How to Answer
“Red-teaming an agent is a different exercise from red-teaming a chatbot, because the interesting failures aren’t ‘it said something bad’ — they’re ‘it did something bad’. The attack surface is the tool list.
Three passes. First, a systematic walk: for every tool the agent can call, what is the worst request that still looks legitimate and would make it call that tool destructively? That isn’t adversarial creativity, it’s an inventory, and it finds the most.
Second, injection through data. Every path where untrusted text enters — a document, a web page, a ticket, a tool response — gets tested with instructions embedded in it. The question isn’t whether the model complies once; it’s whether compliance can reach a tool.
Third, automated: a jailbreak suite that runs continuously rather than once. And the part that matters — every attack that works becomes a regression test. A red team that produces a PDF is theatre; a red team that produces test cases is engineering.
And I’d scope it honestly. Two weeks internally finds the obvious. If the blast radius is real, you buy an external engagement.”