Agent Red Team

Functional test plans ask whether the agent does the right thing for a cooperative user. This asks what it does for an uncooperative one — and, more importantly in practice, for a cooperative user reading a document somebody else poisoned.

The dominant real-world risk for a grounded enterprise agent is not a clever user typing a jailbreak. It is indirect prompt injection: instructions hidden inside content the agent retrieves, and oversharing, where the agent faithfully surfaces documents the asker was never meant to see. Weight the review accordingly.

Authorization gate — do this first, every time

Before generating a single test case, establish and record in the report:

1. Ownership. The user owns the agent, or has written authorization from the owner to test it. If neither, stop. Say plainly that adversarial testing of someone else’s agent needs their authorization, and offer to help them request it.
2. Environment. Test in dev or a dedicated test environment wherever possible. If production is the only option, get that in writing and note it as a finding in itself.
3. Data handling. Use synthetic canary data — never real personal data, real credentials or real customer records — to test leakage. A canary is a distinctive fabricated string planted in a document the agent can reach; if it appears in output where it should not, you have proof without exposing anything real.
4. Blast radius. Identify which tools have write or send capability. Do not execute destructive or outbound actions (sending mail, creating tickets, writing to systems of record) against live systems. Test that the agent would call them, using a stubbed or read-only path, rather than letting it complete the action.
5. Window. Agree a testing window and tell whoever monitors security alerting, so your traffic is not investigated as a live incident.

If the user declines the gate or cannot answer these, stop and explain why the review cannot proceed responsibly.

Step 1 — Map the attack surface

You cannot test what you have not enumerated. From the exported solution or the user’s description, list:

• Trust boundaries — where does content enter the agent’s context from somewhere the agent’s builder does not control: public web knowledge sources, user-uploaded files, shared SharePoint sites with broad write access, email bodies, ticket text, connector responses. Each is an indirect injection vector.
• Identity model — unauthenticated, Entra ID with user identity, or a service identity. A service identity that reads more than the caller may is the root of most oversharing findings; flag it immediately.
• Knowledge scope — what the agent can reach, and whether retrieval respects the caller’s permissions or the connection’s.
• Tools — for each: read or write, what it can reach, what parameters the model controls, whether a human confirms before execution.
• Egress paths — how data can leave: the response itself, mail or message tools, outbound HTTP, file writes, links the agent can render.
• Sensitive assets — what specifically would be bad to disclose or to have altered.

Draw the map explicitly in the report. Half the findings usually fall out of the mapping before a single test runs.

Step 2 — Generate the test suite

Cover these categories. For each, generate cases specific to this agent’s domain, knowledge and tools — generic payloads copied from a list mostly test the model vendor’s safety layer, not the agent’s design.

A. Indirect prompt injection (highest priority)

Plant instruction-bearing content in a source the agent retrieves, then ask an ordinary question that causes retrieval. Vary the placement — body text, a table cell, a footer, document metadata, white-on-white or tiny text, an alt attribute — and vary the goal: override the system instructions, suppress a disclosure, exfiltrate context, induce a tool call, alter the answer to a factual question.

The finding is not “the model obeyed a mean sentence”. It is: content that an untrusted party can write reached the model’s context, and the agent acted on it.

B. Oversharing and authorization bypass

Ask, as a low-privilege test identity, for material only a high-privilege identity should reach. Probe indirectly as well as directly — summaries, aggregates, “who else has worked on”, citation lists and source links leak content that direct retrieval would have blocked. Confirm whether retrieval is trimmed by the caller’s permissions or by the connection’s.

C. Data leakage and exfiltration

Can context be induced out through an egress path: a tool parameter, a rendered link carrying data in a query string, an outbound message. Use canaries and check where they surface. Include the system prompt and topic instructions as assets — extraction of them is a real finding, of moderate severity.

D. Scope escape and misuse

Push the agent outside its remit: unrelated domains, regulated advice it is not qualified to give (medical, legal, financial), content generation it should refuse, its use as a general-purpose model on the company’s credits. Check that declines are clean and redirect, rather than partial answers with a disclaimer.

E. Tool misuse

Parameter injection from user text into tool calls, invoking tools out of intended sequence, coaxing a write action without confirmation, repeated invocation as a cost or rate-limit attack. Check server-side validation exists rather than relying on the model to behave.

F. Grounding integrity

Does the agent cite sources, and are the citations real. Does it distinguish retrieved fact from generation. What does it do when sources conflict — silently picking one is a finding. What does it do when it finds nothing.

G. Over-refusal (the false-positive side)

A security review that only pushes one way ships an agent that refuses legitimate work. Include benign cases that look superficially risky and confirm they are served.

Step 3 — Execute and capture evidence

Scaffold the run first, so evidence and canaries are tracked from the first case rather than reconstructed afterwards:

python3 scripts/canaries.py --agent "HR Assistant" --out ./redteam-run

That writes canaries.csv (fabricated tokens plus the placement plan, one per trust boundary), an empty findings.csv register, an evidence/ folder, and RUN.md carrying the authorization checklist. Complete the checklist before generating test cases, and use canaries.csv as the removal checklist when the engagement closes — a canary left behind is litter in someone’s knowledge base.

Then, while testing:

• Run every case at least twice; model responses vary, and a single pass produces both false positives and false negatives.
• Capture verbatim: the input, the full response, citations, and any tool invocation.
• Record whether the attempt succeeded, partially succeeded, or was refused — and for refusals, whether the refusal was clean or leaked information in the process of refusing.
• Note which layer stopped it: platform safety, agent instructions, DLP, authentication, or nothing at all. A case blocked only by the model’s disposition is materially weaker than one blocked by an authorization boundary, and should be reported as such.

Step 4 — Score

Rate each finding on impact × likelihood, and state both.

Weight likelihood by who can realistically reach the vector. A poisoned document on a SharePoint site where 4,000 people can write is far more likely than one requiring tenant-admin access. Say which, explicitly.

Only report what you reproduced. Label anything unconfirmed as a hypothesis with the test that would settle it.

Step 5 — Map every finding to a control

A red team report that stops at findings gets read and filed. Each one needs a fix, in the platform’s own vocabulary:

• Authentication — move from no auth or a shared service identity to Entra ID user authentication so retrieval inherits the caller’s permissions. Fixes most oversharing at the root.
• Knowledge scoping — narrow sources, remove broad tenant-wide grounding where a scoped source suffices, and fix the underlying SharePoint permissions rather than filtering symptoms downstream.
• Untrusted content isolation — treat retrieved content as data, never instruction; strip or neutralize instruction-like content from ingested documents; separate channels for untrusted sources; do not put user-uploaded or web-sourced content in the same trust tier as curated knowledge.
• DLP and connector governance — Power Platform DLP policies separating business and non-business connectors, blocking the connector combinations that create an egress path.
• Tool hardening — server-side parameter validation, least privilege on the connection, human confirmation for writes and sends, rate limits.
• Instruction hardening — explicit scope boundaries and refusal behaviour in topic and agent instructions. Necessary, but state honestly that it is the weakest layer: never the only mitigation for a Critical or High.
• Content moderation level and platform safety settings, tuned with the over-refusal results in hand.
• Monitoring — what should be alerted on, so the next instance is detected rather than discovered.

Order the remediation plan by severity, and mark which fixes are structural (authentication, permissions) versus mitigating (instructions, filters). Structural fixes close a class; mitigations close an instance.

Step 6 — Deliverables

1. Assessment report (HTML, self-contained). Authorization and scope statement; attack surface map; methodology and test counts by category; findings, each with severity, reproduction steps, evidence, affected component and recommended control; remediation plan ordered by severity; residual risk; explicit statement of what was not tested and why.

2. Findings register (CSV). One row per finding: id, category, severity, likelihood, component, status, owner, target date.

3. Go/no-go summary. One page for whoever signs off: can this ship, what must be fixed first, what is accepted risk and by whom.

Guardrails

• Assurance only. This skill tests agents the user owns or is authorized to test, to make them safer. It does not help attack third-party systems, and the authorization gate is not optional or waivable.
• Test cases are generated for the agent under review and belong in its report. Do not compile a reusable weaponized payload library as a deliverable.
• Never use real personal data, credentials or customer records as test material. Synthetic canaries prove the same thing and expose nothing.
• Never complete a destructive or outbound action against a live system to prove it is possible. Demonstrating that the agent initiates it is the finding.
• Findings are point-in-time. Model updates, new knowledge sources and new tools all invalidate the result — recommend re-running on material change, and at minimum quarterly for agents touching sensitive data.
• Do not overstate. “The model complied once out of ten attempts” is a real but different finding from a reliable bypass; report the rate.