What is AI red teaming for LLM and agentic applications?

AI red teaming uses adversarial tests to examine how LLM and agentic applications respond to prompt injection, unsafe tool use, memory poisoning, and data exposure. Promptention documents the setup and observable results of those tests.

What vulnerabilities does agentic red teaming detect?

Adversarial tests can explore direct and indirect prompt injection, multi-turn jailbreaks, tool-output and MCP injection, memory poisoning, data exposure, excessive agency, and harmful output. Reproducible findings make those behaviors easier to investigate.

Promptention Red

Test how AI applications
behave under attack.

Promptention Red brings adversarial testing to LLM and agentic applications. It examines prompt injection, tool misuse, memory poisoning, and data exposure, then documents the results.

Read the research

redteam sample test

SAMPLE RUN

target support-agent29% held

ATTACKVECTORRESULTTURNS

›moderation bypassencodingBLOCK,

›system-prompt extractiondirectBLOCK,

›memory poisoningsession stateBREACH6t

›harmful-content elicitroleplayFLAG4t

›tool-output injectionMCP serverFLAG5t

›indirect injectionRAG documentBREACH3t

›multi-turn crescendoconversationBREACH8t

3 findings this campaignmapped to OWASP LLM Top 10

THE ATTACK SURFACE

Attack paths we test

We test how adversarial inputs can redirect autonomous systems and expose the boundaries they rely on.

Prompt injection

Direct and indirect, including instructions hidden in the pages and documents your agent retrieves.

indirectRAG docsystem-prompt leak

Jailbreaks

Multi-turn campaigns that erode guardrails gradually, not just single-message tricks.

crescendomany-shotpolicy reframing

Tool & MCP abuse

Poisoned tool results and rogue MCP servers that turn a helpful function call into an attacker's instruction.

tool-output injectionrogue MCP

Memory poisoning

Planting instructions in session or long-term memory that detonate on a later, unrelated request.

session statepersistent memory

Data exfiltration

Coaxing secrets out through markdown image links, tool arguments, and other side channels a text filter misses.

markdown exfilPII leak

Excessive agency

Pushing agents to take out-of-scope, destructive actions, the wire transfer that never should have been callable.

over-scoped toolsmulti-agent handoff

Harmful content & moderation

Probing whether the model can be steered into toxic, violent, illegal, or off-brand output.

moderation bypasshate speechmultilingual

Hallucination & misinformation

Measuring where the model invents facts, contradicts sources, or confidently answers what it shouldn't, under adversarial pressure.

fabricationsource conflict

Sensitive data exposure

Coaxing training data, system context, and other users' information out of the model through targeted questioning.

context leaktraining-data recall

COVERAGE

One test cannot tell you how an agent will behave

Our test library spans prompt injection, tool misuse, data exposure, and other attack surfaces. We use it to ask how behavior changes across different contexts and multiple turns.

Prompt injectionIndirect injectionJailbreaksTool & MCP abuseContent moderationBias & discriminationMisinformationMalicious codeInsecure outputPII extractionSystem-prompt extraction

Crescendo (gradual escalation)Many-shotPolicy reframingPayload splittingMulti-persona hijackRefusal suppressionToken-boundary manipulationVirtualization / nested simulationDocument-embedded instructionTool-output / system spoofContext / RAG replaySemantic smugglingEncoding & linguistic transformAuthority escalationReverse-psychology trapCrescendo (gradual escalation)Many-shotPolicy reframingPayload splittingMulti-persona hijackRefusal suppressionToken-boundary manipulationVirtualization / nested simulationDocument-embedded instructionTool-output / system spoofContext / RAG replaySemantic smugglingEncoding & linguistic transformAuthority escalationReverse-psychology trap

Hypothetical distancingFew-shot in-context attackRoleplay ecosystemContinuation attackFormat forcingInvisible / markup smugglingTask decompositionChained benign-to-dangerousStyle-transfer evasionFabricated authorityCognitive overloadPrompt introspectionArgument smugglingMarkdown exfiltration linkConditional triggerHypothetical distancingFew-shot in-context attackRoleplay ecosystemContinuation attackFormat forcingInvisible / markup smugglingTask decompositionChained benign-to-dangerousStyle-transfer evasionFabricated authorityCognitive overloadPrompt introspectionArgument smugglingMarkdown exfiltration linkConditional trigger

These are examples from the LOKI adversarial dataset. We use frameworks such as the OWASP LLM Top 10 and MITRE ATLAS to organize the questions we test.

RESEARCH METHOD

From question to repeatable finding

01
Scope
Map agents, tools, and data flows, then choose the boundaries to test.
02
Attack
Combine repeatable attack cases with manual exploration of less obvious paths.
03
Report
Record reproductions and conditions so findings can be checked again.
04
Retest
Repeat tests after a change to see what improved and what remains open.

Human-in-the-loop, not just a scannerLOKI adversarial datasetFindings mapped to OWASP LLM Top 10

Test how AI applications behave under attack.