Find what your
AI agent
will do under attack

We strongly recommend testing against a staging environment. If production testing is required, we agree a narrow time window, a rollback plan, and a concurrency limit in the Rules of Engagement before any probes are dispatched. Our harness is configured to never create persistent access, delete data, or exfiltrate real user information.

Our harness communicates via HTTP only — it is framework-agnostic. We ship seven adapters: OpenAI-compatible chat (regular + SSE streaming), Anthropic Messages (regular + SSE streaming), MCP servers (JSON-RPC), GraphQL-fronted agents, and any generic REST API via Jinja2 templates. That covers Azure OpenAI, Groq, Together, Fireworks, Mistral, DeepSeek, Ollama, vLLM, LangGraph / LangServe, Hasura, AppSync, and any custom internal gateway. If your agent uses a custom protocol, we can build a custom adapter as part of the scoping phase.

Yes — all three are first-class targets. MCP servers are pen-tested directly via JSON-RPC (M-01..M-03: resource traversal, tool-argument injection, unauthenticated discovery) and indirectly via the LLM that consumes them (C-01: confused-deputy attacks where the model is tricked into calling a tool maliciously). GraphQL-fronted agents get a dedicated category (G-01) covering introspection leakage, depth DoS, alias amplification, and SQL-pattern injection through mutation arguments. Multi-turn attacks (P-01) cover trust priming, confabulation exploits, goal drift, and context-flood safety decay — attack classes that single-shot probe libraries miss entirely.

Beyond fixed, scripted multi-turn probes, AAPT runs an adaptive attacker (P-02): an LLM generates each conversational turn live, adapting to how your agent responds, carrying a working memory of what it has tried, and steering toward the goal. It stops early when an attack plateaus (saving time and cost), and its reproducibility is empirically measured — the attack is re-run and the success rate feeds the CVSS-A score. An anonymized cross-run memory seeds each engagement with the tactics that worked against similar agents, so the attacker gets sharper the more it is used — while never storing or sharing your prompts, data, or findings.

Findings that need judgement can be evaluated by a dual-model judge council: two independent frontier models (Anthropic and Google) each assess the agent's response and their verdicts are combined, so no single model's blind spot goes unchallenged. When the models disagree, that disagreement is surfaced on the finding for human review. A deterministic heuristic layer runs underneath as a fallback, so detection degrades gracefully rather than failing.

Each FAIL finding carries two cost bands derived from its severity and category: a fix cost (engineering effort to remediate, $500–$150k across four bands) and a risk-exposure cost (estimated impact if exploited, $1k–$10M across four bands). Higher-blast-radius categories (credential exfil, tool misuse, agent-to-agent compromise) bump the risk band one tier above the fix band. Per-finding bands sum to a rollup card on the report's first page so CFOs and CISOs can prioritise without translating CVSS into spend themselves. Bands are deliberately wide because real cost depends on your stack and regulatory posture — they're defensible order-of-magnitude estimates, not invoices.

The AAPT methodology document, finding register, and CVSS-A scored reports are designed as audit-ready evidence artefacts. They directly address SOC 2 Security trust service criteria and EU AI Act Article 9 (Risk Management), Article 15 (Robustness and Cybersecurity). Many clients share the executive report with their auditors at the start of the review cycle.

Raw probe payloads and agent responses are purged 30 days after engagement close. Scored findings are retained for 12 months for trend analysis, then deleted. We sign a data processing agreement before any testing begins. All test traffic originates from agreed IP ranges disclosed in the Scope Agreement.

Yes — enterprise clients can supply domain-specific probes in our YAML schema. This is particularly valuable for regulated-domain agents (financial advice guardrails, HIPAA PHI handling) where generic probes may not fully cover your specific compliance requirements. Custom probes are loaded alongside the standard library and scored with the same CVSS-A framework.