ai-agent-redteam

# AI Agent Red Teaming Offensive testing of **autonomous LLM agents** — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing (see `ai-security`): the attack surface here is the *agentic pipeline* — untrusted data channels, tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement. ## When to Activate - Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter - Testing RAG / email / browser assistants for indirect or zero-click prompt injection - Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping - Assessing persistent memory / long-term context for poisoning and belief drift - Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions - Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR - Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Indirect / zero-click prompt injection (EchoLeak-class) | T1566.002 / AML.T0051.001 | CWE-1427 | references/indirect-prompt-injection.md | scripts/indirect_injection_forge.py | | RAG corpus poisoning & markdown/image exfiltration | T1567 / AML.T0070 | CWE-1426 | references/indirect-prompt-injection.md | scripts/indirect_injection_forge...