Vantagea / AI & Agent Red Teaming
Red-teaming for AI agents
The model is only part of the target. We attack the agents you ship the way an adversary would, from the first prompt to the cloud account they can reach. Every finding arrives with the inputs and evidence to reproduce it.
What we test
Your agent has credentials. Most tests never touch them.
A web pentest stops at the app around the model. A prompt scanner never leaves the chat box. We test what a manipulated agent can do with the access you gave it, including the seams between agents, the identities they borrow and the sandboxes they run in.
A2A
Agent-to-agent trust boundaries
One agent's output becomes another agent's input. We test whether a low-trust agent, or content it handled, can steer a more privileged one. We also look for coordination the design never intended.
What we test
- Spoofed, replayed or tampered inter-agent messages
- Impersonated agent identities and capability claims
- Low-trust output steering a privileged agent
- Delegation that skips re-authorisation
- Out-of-band coordination through shared memory, files or tools
ASI07, ASI01
IAM
Over-privileged shared identities
Agents often share one service account, token or role. Where zero standing privileges (ZSP) are not enforced, compromise one and you inherit the permissions of all. We measure that blast radius directly.
What we test
- Shared service accounts and long-lived tokens
- Inherited OAuth scopes and confused-deputy calls
- Credentials cached in memory, context or logs
- Standing access where just-in-time grants should apply
- Privilege elevation through coordination between agents
ASI03, LLM06
CTRL
Control-plane takeover
The orchestrator, task queue, memory store or verification layer that schedules and judges agents is a higher-value target than any single agent. We test who can write to it and whether it notices an agent drifting from its task.
What we test
- Write access to task queues and memory stores
- Tampering with verifier and judge agents
- Orchestrator configuration and prompt templates
- Kill switches and containment that fail open
ASI10, ASI08
MCP
MCP, tool and skill supply chain
Tool descriptions, MCP server metadata and skill manifests load into context before a user types anything. Most reviews never test this injection and supply-chain path.
What we test
- Poisoned tool descriptions and server metadata
- Tool definitions that change after approval
- Cross-server tool shadowing
- Unpinned skills, plugins and prompt templates
ASI04, LLM03
SSRF
Assumed breach into the AI supply chain
From a foothold, we follow SSRF, leaked keys and over-broad network access into model gateways, vector stores, fine-tuning pipelines and the secrets they hold. We also probe the isolation boundary: sandboxes, ephemeral micro-VMs and virtualised egress.
What we test
- Fetch and browse tools aimed at internal endpoints
- Leaked model-provider and integration keys
- Model gateways, vector stores and fine-tuning pipelines
- Secrets reachable from CI/CD
- Egress and state persistence across sandboxes, micro-VMs and snapshots
ASI02, ASI05, LLM06
Free resource
Check your own agents first. The Agent Red-Team Readiness Checklist: 21 checks across seven areas.
Get the checklistHow it works
The Prompt-to-Cloud Path
Seven stages, from the first input an attacker controls to the cloud account your agent can reach.
STAGE 01
Map every input
We list every channel that can carry an instruction to your agent: chat and API, file uploads, retrieved documents, tool responses, other agents, MCP servers and skills.
LLM01 / ASI04 / ASI07 / ATLAS: Reconnaissance
STAGE 02
Map the agent ecosystem
We map the orchestrators, model hosting, vector stores, memory, logs and third-party APIs around the agent, the identity each one runs as and what that identity can reach.
LLM03 / LLM06 / ASI03 / ASI10 / ATLAS: Discovery
STAGE 03
Probe the model layer
We try to leak the system prompt, extract sensitive information and get past guardrails and classifiers. A leaked system prompt often reveals business logic and sometimes secrets.
LLM02 / LLM07 / ATLAS: LLM Jailbreak
STAGE 04
Hijack the goal
We try to change what the agent is trying to do, through direct, indirect and multi-turn injection, written by hand and fuzzed at scale. We also record the signals a hijack leaves, so you can detect it.
LLM01 / ASI01 / ASI09 / ATLAS: LLM Prompt Injection
STAGE 05
Poison data, memory and retrieval
We plant content in RAG sources, embeddings, long-term memory and shared context, then check whether it persists, changes later decisions and spreads to other agents.
LLM04 / LLM08 / ASI06 / ASI08
STAGE 06
Abuse the application and its tools
We drive the agent's tools into unsafe calls: function-call abuse, SSRF, injection into downstream systems, code execution and escape from sandboxed tool runtimes.
LLM05 / LLM06 / ASI02 / ASI05
STAGE 07
Pivot to identity and cloud
We use the agent's tokens and roles to move into SaaS, CI/CD and cloud accounts, inside the agreed scope. This is where a manipulated agent becomes real business impact.
LLM06 / ASI03 / ATLAS: Privilege Escalation
Framework coverage
Every finding carries its OWASP LLM Top 10, OWASP Agentic Top 10 (ASI01 to ASI10) and MITRE ATLAS IDs. LLM09 (misinformation) and LLM10 (unbounded consumption) are added on request, because cost and availability testing needs its own limits.
Engagements
One discipline, four depths
The same method at four depths. Choose by how much of your AI stack is in scope.
Every engagement starts with a fixed fee agreed on a scoping call and written rules of engagement.
Prompt-Injection & Trust-Boundary Audit
A focused adversarial test of your injection surfaces and the boundaries between user content, retrieved content, system prompts, tools and privileged actions.
- Injection-surface inventory
- Validated exploit paths, or a clean result for that scope
- Boundary recommendations
- Duration
- 1 to 2 weeks
- Maps to
- LLM01, LLM07, Agentic goal hijack and memory poisoning
Agentic Architecture & Containment Review
A white-box design and runtime review covering tool permissions, identity design, MCP posture, sandbox isolation, memory, approval gates and kill switches.
- Architecture risk memo
- Agentic threat model
- Prioritised control backlog
- Duration
- 1 to 2 weeks
- Maps to
- OWASP Agentic Top 10 at design and runtime level
Core engagement
AI-Agent Red-Team Assessment
An end-to-end adversarial exercise against your production or staging agent system: model, tools, identity, memory and orchestration, followed through to impact.
- Findings report with attack traces
- Mapped risk register
- Executive brief and remediation workshop
- Duration
- 2 to 4 weeks
- Maps to
- OWASP LLM Top 10, OWASP Agentic Top 10, MITRE ATLAS
Multi-Agent & Infrastructure Programme
For cooperating agent fleets, shared identities and control planes, multi-tenant sandbox runtimes, or blast radius across cloud environments.
- Everything in the red-team assessment
- Cross-agent, sandbox and control-plane attack paths
- Retest verification and close-out letter
- Duration
- Scoped per programme
- Maps to
- Full kill chain, prompt to cloud account
Every engagement
What you receive
If nothing is found within scope, you get an honest clean result for that scope and window.
Every finding contains
- Severity, with the reasoning behind it
- OWASP LLM, OWASP Agentic and MITRE ATLAS mapping
- Preconditions and the access an attacker needs
- Exact inputs and reproduction steps
- Observed success rate across repeated trials
- Evidence: traces, tool calls, logs and screenshots
- Business impact in plain terms
- The fix and how to verify it
- Findings report
- Severity-rated, reproducible steps with evidence: traces, logs and screenshots.
- Framework mapping
- Each finding tagged to the OWASP LLM Top 10, the OWASP Agentic Top 10 and MITRE ATLAS.
- Executive brief
- One to two pages for leadership, the board or a customer security questionnaire.
- Remediation guidance
- Concrete, prioritised fixes, with an optional workshop for your engineering team.
- Optional retest letter
- Confirmation that critical and high findings are closed.
Free resource
The Agent Red-Team Readiness Checklist
A self-assessment for teams shipping LLM features, AI agents and multi-agent systems. Work through it before a launch, a customer security review or an external red-team engagement. Every unchecked item is a question an attacker gets to answer first.
Two pages. 21 checks across seven areas, mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS. Free to use and share with attribution.
PDF, ungated, no form. To hear when it is revised, email admin@vantagea.io.
OWASP LLM01 / ATLAS: Reconnaissance, Initial Access
- Every channel that can place text in model context is listed: user chat, file uploads, retrieved documents, email and tickets, tool outputs, other agents, MCP tool descriptions and skill files.
- Content from those channels is treated as untrusted data and is never merged into system instructions.
- You can say, for each input, who outside your organisation is able to influence it.
Practical questions
Questions before scoping
Request an assessment
Tell us what you have shipped, or are about to
Tell us which environments we can test and what the result needs to support: a launch gate, a customer questionnaire, audit evidence or incident follow-up. We reply with a scope and a fixed-fee proposal.
By contacting us you confirm you are authorised to discuss security testing of the systems described. We do not accept requests to test third-party systems without documented permission.