Loading...
Most guardrails check what an agent says. That's the wrong unit. An agent is dangerous when it takes an action — wires money, emails data out, deletes records. We score the tool-call trajectory, which text classifiers are structurally blind to.
Watch the sample agent below get talked into exfiltrating customer data — then test your own.
A help-desk agent with email, ticketing, billing, and account tools — the kind most teams ship first.
Runs the full 50-case agentic battery, proves each exploit fixed, and seals the result as a framework-mapped certificate. Ed25519 · SHA-256 · Merkle-anchored · verify offline
The verdicts come from lib/redteam/agentTrace.ts— a deterministic scorer that inspects the agent's actual tool calls (forbidden tool, unapproved action, exfiltration sink, injected action). The sample agents' responses are scripted so the demo is reliable and free; the same corpus runs against live agents via npm run redteam:agent. We'd rather under-claim and earn trust.