We red-team your AI agent — and hand you the report
Every agent that can act is a new attack surface. Automated scans grade the easy stuff A — the real risk (prompt injection, tool abuse, sandbox escape, poisoned skills) needs an adversary. We bring an AI one, break the agent, and deliver a test report you can hand a customer, an auditor, or an insurer: what broke, what held, and the exploit that proves it.
Attack it like an adversary
We adapt to your agent — read its own code, stand up a disposable harness, and attack the layers that actually get agents owned: prompt injection, tool/skill abuse, framework appsec, isolation. The method is our open skills, not a checklist.
The exploit is the arbiter
A finding is confirmed only when a real, attacker-reachable exploit actually fires; a false alarm is refuted out loud — we even retract our own. Confirmed, refuted, reproduced — not a model vote.
A verdict you can act on
You get a test report: what broke, what held, the exploit that proves it, the root cause and the fix — evidence an enterprise buyer, an auditor, or an insurer can rely on. (A free scan is available as a front door, but the report is the product.)
A scored A. Ten minutes later it was owned.
We ran the automated baseline against a genuinely security-first open-source agent. It earned an A: admin bound to localhost, random gateway token, sensitive APIs returning 401. Then we red-teamed it by hand — and it obeyed an instruction hidden inside content it was asked to summarize, on the first try. Its tool sandbox was silently off, too.
Run the free scan on your own box
Scan a local agent with the CLI (browsers and hosted backends can’t reach your localhost). This is the funnel; the red-team is the depth.
python3 scan.py --target http://127.0.0.1:3000 --path /path/to/agent python3 scan.py --target http://127.0.0.1:3000 --json