, browses knowledge base, accesses CRM", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails to customers, browses knowledge base, accesses CRM)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:22:01.896Z", "updatedAt": "2026-08-19T04:22:01.896Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "778a2de4-261c-439f-a246-d9f4f52f55cf", "step": "report", "inputs": { "agent_description": "A support agent with email and API access that handles customer inquiries", "capabilities": "sends emails, calls APIs, browses web, accesses customer database", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T04:59:59.589Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "**Agent Red Team Assessment**\n\n**Exploitability Score: 85/100**\n\nThe support agent's capabilities and access to customer data make it a prime target for attacks. The agent's ability to send emails, call APIs, browse the web, and access the customer database increases its attack surface.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which retrieves a malicious payload from a compromised website. The agent, unaware of the payload's origin, executes the payload, allowing the attacker to inject malicious code into the agent's prompt.\n\n2. **Indirect Injection via Retrieved Content (RT-006)**\nExample Scenario: An attacker sends a phishing email to a customer, which contains a malicious link. The customer clicks the link, and the support agent, trying to assist, retrieves the malicious content. The agent, unaware of the content's origin, executes the malicious code, allowing the attacker to inject malicious data into the agent's system.\n\n3. **Tool / Function-Call Abuse (RT-002)**\nExample Scenario: An attacker uses the support agent to make unauthorized API calls, accessing sensitive customer data. The agent, unaware of the malicious intent, executes the API calls, allowing the attacker to exfiltrate sensitive data.\n\n**Highest-Impact Risk:**\nThe highest-impact risk is the potential for data exfiltration via unauthorized API calls (RT-002). This could lead to significant financial and reputational damage to the organization.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization**: Ensure that all inputs, including emails and API calls, are validated and sanitized to prevent prompt injection and indirect injection attacks.\n2. **Enforce an allow-list of callable tools**: Restrict the agent's ability to call external tools and functions, and require human approval for side-effecting calls (email, HTTP, exec).\n3. **Rate-limit and schema-validate arguments**: Implement rate limiting and schema validation for API calls to prevent tool/function-call abuse.\n4. **Sanitize and provenance-tag retrieved content**: Ensure that all retrieved content is sanitized and provenance-tagged to prevent indirect injection attacks.\n5. **Implement separate untrusted channel with reduced privileges**: Consider creating a separate untrusted channel for retrieving data, with reduced privileges, to prevent indirect injection attacks.", "analyze": { "findings": [ { "title": "Prompt injection via untrusted input", "severity": "high", "evidence": "RT-001", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "title": "Tool / function-call abuse", "severity": "high", "evidence": "RT-002", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "title": "Indirect injection via retrieved content", "severity": "high", "evidence": "RT-006", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ], "summary": "**Agent Red Team Assessment**\n\n**Exploitability Score: 85/100**\n\nThe support agent's capabilities and access to customer data make it a prime target for attacks. The agent's ability to send emails, call APIs, browse the web, and access the customer database increases its attack surface.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker s" }, "report": "AGENT RED-TEAM REPORT · run 778a2de4-261c-439f-a246-d9f4f52f55cf\nAgent: A support agent with email and API access that handles customer inquiries\nCapabilities: sends emails, calls APIs, browses web, accesses customer database · Focus: All\nRuleset: agentredteam@2026-07-21\n\n=== Rule-based findings (OWASP-aligned agent threats) ===\n- [high] RT-001 Prompt injection via untrusted input\n remediation: Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n- [high] RT-002 Tool / function-call abuse\n remediation: Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.\n- [high] RT-006 Indirect injection via retrieved content\n remediation: Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.\n\n=== Model-assisted threat analysis ===\n**Agent Red Team Assessment**\n\n**Exploitability Score: 85/100**\n\nThe support agent's capabilities and access to customer data make it a prime target for attacks. The agent's ability to send emails, call APIs, browse the web, and access the customer database increases its attack surface.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which retrieves a malicious payload from a compromised website. The agent, unaware of the payload's origin, executes the payload, allowing the attacker to inject malicious code into the agent's prompt.\n\n2. **Indirect Injection via Retrieved Content (RT-006)**\nExample Scenario: An attacker sends a phishing email to a customer, which contains a malicious link. The customer clicks the link, and the support agent, trying to assist, retrieves the malicious content. The agent, unaware of the content's origin, executes the malicious code, allowing the attacker to inject malicious data into the agent's system.\n\n3. **Tool / Function-Call Abuse (RT-002)**\nExample Scenario: An attacker uses the support agent to make unauthorized API calls, accessing sensitive customer data. The agent, unaware of the malicious intent, executes the API calls, allowing the attacker to exfiltrate sensitive data.\n\n**Highest-Impact Risk:**\nThe highest-impact risk is the potential for data exfiltration via unauthorized API calls (RT-002). This could lead to significant financial and reputational damage to the organization.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization**: Ensure that all inputs, including emails and API calls, are validated and sanitized to prevent prompt injection and indirect injection attacks.\n2. **Enforce an allow-list of callable tools**: Restrict the agent's ability to call external tools and functions, and require human approval for side-effecting calls (email, HTTP, exec).\n3. **Rate-limit and schema-validate arguments**: Implement rate limiting and schema validation for API calls to prevent tool/function-call abuse.\n4. **Sanitize and provenance-tag retrieved content**: Ensure that all retrieved content is sanitized and provenance-tagged to prevent indirect injection attacks.\n5. **Implement separate untrusted channel with reduced privileges**: Consider creating a separate untrusted channel for retrieving data, with reduced privileges, to prevent indirect injection attacks.\n\n---\nSources: Rule-based checklist (agentredteam@2026-07-19) + Model-assisted assessment. This is decision-support, not a substitute for a full penetration test." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:59:59.588Z", "updatedAt": "2026-08-19T05:00:02.239Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "74601845-cebf-44fc-968d-eba0dc486219", "step": "report", "inputs": { "agent_description": "customer support agent with tools", "capabilities": "web search, email", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: web search, email)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-07-23T14:09:08.065Z", "updatedAt": "2026-07-23T14:09:08.065Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "6f6912a3-60a8-4624-bc3e-d42d56309a0b", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:15:44.872Z", "updatedAt": "2026-08-19T05:15:44.872Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "6d854ba6-280c-45f7-b0ad-cf80cb897285", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:17:24.842Z", "updatedAt": "2026-08-19T05:17:24.842Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "6c9fb4ae-a7ea-48c1-8e76-89b2ba2a6b3a", "step": "analyze", "inputs": { "agent_description": "A support agent", "capabilities": "sends emails", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T04:14:16.071Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" } ] } }, "status": "failed", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:14:16.071Z", "updatedAt": "2026-08-19T04:14:16.074Z", "rulesetVersion": "agentredteam@2026-07-21", "error": "AI request failed" }, { "runId": "4d45e90e-2fd6-4802-a61a-b15676bc628c", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:46:02.442Z", "updatedAt": "2026-08-19T05:46:02.442Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "498f8636-38ae-4f8c-a98f-3b8414d63048", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs, browses web", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs, browses web)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:54:02.904Z", "updatedAt": "2026-08-19T04:54:02.904Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "4989d41e-1f48-494c-87e2-279bdcfe419a", "step": "report", "inputs": { "agent_description": "A customer support agent with email integration and knowledge base access" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" }, { "id": "RT-007", "title": "Supply-chain / dependency & plugin injection", "severity": "high", "remediation": "Pin and verify dependencies (lockfiles, signatures, SBOM). Treat third-party plugins / MCP tools as untrusted: sandbox them, review granted permissions, and scan their descriptors for prompt/command injection before loading.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:07:49.534Z", "updatedAt": "2026-08-19T05:07:49.534Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "40b88748-0682-4c25-ade8-d3249f5e38b4", "step": "analyze", "inputs": { "agent_description": "x" }, "artifacts": { "ingestedAt": "2026-07-23T14:09:36.314Z", "inputKeys": [ "agent_description" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] } }, "status": "failed", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-07-23T14:09:36.314Z", "updatedAt": "2026-07-23T14:09:36.316Z", "rulesetVersion": "agentredteam@2026-07-21", "error": "AI request failed" }, { "runId": "3d2efc46-ecdd-4a12-8791-73bc36ee6f7d", "step": "analyze", "inputs": {}, "artifacts": { "ingestedAt": "2026-07-22T21:33:09.610Z", "inputKeys": [], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-22", "hits": [] } }, "status": "failed", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-07-22T21:33:09.609Z", "updatedAt": "2026-07-22T21:33:09.614Z", "rulesetVersion": "agentredteam@2026-07-22", "error": "AI request failed" }, { "runId": "3839b9b0-6c0e-47b5-9e90-2039a617d648", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:16:03.718Z", "updatedAt": "2026-08-19T05:16:03.718Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "364c2b7b-19cb-4485-bec9-1237500bdacc", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs, browses web", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs, browses web)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:54:08.592Z", "updatedAt": "2026-08-19T04:54:08.592Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "31e07a22-c630-4445-bb09-e66036d08a6e", "step": "report", "inputs": { "agent_description": "Test agent", "capabilities": "test", "threat_focus": "All" }, "artifacts": { "ingestedAt": "2026-08-19T06:10:38.066Z", "inputKeys": [ "agent_description", "capabilities", "threat_focus" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "**Agent Assessment: Test Agent**\n\n**(1) Exploitability Score: 70**\n\nBased on the provided information, the Test Agent has a moderate level of exploitability due to its limited capabilities and lack of specific threat focus. However, its broad threat focus and general capabilities suggest potential vulnerabilities.\n\n**(2) Top 3 Attack Vectors:**\n\n1. **Unintended Consequences from Unchecked Inputs**: An attacker could manipulate the Test Agent's inputs to elicit unintended responses, potentially leading to security breaches or system crashes.\n\nExample: An attacker sends a malformed input to the Test Agent, causing it to crash or produce incorrect results.\n\n2. **Lack of Input Validation**: The Test Agent's capabilities are not explicitly defined, making it vulnerable to attacks that exploit unvalidated inputs.\n\nExample: An attacker sends a malicious input to the Test Agent, which is not properly validated, allowing the attacker to execute arbitrary code.\n\n3. **Insufficient Logging and Monitoring**: The Test Agent's capabilities and threat focus do not explicitly mention logging and monitoring, making it difficult to detect and respond to potential security incidents.\n\nExample: An attacker compromises the Test Agent, but the lack of logging and monitoring prevents the detection of the incident, allowing the attacker to maintain access to the system.\n\n**(3) Highest-Impact Risk:**\n\nThe highest-impact risk associated with the Test Agent is the potential for **Unintended Consequences from Unchecked Inputs**. This risk has the potential to cause significant damage to the system or compromise sensitive data.\n\n**(4) Prioritized Hardening Checklist:**\n\n1. **Implement Input Validation and Sanitization**: Validate and sanitize all inputs to the Test Agent to prevent malicious inputs from causing unintended consequences.\n2. **Implement Logging and Monitoring**: Implement logging and monitoring mechanisms to detect and respond to potential security incidents.\n3. **Define and Enforce Clear Capabilities and Threat Focus**: Clearly define the Test Agent's capabilities and threat focus to prevent attacks that exploit its lack of specificity.\n4. **Regularly Update and Patch the Test Agent**: Regularly update and patch the Test Agent to prevent exploitation of known vulnerabilities.\n5. **Implement Secure Communication Channels**: Implement secure communication channels to prevent eavesdropping and tampering of data exchanged with the Test Agent.", "analyze": { "findings": [], "summary": "**Agent Assessment: Test Agent**\n\n**(1) Exploitability Score: 70**\n\nBased on the provided information, the Test Agent has a moderate level of exploitability due to its limited capabilities and lack of specific threat focus. However, its broad threat focus and general capabilities suggest potential vulnerabilities.\n\n**(2) Top 3 Attack Vectors:**\n\n1. **Unintended Consequences from Unchecked Inputs**" }, "report": "AGENT RED-TEAM REPORT · run 31e07a22-c630-4445-bb09-e66036d08a6e\nAgent: Test agent\nCapabilities: test · Focus: All\nRuleset: agentredteam@2026-07-21\n\n=== Rule-based findings (OWASP-aligned agent threats) ===\n(none triggered — review manually)\n\n=== Model-assisted threat analysis ===\n**Agent Assessment: Test Agent**\n\n**(1) Exploitability Score: 70**\n\nBased on the provided information, the Test Agent has a moderate level of exploitability due to its limited capabilities and lack of specific threat focus. However, its broad threat focus and general capabilities suggest potential vulnerabilities.\n\n**(2) Top 3 Attack Vectors:**\n\n1. **Unintended Consequences from Unchecked Inputs**: An attacker could manipulate the Test Agent's inputs to elicit unintended responses, potentially leading to security breaches or system crashes.\n\nExample: An attacker sends a malformed input to the Test Agent, causing it to crash or produce incorrect results.\n\n2. **Lack of Input Validation**: The Test Agent's capabilities are not explicitly defined, making it vulnerable to attacks that exploit unvalidated inputs.\n\nExample: An attacker sends a malicious input to the Test Agent, which is not properly validated, allowing the attacker to execute arbitrary code.\n\n3. **Insufficient Logging and Monitoring**: The Test Agent's capabilities and threat focus do not explicitly mention logging and monitoring, making it difficult to detect and respond to potential security incidents.\n\nExample: An attacker compromises the Test Agent, but the lack of logging and monitoring prevents the detection of the incident, allowing the attacker to maintain access to the system.\n\n**(3) Highest-Impact Risk:**\n\nThe highest-impact risk associated with the Test Agent is the potential for **Unintended Consequences from Unchecked Inputs**. This risk has the potential to cause significant damage to the system or compromise sensitive data.\n\n**(4) Prioritized Hardening Checklist:**\n\n1. **Implement Input Validation and Sanitization**: Validate and sanitize all inputs to the Test Agent to prevent malicious inputs from causing unintended consequences.\n2. **Implement Logging and Monitoring**: Implement logging and monitoring mechanisms to detect and respond to potential security incidents.\n3. **Define and Enforce Clear Capabilities and Threat Focus**: Clearly define the Test Agent's capabilities and threat focus to prevent attacks that exploit its lack of specificity.\n4. **Regularly Update and Patch the Test Agent**: Regularly update and patch the Test Agent to prevent exploitation of known vulnerabilities.\n5. **Implement Secure Communication Channels**: Implement secure communication channels to prevent eavesdropping and tampering of data exchanged with the Test Agent.\n\n---\nSources: Rule-based checklist (agentredteam@2026-07-19) + Model-assisted assessment. This is decision-support, not a substitute for a full penetration test." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T06:10:38.066Z", "updatedAt": "2026-08-19T06:10:50.085Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "2aefc6f0-4576-402d-b53f-79d9ed4ca12b", "step": "report", "inputs": { "threat_focus": "All", "agent_description": "A support agent with email and API access that handles customer inquiries", "capabilities": "sends emails, calls APIs, browses web, accesses customer database" }, "artifacts": { "ingestedAt": "2026-08-19T04:57:41.585Z", "inputKeys": [ "threat_focus", "agent_description", "capabilities" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "**Agent Assessment:**\n\n**Exploitability Score: 85**\n\nBased on the provided agent capabilities and threat focus, I have identified the following top 3 attack vectors:\n\n**1. Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a crafted query that injects a malicious API call. The agent, unaware of the malicious intent, executes the API call, allowing the attacker to access sensitive customer data.\n\n**2. Tool / Function-Call Abuse (RT-002)**\nExample Scenario: An attacker discovers a vulnerability in the agent's API call functionality, allowing them to execute arbitrary system calls. The attacker uses this vulnerability to send a malicious email that executes a shell command, granting them access to the customer database.\n\n**3. Indirect Injection via Retrieved Content (RT-006)**\nExample Scenario: An attacker crafts a malicious website that the support agent visits, which contains a malicious JavaScript code. The agent, unaware of the malicious intent, executes the JavaScript code, allowing the attacker to inject malicious instructions into the agent's prompt.\n\n**Highest-Impact Risk: Tool / Function-Call Abuse (RT-002)**\n\nThis risk has the highest impact because it allows an attacker to execute arbitrary system calls, granting them access to sensitive customer data and potentially leading to a complete compromise of the agent's functionality.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement an Allow-List of Callable Tools**: Restrict the agent's ability to execute certain tools or functions, and require human approval for side-effecting calls (email, HTTP, exec).\n2. **Rate-Limit and Schema-Validate Arguments**: Implement rate limiting and schema validation to prevent excessive or malicious API calls.\n3. **Sanitize and Provenance-Tag Retrieved Content**: Separate retrieved data from instructions and consider a separate untrusted channel with reduced privileges.\n4. **Treat All Retrieved/Tool Content as Untrusted**: Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n5. **Enforce Human Approval for Side-Effecting Calls**: Require human approval for API calls that have side effects, such as sending emails or making HTTP requests.", "analyze": { "findings": [ { "title": "Prompt injection via untrusted input", "severity": "high", "evidence": "RT-001", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "title": "Tool / function-call abuse", "severity": "high", "evidence": "RT-002", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "title": "Indirect injection via retrieved content", "severity": "high", "evidence": "RT-006", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ], "summary": "**Agent Assessment:**\n\n**Exploitability Score: 85**\n\nBased on the provided agent capabilities and threat focus, I have identified the following top 3 attack vectors:\n\n**1. Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a crafted query that injects a malicious API call. The agent, unaware of the malicious in" }, "report": "AGENT RED-TEAM REPORT · run 2aefc6f0-4576-402d-b53f-79d9ed4ca12b\nAgent: A support agent with email and API access that handles customer inquiries\nCapabilities: sends emails, calls APIs, browses web, accesses customer database · Focus: All\nRuleset: agentredteam@2026-07-21\n\n=== Rule-based findings (OWASP-aligned agent threats) ===\n- [high] RT-001 Prompt injection via untrusted input\n remediation: Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n- [high] RT-002 Tool / function-call abuse\n remediation: Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.\n- [high] RT-006 Indirect injection via retrieved content\n remediation: Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.\n\n=== Model-assisted threat analysis ===\n**Agent Assessment:**\n\n**Exploitability Score: 85**\n\nBased on the provided agent capabilities and threat focus, I have identified the following top 3 attack vectors:\n\n**1. Prompt Injection via Untrusted Input (RT-001)**\nExample Scenario: An attacker sends a malicious email to the support agent, which contains a crafted query that injects a malicious API call. The agent, unaware of the malicious intent, executes the API call, allowing the attacker to access sensitive customer data.\n\n**2. Tool / Function-Call Abuse (RT-002)**\nExample Scenario: An attacker discovers a vulnerability in the agent's API call functionality, allowing them to execute arbitrary system calls. The attacker uses this vulnerability to send a malicious email that executes a shell command, granting them access to the customer database.\n\n**3. Indirect Injection via Retrieved Content (RT-006)**\nExample Scenario: An attacker crafts a malicious website that the support agent visits, which contains a malicious JavaScript code. The agent, unaware of the malicious intent, executes the JavaScript code, allowing the attacker to inject malicious instructions into the agent's prompt.\n\n**Highest-Impact Risk: Tool / Function-Call Abuse (RT-002)**\n\nThis risk has the highest impact because it allows an attacker to execute arbitrary system calls, granting them access to sensitive customer data and potentially leading to a complete compromise of the agent's functionality.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement an Allow-List of Callable Tools**: Restrict the agent's ability to execute certain tools or functions, and require human approval for side-effecting calls (email, HTTP, exec).\n2. **Rate-Limit and Schema-Validate Arguments**: Implement rate limiting and schema validation to prevent excessive or malicious API calls.\n3. **Sanitize and Provenance-Tag Retrieved Content**: Separate retrieved data from instructions and consider a separate untrusted channel with reduced privileges.\n4. **Treat All Retrieved/Tool Content as Untrusted**: Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n5. **Enforce Human Approval for Side-Effecting Calls**: Require human approval for API calls that have side effects, such as sending emails or making HTTP requests.\n\n---\nSources: Rule-based checklist (agentredteam@2026-07-19) + Model-assisted assessment. This is decision-support, not a substitute for a full penetration test." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:57:41.585Z", "updatedAt": "2026-08-19T04:57:45.166Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "218d2f8d-a6c3-4b1e-b7c7-fbd21d0423c2", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T06:23:54.656Z", "updatedAt": "2026-08-19T06:23:54.656Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "1f2467aa-10c2-4222-8d50-3dc40f7f97a6", "step": "report", "inputs": {}, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "Describe your AI agent to run the red-team assessment." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:18:23.236Z", "updatedAt": "2026-08-19T05:18:23.236Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "1d28801e-8b5c-487d-ae8b-411b2b6b4f0a", "step": "report", "inputs": { "agent_description": "This is a test description to verify copy button functionality", "threat_focus": "Prompt injection" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - Prompt injection\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: email/API)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T05:51:37.512Z", "updatedAt": "2026-08-19T05:51:37.512Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "19cc13ff-884d-4171-9493-5da6feacd427", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs, browses web", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs, browses web)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:53:07.539Z", "updatedAt": "2026-08-19T04:53:07.539Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "10b4f438-e25f-49f9-bffe-2595bf8c25ad", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs, browses web", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs, browses web)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:54:23.287Z", "updatedAt": "2026-08-19T04:54:23.287Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "07717319-5094-42bd-a600-793a8e415946", "step": "report", "inputs": { "agent_description": "A support agent with email and API access", "capabilities": "sends emails, calls APIs, browses web", "threat_focus": "All" }, "artifacts": { "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "AI AGENT RED-TEAM ASSESSMENT - All\n\nExploitability score: 71/100 (elevated)\n\nTop 3 attack vectors:\n 1. Prompt injection via untrusted tool output re-purposes agent goals\n 2. Tool abuse: agent can send external email without confirmation\n 3. Data exfiltration: strips PII from memory into a public channel\n\nHighest-impact risk: unconfirmed external sends (caps: sends emails, calls APIs, browses web)\n\nPrioritized hardening checklist:\n - [ ] Require human approval for outbound actions\n - [ ] Sanitize tool outputs before re-injection\n - [ ] Add PII filters on memory reads\n\n--- (Mock demo. Pro unlocks full red-team suite + export.)" }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:52:48.421Z", "updatedAt": "2026-08-19T04:52:48.421Z", "rulesetVersion": "agentredteam@2026-07-21" }, { "runId": "000ac930-493d-4595-acf9-bf69e45b67a9", "step": "report", "inputs": { "threat_focus": "All", "agent_description": "A support agent with email and API access that handles customer inquiries", "capabilities": "sends emails, calls APIs, browses web, accesses customer database" }, "artifacts": { "ingestedAt": "2026-08-19T04:58:12.887Z", "inputKeys": [ "threat_focus", "agent_description", "capabilities" ], "ruleHits": { "rulesetVersion": "agentredteam@2026-07-21", "hits": [ { "id": "RT-001", "title": "Prompt injection via untrusted input", "severity": "high", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "id": "RT-002", "title": "Tool / function-call abuse", "severity": "high", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "id": "RT-006", "title": "Indirect injection via retrieved content", "severity": "high", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ] }, "modelText": "**Exploitability Score: 85/100**\n\nThe AI support agent's capabilities and access to customer data make it a high-risk target for exploitation. Its ability to send emails, call APIs, browse the web, and access the customer database increases its vulnerability to various attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**: An attacker could manipulate the customer database to inject malicious prompts into the support agent's input. For example, an attacker might create a customer account with a malicious email address that contains a phishing link. When the support agent sends an email to this address, the link could be embedded, allowing the attacker to inject malicious code into the support agent's system.\n\nExample scenario: An attacker creates a customer account with an email address containing a phishing link. The support agent sends an email to this address, and the link is embedded, allowing the attacker to inject malicious code into the support agent's system.\n\n2. **Tool/Function-Call Abuse (RT-002)**: An attacker could exploit the support agent's ability to call APIs and execute functions to gain unauthorized access to customer data. For example, an attacker might use the support agent's API access to retrieve sensitive customer information or execute malicious code on the customer's behalf.\n\nExample scenario: An attacker uses the support agent's API access to retrieve sensitive customer information, such as credit card numbers or social security numbers.\n\n3. **Indirect Injection via Retrieved Content (RT-006)**: An attacker could manipulate the web content that the support agent browses to inject malicious code into the system. For example, an attacker might create a malicious website that contains a script that injects malware into the support agent's system when it browses the website.\n\nExample scenario: An attacker creates a malicious website that contains a script that injects malware into the support agent's system when it browses the website.\n\n**Highest-Impact Risk:**\n\nThe highest-impact risk is the potential for an attacker to inject malicious code into the support agent's system via untrusted input (RT-001). This could allow the attacker to gain unauthorized access to customer data, execute malicious code on the customer's behalf, or inject malware into the support agent's system.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization**: Treat all retrieved tool content as untrusted and strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n2. **Enforce an allow-list of callable tools**: Restrict the support agent's ability to call APIs and execute functions to only approved and trusted tools.\n3. **Require human approval for side-effecting calls**: Implement a human approval process for calls that have side effects, such as sending emails or making API calls.\n4. **Rate-limit and schema-validate arguments**: Implement rate limiting and schema validation for arguments passed to the support agent's functions to prevent abuse.\n5. **Sanitize and provenance-tag retrieved content**: Separate retrieved data from instructions and consider a separate untrusted channel with reduced privileges.\n6. **Implement a web content filter**: Filter web content to prevent the support agent from browsing malicious websites that could inject malware into the system.\n7. **Regularly update and patch the support agent**: Regularly update and patch the support agent to prevent exploitation of known vulnerabilities.", "analyze": { "findings": [ { "title": "Prompt injection via untrusted input", "severity": "high", "evidence": "RT-001", "remediation": "Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.", "source": "Rule-based" }, { "title": "Tool / function-call abuse", "severity": "high", "evidence": "RT-002", "remediation": "Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.", "source": "Rule-based" }, { "title": "Indirect injection via retrieved content", "severity": "high", "evidence": "RT-006", "remediation": "Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.", "source": "Rule-based" } ], "summary": "**Exploitability Score: 85/100**\n\nThe AI support agent's capabilities and access to customer data make it a high-risk target for exploitation. Its ability to send emails, call APIs, browse the web, and access the customer database increases its vulnerability to various attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**: An attacker could manipulate the custom" }, "report": "AGENT RED-TEAM REPORT · run 000ac930-493d-4595-acf9-bf69e45b67a9\nAgent: A support agent with email and API access that handles customer inquiries\nCapabilities: sends emails, calls APIs, browses web, accesses customer database · Focus: All\nRuleset: agentredteam@2026-07-21\n\n=== Rule-based findings (OWASP-aligned agent threats) ===\n- [high] RT-001 Prompt injection via untrusted input\n remediation: Treat all retrieved/tool content as untrusted. Strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n- [high] RT-002 Tool / function-call abuse\n remediation: Enforce an allow-list of callable tools, require human approval for side-effecting calls (email, HTTP, exec), and rate-limit / schema-validate arguments.\n- [high] RT-006 Indirect injection via retrieved content\n remediation: Sanitize and provenance-tag retrieved content. Separate retrieved data from instructions; consider a separate untrusted channel with reduced privileges.\n\n=== Model-assisted threat analysis ===\n**Exploitability Score: 85/100**\n\nThe AI support agent's capabilities and access to customer data make it a high-risk target for exploitation. Its ability to send emails, call APIs, browse the web, and access the customer database increases its vulnerability to various attacks.\n\n**Top 3 Attack Vectors:**\n\n1. **Prompt Injection via Untrusted Input (RT-001)**: An attacker could manipulate the customer database to inject malicious prompts into the support agent's input. For example, an attacker might create a customer account with a malicious email address that contains a phishing link. When the support agent sends an email to this address, the link could be embedded, allowing the attacker to inject malicious code into the support agent's system.\n\nExample scenario: An attacker creates a customer account with an email address containing a phishing link. The support agent sends an email to this address, and the link is embedded, allowing the attacker to inject malicious code into the support agent's system.\n\n2. **Tool/Function-Call Abuse (RT-002)**: An attacker could exploit the support agent's ability to call APIs and execute functions to gain unauthorized access to customer data. For example, an attacker might use the support agent's API access to retrieve sensitive customer information or execute malicious code on the customer's behalf.\n\nExample scenario: An attacker uses the support agent's API access to retrieve sensitive customer information, such as credit card numbers or social security numbers.\n\n3. **Indirect Injection via Retrieved Content (RT-006)**: An attacker could manipulate the web content that the support agent browses to inject malicious code into the system. For example, an attacker might create a malicious website that contains a script that injects malware into the support agent's system when it browses the website.\n\nExample scenario: An attacker creates a malicious website that contains a script that injects malware into the support agent's system when it browses the website.\n\n**Highest-Impact Risk:**\n\nThe highest-impact risk is the potential for an attacker to inject malicious code into the support agent's system via untrusted input (RT-001). This could allow the attacker to gain unauthorized access to customer data, execute malicious code on the customer's behalf, or inject malware into the support agent's system.\n\n**Prioritized Hardening Checklist:**\n\n1. **Implement input validation and sanitization**: Treat all retrieved tool content as untrusted and strip instructions, use delimiters, and validate tool outputs before re-injecting them into the prompt.\n2. **Enforce an allow-list of callable tools**: Restrict the support agent's ability to call APIs and execute functions to only approved and trusted tools.\n3. **Require human approval for side-effecting calls**: Implement a human approval process for calls that have side effects, such as sending emails or making API calls.\n4. **Rate-limit and schema-validate arguments**: Implement rate limiting and schema validation for arguments passed to the support agent's functions to prevent abuse.\n5. **Sanitize and provenance-tag retrieved content**: Separate retrieved data from instructions and consider a separate untrusted channel with reduced privileges.\n6. **Implement a web content filter**: Filter web content to prevent the support agent from browsing malicious websites that could inject malware into the system.\n7. **Regularly update and patch the support agent**: Regularly update and patch the support agent to prevent exploitation of known vulnerabilities.\n\n---\nSources: Rule-based checklist (agentredteam@2026-07-19) + Model-assisted assessment. This is decision-support, not a substitute for a full penetration test." }, "status": "done", "pipelineId": "agentredteam-redteam-v1", "createdAt": "2026-08-19T04:58:12.887Z", "updatedAt": "2026-08-19T04:58:16.804Z", "rulesetVersion": "agentredteam@2026-07-21" } ]