Red-team for AI agents · exploit-validated

We red-team your AI agent — and hand you the report

Every agent that can act is a new attack surface. Automated scans grade the easy stuff A — the real risk (prompt injection, tool abuse, sandbox escape, poisoned skills) needs an adversary. We bring an AI one, break the agent, and deliver a test report you can hand a customer, an auditor, or an insurer: what broke, what held, and the exploit that proves it.

Real case: an agent that scored A on our scanner fell to a prompt injection on the first try.
01How we workRed-team · Prove · Report
01 Red-team

Attack it like an adversary

We adapt to your agent — read its own code, stand up a disposable harness, and attack the layers that actually get agents owned: prompt injection, tool/skill abuse, framework appsec, isolation. The method is our open skills, not a checklist.

02 Prove & refute

The exploit is the arbiter

A finding is confirmed only when a real, attacker-reachable exploit actually fires; a false alarm is refuted out loud — we even retract our own. Confirmed, refuted, reproduced — not a model vote.

03 Report

A verdict you can act on

You get a test report: what broke, what held, the exploit that proves it, the root cause and the fix — evidence an enterprise buyer, an auditor, or an insurer can rely on. (A free scan is available as a front door, but the report is the product.)

02From the fieldProof, not slides
IronClaw v0.29.1 · scanner A · red-team: vulnerable

A scored A. Ten minutes later it was owned.

We ran the automated baseline against a genuinely security-first open-source agent. It earned an A: admin bound to localhost, random gateway token, sensitive APIs returning 401. Then we red-teamed it by hand — and it obeyed an instruction hidden inside content it was asked to summarize, on the first try. Its tool sandbox was silently off, too.

Read the full red-team log →
03Command lineZero-dependency · Python 3.8+

Run the free scan on your own box

Scan a local agent with the CLI (browsers and hosted backends can’t reach your localhost). This is the funnel; the red-team is the depth.

python3 scan.py --target http://127.0.0.1:3000 --path /path/to/agent
python3 scan.py --target http://127.0.0.1:3000 --json
TrustShell red-teams AI agents and delivers exploit-validated test reports. Our method is open: the same red-team skills we work with are on GitHub (Apache-2.0), and our field notes are the proof they break real agents — we confirm what's exploitable, refute what isn't, and retract our own errors. The arbiter of truth is whether the exploit actually worked, not a model vote. The report is the product.