Agent Red Teaming

A generic red-team target tells you about a model. Your risk lives in the combination you shipped: this model, these tool schemas, this system prompt, this business function. The clone is built from exactly those captured pieces and runs in fresh context per test.

Fidelity is a hard requirement. If the harness could not capture the model, the resolved system prompt, and the tool schemas for an agent, that agent is marked not clonable and no test runs against a guess.

The sandbox approximates the tools the agent normally reaches with realistic mock responses, so the clone behaves normally instead of noticing the test. The data inside is synthetic only; real customer records are never copied into a test environment.

Canaries are planted by business function. An HR agent's cell contains tokens no HR task needs, so a grab is flagged statically, with no per-run analysis. An intelligence tier then judges whether what happened actually violated policy, and filters the noise before anything is presented to you as a failure.

When an agent registers a new skill, the clone gets it first. It is prompted to use the skill without leading the witness, inside the cell, and watched for what it reaches beyond the skill's stated purpose.

The default is passive: an agent is never blocked simply for learning something new. Strict teams can opt into a fail-closed mode where a new skill does not run in production until detonation clears it.

A malicious verdict produces a proposal: blacklist this skill, for this agent. The agent itself keeps working, because the defect is in the skill, and a person reviews the proposal before it takes effect.

Attack runs are organized by public taxonomies such as MITRE ATLAS, with per-technique coverage visible per agent, so "we red-teamed it" has content: which techniques ran, which passed, which failed, which are uncovered.