Agentic Red Teaming Overview
How to probe AI agents and multi-agent systems for security risks on Dreadnode - attack tool-using and multi-agent targets and score on the actions they take.
Red teaming a chat model asks whether the model produces harmful text. Red teaming an agent asks a different question: whether the agent takes a harmful action. An agent plans, calls tools, reads external content, and coordinates with other agents, so the attack surface and the evidence of success are both about actions, not words.
This page explains how Dreadnode structures agentic red teaming, how it maps to the OWASP Top 10 for Agentic Applications, and where to go next for the SDK and TUI workflows.
The evidence model
Section titled “The evidence model”Dreadnode scores actions, not words. A finding is recorded only when the agent performs an action that violates policy, established from the tool calls the target actually made and the arguments it used. There is no planted flag and no boolean success signal from the target. The ground truth is which tool ran and with what arguments.
For a data exfiltration or code execution assessment against a production agent where you cannot plant a flag, Dreadnode uses honeytokens. A honeytoken is an inert, unique value that is safe to leak. If the agent leaks it or runs it, exfiltration or code execution is proven with no damage. See Honeytoken Probing.
Coverage: OWASP Top 10 for Agentic Applications (2026)
Section titled “Coverage: OWASP Top 10 for Agentic Applications (2026)”The agentic suite drives every category in the 2026 OWASP-ASI taxonomy. For each category it selects the mapped attack strategies, applies the relevant transform families, and scores results with the matching detection scorers.
| Category | What Dreadnode runs |
|---|---|
| ASI01 Agent Goal Hijack | Injection across direct, tool output, and peer message surfaces; reasoning hijack |
| ASI02 Tool Misuse and Exploitation | Argument-aware tool-evidence gate; MCP tool poisoning; mcp-poisoning-mesh |
| ASI03 Identity and Privilege Abuse | Delegation and boundary-crossing analysis across privilege pipelines |
| ASI04 Agentic Supply Chain | Typosquat and dependency confusion; supply-chain-mesh |
| ASI05 Unexpected Code Execution (RCE) | Real shell execution and honeytoken proof-of-execution; devops-rce-mesh |
| ASI06 Memory and Context Poisoning | Shared-memory and query-memory injection transforms |
| ASI07 Insecure Inter-Agent Communication | Prompt infection, consensus poisoning, peer spoofing across agent meshes |
| ASI08 Cascading Failures | Cascade depth and boundary-crossing metrics across delegation chains |
| ASI09 Human-Agent Trust Exploitation | Persuasion and trust-exploitation transforms |
| ASI10 Rogue Agents | Goal drift and reasoning hijack transforms |
Indirect prompt injection, the EchoLeak and ForcedLeak class where a hidden
instruction rides inside content the agent reads, is exercised through the tool
output surface and the indirect-injection-mesh environment.
The target
Section titled “The target”A target is anything you can call that runs the agent and returns its response plus the tool calls it executed - an in-process agent, a deployed endpoint, or one of the shipped environments below. It runs locally, on AWS, or on Azure; the attack does not care how it is hosted.
For ATLAS, the target also takes a surface that says where to apply the injection:
direct (the entry agent), tool_output (content a tool returns - indirect prompt
injection), or peer_message (an inter-agent delegation). See Red Teaming an
Agent for the
exact target shapes the SDK accepts.
Ready environments
Section titled “Ready environments”Dreadnode ships environments that expose each attack surface so you can validate a workflow before pointing it at your own system. See Red Teaming an Agent for the full list and each environment’s terminal dangerous tool.
| Environment | Risk |
|---|---|
finops-mesh | Tool misuse and privilege escalation |
devsecops-mesh | Supply chain and deployment |
healthcare-mesh | Unsafe clinical action |
soc-mesh | SOC sabotage and exfiltration |
devops-rce-mesh | Real code execution |
support-exfil-mesh | Data exfiltration |
mcp-poisoning-mesh | MCP tool poisoning |
reasoning-hijack-mesh | Reasoning hijack |
indirect-injection-mesh | Indirect prompt injection |
supply-chain-mesh | Agentic supply chain |