AI agent red teaming: test what a stranger can make your agent do

AI agent red teaming means deliberately attacking an agent that reads content, calls tools and acts on data, in order to measure what a stranger can make it do. It differs from a classic penetration test because the target is a language model that decides its own actions: the flaw sits in the text the agent reads as much as in the code around it. CleanIssue runs this test on a test environment, under written authorization, and delivers a report with reproducible evidence.

What is AI agent red teaming?

It is a penetration test adapted to agents. You take the position of an attacker with no privileged access who can still drop text somewhere the agent will read it: an email, a ticket, a document, a web page, a form field. The test then measures what the agent does with that text: which instructions it follows, which tools it calls, which data it sends out.

An agent usually combines a model, a system prompt, tools (APIs, databases, email sending, web browsing, MCP servers) and a memory or document retrieval layer (RAG). Each component opens an attack surface. Red teaming walks through them in the order an attacker would meet them, then chains the weaknesses to reach a concrete impact: a data leak, an unauthorized action, an account takeover.

The baseline reference is the OWASP Top 10 for LLM Applications 2025, extended by OWASP's work on agentic applications and by the MITRE ATLAS matrix. For a wider view of the risks, see our page on AI agent security.

Why does a classic pentest miss AI agent flaws?

A classic pentest looks for defects in code and configuration: SQL injection, missing access control, exposed secrets. An AI agent adds a layer those methods do not cover. The model interprets natural language and can be talked into using its permissions for something its designer never intended.

Three reasons explain the gap:

• The input is no longer a form field. Any content the agent reads becomes a potential input. A scanner that tests HTTP parameters cannot see that a PDF or a ticket carries a hidden instruction.
• Behavior is not deterministic. An attack can fail three times and succeed on the fourth. A serious test replays each scenario several times and keeps every output.
• The agent carries the permissions. A perfectly authenticated API stays dangerous if the agent calls it with a user's rights at a third party's request. The flaw lies in the decision, which neither a WAF nor a scanner can see.

For the difference between approaches, read our article on passive audits versus pentests. The back end still matters: the application around the agent belongs to the evidence scope, because its endpoints are often the sources and destinations the agent's tools read and write.

What do we test on an AI agent?

An agent red team covers six scenario families, aligned with the OWASP Top 10 for LLM Applications 2025 categories.

Indirect prompt injection (LLM01)

The attacker plants instructions in content the agent processes: an incoming email, a shared document, a web page, a ticket comment. The agent runs them as if they were legitimate orders. This is the most profitable family for an attacker and the most frequent one in engagements. Our prompt injection page covers the variants, and the article on indirect prompt injection in RAG systems shows the mechanism on a document case.

Tool and MCP server abuse

We test what the agent can call, with which arguments, and what stops it from calling a tool outside its role. For MCP servers we also check tool descriptions (which enter the model's context), authentication and token scope. See our MCP security page and the article on the attack surface of function calling.

Data exfiltration through tool calls

We look for the full chain: content read by the agent, an action on sensitive data, then a send to the outside (email, HTTP request, link rendered as an image, write to a shared space). The leak often travels through a legitimate channel the agent is allowed to use. On this topic, read five ways chatbots leak data.

Excessive agency (LLM06)

We compare what the agent can do with what it needs to do. The gap (unneeded write rights, deletion tools, no human approval on sensitive actions) is the most common finding in an agent test.

System prompt leakage (LLM07)

The system prompt sometimes holds business rules, tool identifiers or secrets that should not be there. We check what can be extracted, including in fragments, and above all what that extraction teaches an attacker for the next step.

Isolation between customers

For a multi-customer agent we test whether one tenant can read or influence another tenant's data: predictable identifiers in tool calls, URL parameters that select the customer, shared memory or indexes. It is the commercially costliest scenario when it succeeds.

How does an AI agent red team engagement run?

An engagement follows a fixed sequence, from scoping to re-test.

1. Scoping (free 30-minute discovery meeting). We identify the agent, its tools, its content sources and what matters most to you: customer data, irreversible actions, a client waiting on a security questionnaire.
2. Written authorization. No test starts without a signed document that sets the scope, the dates, the authorized techniques and emergency contacts. A verbal agreement is not enough.
3. Test environment. You provide an environment you control, with fictitious accounts and data. We do not attack production without an explicit mandate.
4. Reconnaissance. We map the tools, content sources, host application, exposed identifiers and guardrail behavior. This phase is short and changes nothing.
5. Attack. We replay each scenario several times, starting with those reconnaissance flags as most promising, then chain the weaknesses. Test writes go through identifiable objects that are deleted afterward.
6. Verification. Every finding is retested by hand. Model output without raw evidence (request, response, log) is not retained.
7. Report and debrief. A short report, then a 30-minute video call with your team.
8. Re-test. Once fixes are applied, we check that they hold.

Our detailed approach is on the method page.

What does the delivered report contain?

For each finding the report states the booby-trapped text used, the action attempted, the proof that it succeeded, the severity and a remediation path. It also lists what was tested and held up, which is useful information for your customers. The format is short so you can attach it to a security questionnaire (AI Act, SOC 2, ISO 27001).

A typical finding reads like this: the content carrying the instruction, the tool called, the data involved, the exit channel and the number of attempts needed. A technical reader can reproduce the scenario, and a non-technical reader understands the impact.

How much does an AI agent red team cost and how long does it take?

The Agent Red Team Express costs €1,900 and lasts 5 days. It covers one agent, with an access review, reproducible demonstrations, a test of the data-leak chain, a reusable report and a 30-minute debrief. Work starts within 48 hours. VAT not applicable. The service is always paid: there is no "nothing found, nothing paid" guarantee, because showing that an agent resists takes the same work as showing that it gives way.

The Custom Red Team is for wider scopes: several agents, MCP servers, white-label delivery for an agency. It is quoted after the discovery meeting. The standard offer is detailed on the Agent Red Team Express page, and prices are summarized on the pricing page.

Agent red team, classic pentest or automated scanner: which one to choose?

The choice depends on what you need to prove.

• AI agent red team: targets model behavior, tools and data. Output: reproducible attack scenarios and evidence. Choose it when an agent is in production or about to be.
• Classic pentest: targets the application's code, infrastructure and authentication. Output: conventional technical vulnerabilities. Choose it for the web application around the agent.
• Automated injection scanner: replays libraries of known prompts. Output: broad, shallow coverage with many false positives. Useful in continuous integration, insufficient to judge real impact.
• Configuration review: compares the agent's permissions with its needs. Output: rights gaps. It is part of a red team but does not prove exploitability on its own.

These approaches complement each other. Research benchmarks such as InjecAgent and AgentDojo show that well-configured agents can still be hijacked by instructions placed in tool outputs or data, which supports case-by-case testing over blind trust in the model.

Who is this service for?

It fits three profiles.

• Startups and SMEs with an agent in production: teams of 10 to 80 people, often without a security team, whose customer asks for proof of testing.
• AI agencies that deliver agents: check before delivery that an agent withstands what a stranger can write to it, and attach a report to acceptance.
• Pentest firms: white-label backup for an engagement where the AI agent is the scope and the team does not yet have the method.

If your agent does not act (it only answers questions, with no tools or sensitive data), the risk is lower and a lighter test may be enough. The discovery meeting is also where we say so.

How should you prepare your agent before a red team?

Good preparation saves a day of testing. Gather before kickoff:

• a test environment that mirrors production: same tools, same rights, fictitious data;
• the list of tools with their permissions and, if possible, their argument schemas;
• the content sources the agent reads (inbox, document store, web pages, tickets) and how to drop a test item into them;
• the system prompt and a description of existing guardrails;
• two test accounts belonging to two different customers, if the agent is multi-customer;
• a reachable contact during the five days and the logging policy you want.

Also plan to disable real sends (emails, payments, notifications) or redirect them to test mailboxes.

What are the limits of an AI agent red team?

A test lasts five days and does not prove the absence of flaws: it documents what was attempted inside a given scope. Models change, new tools get added, and a prompt fix can be bypassed by a phrasing the test never tried. Three consequences follow: retest after any major change (new model, new tool, new content source), combine testing with structural safeguards (minimal rights, human approval, isolation of untrusted content) and keep logging the agent's actions.

The Shield, the software layer meant to block unauthorized actions before they run, is under development and not available today. The defenses described on our AI agent security page apply right now with the means you already have.

Where to go next

Talk through your agent in a free 30-minute discovery meeting and leave with a clear scope. To check whether your agent is already exposed, see the exposed agent page. Technical terms are defined in the glossary.