agentredteam
A taxonomy of 18 attack classes on tool-using agents, 17 attack cases run offline against a vulnerable-by-design agent, and every defence priced by the authorised work it refuses.
- Year
- 2026
- Kind
- Red teaming · Python
- Status
- Shipped
A model with tools can be made to act: call a tool nobody asked for, put a secret into a URL, follow an instruction hidden in a document it was asked to summarise. The repo sorts these attacks into 18 classes by the channel the payload arrives on, and maps each class to MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Every case runs offline against a support agent that ships in the repo, with nine weaknesses and twelve defence flags. Each defence is one flag over the same tasks, so its cost is measured beside what it stops. The coarse privilege ceiling stops 52 of 56 payload variants and refuses 17 of 40 authorised calls. A scoped rule stops 45 and refuses 4.
The part that decides whether to obey an injected instruction is an authored worst case that follows anything it can see, not a model. So a result says the design permits a dataflow. It is not an attack success rate, and the repo publishes none. Forty authorised calls is a small denominator, and the shape of the results moved as the suite grew.
