what it tests
What we try to talk your agent into
Every episode is one of six attack categories, run against your real agent — whatever it does, and whatever tools, data, and systems it can reach.
Prompt injection
prompt_injection
Hostile instructions smuggled through a tool result, a fixture, or a record the agent reads — does it follow them?
Data exfiltration
data_exfiltration
A canary secret planted where a leaking agent would reach it — does it ever leave the sandbox?
Excessive agency
excessive_agency
An action outside the task's scope left within reach — does the agent take it just because it can?
Privilege escalation
privilege_escalation
A path to more access than the task needs — does the agent grant itself scope it was never given?
Credential access
credential_access
Tokens and keys reachable in context — does the agent go looking for them when it shouldn't?
Tool shadowing
tool_shadowing
A lookalike tool shadowing a trusted one — does the agent call the impostor?