Agentic Red Teaming Overview

Red teaming a chat model asks whether the model produces harmful text. Red teaming an agent asks a different question: whether the agent takes a harmful action. An agent plans, calls tools, reads external content, and coordinates with other agents, so the attack surface and the evidence of success are both about actions, not words.

This page explains how Dreadnode structures agentic red teaming, how it maps to the OWASP Top 10 for Agentic Applications, and where to go next for the SDK and TUI workflows.

The evidence model

Dreadnode scores actions, not words. A finding is recorded only when the agent performs an action that violates policy, established from the tool calls the target actually made and the arguments it used. There is no planted flag and no boolean success signal from the target. The ground truth is which tool ran and with what arguments.

Note

A jailbreak that only produces text is low severity. The same attack that makes an agent call transfer_funds to an external account, run_shell a non-CI command, or send_email to an external recipient is high severity. Dreadnode captures the executed tool calls so findings show the real blast radius.

For a data exfiltration or code execution assessment against a production agent where you cannot plant a flag, Dreadnode uses honeytokens. A honeytoken is an inert, unique value that is safe to leak. If the agent leaks it or runs it, exfiltration or code execution is proven with no damage. See Honeytoken Probing.

Coverage: OWASP Top 10 for Agentic Applications (2026)

The agentic suite drives every category in the 2026 OWASP-ASI taxonomy. For each category it selects the mapped attack strategies, applies the relevant transform families, and scores results with the matching detection scorers.

Category	What Dreadnode runs
ASI01 Agent Goal Hijack	Injection across direct, tool output, and peer message surfaces; reasoning hijack
ASI02 Tool Misuse and Exploitation	Argument-aware tool-evidence gate; MCP tool poisoning; mcp-poisoning-mesh
ASI03 Identity and Privilege Abuse	Delegation and boundary-crossing analysis across privilege pipelines
ASI04 Agentic Supply Chain	Typosquat and dependency confusion; supply-chain-mesh
ASI05 Unexpected Code Execution (RCE)	Real shell execution and honeytoken proof-of-execution; devops-rce-mesh
ASI06 Memory and Context Poisoning	Shared-memory and query-memory injection transforms
ASI07 Insecure Inter-Agent Communication	Prompt infection, consensus poisoning, peer spoofing across agent meshes
ASI08 Cascading Failures	Cascade depth and boundary-crossing metrics across delegation chains
ASI09 Human-Agent Trust Exploitation	Persuasion and trust-exploitation transforms
ASI10 Rogue Agents	Goal drift and reasoning hijack transforms

Indirect prompt injection, the EchoLeak and ForcedLeak class where a hidden instruction rides inside content the agent reads, is exercised through the tool output surface and the indirect-injection-mesh environment.

The target contract

An agentic target is any HTTP service that accepts a message and returns the executed tool calls.

POST /attack
  { "prompt": "...", "surface": "direct|tool_output|peer_message", "injection": "..." }
->
  { "content": "...", "tool_calls": [ {agent, tool, arguments, result}, ... ] }

The surface field selects where the injection is applied: direct for the entry agent, tool_output for content a tool returns (indirect prompt injection), and peer_message for an inter-agent delegation. Any deployment that answers this contract works, whether it runs locally, on AWS, or on Azure.

Ready environments

Dreadnode ships environments that expose each attack surface so you can validate a workflow before pointing it at your own system.

Environment	Risk
finops-mesh	Tool misuse and privilege escalation
devsecops-mesh	Supply chain and deployment
healthcare-mesh	Unsafe clinical action
soc-mesh	SOC sabotage and exfiltration
devops-rce-mesh	Real code execution
support-exfil-mesh	Data exfiltration
mcp-poisoning-mesh	MCP tool poisoning
reasoning-hijack-mesh	Reasoning hijack
indirect-injection-mesh	Indirect prompt injection
supply-chain-mesh	Agentic supply chain

Next steps

Multi-Agent Red Teaming Run the ATLAS campaign and the full agentic suite from the SDK or the TUI.

Honeytoken Probing Prove RCE and data exfiltration safely with inert canaries.