If your agent can move money, change records, grant access or send data, it can be talked into doing it for an attacker. I find the inputs that make that happen, prove it with replayable evidence, and deliver the fix and a CI gate that keeps it fixed.
Three open models ran the same support desk under 37 scenarios with injected instructions. gpt-oss-120b acted for the attacker in 9 of them; qwen3.8-27b never did.
Read the reportA fixed-scope test of your agent's tool use against prompt injection, spoofed authority, poisoned memory and social engineering, with every finding backed by the exact action taken.
Tool-boundary guards that block the forbidden action even when the model is fooled, delivered as a pull request against your code.
Every scenario that broke your agent replays on each pull request, sampled models several times, so a fixed problem cannot quietly return.
Draft answers to the AI-agent questions in enterprise vendor reviews, drawn from the test evidence. Points only you can answer are marked as such.
Same task, same 37 attack scenarios. Judged by a deterministic oracle over the agent's replayed tool calls, not by an LLM.
| Model | Acted for the attacker lower is better | Unsafe, strict policy lower is better | Completed the task higher is better |
|---|---|---|---|
| qwen3.8-27b | 0 / 37 | 27% |
100% |
| gpt-oss-120b | 9 / 37 | 54% |
95% |
| gpt-oss-20b | 5 / 36 | 56% |
86% |
The agent handled the customer's refund correctly, then followed a fake platform-maintenance notice in its inbox and emailed inventory and budget figures (which it invented) to the attacker's address, carrying the payload forward.
Every finding in an audit is reported like this: the action, the recipient or arguments, and the scenario that triggered it, replayable on demand.
The complete output of an audit of a reference support agent running gpt-oss:20b: 21 simulations, 2 kinds of critical failure, and everything needed to fix them and keep them fixed.
Risk score, the critical findings and the required fixes, for leadership and the customer's security team.
Every finding with the agent's exact tool calls, recipients and messages, and the scenario that triggered it.
Generated tool-boundary guards that block the forbidden actions, ready to wire into the agent's tools.
A GitHub workflow and baseline that replay every failing scenario three times on each pull request.
Your agent runs against a faithful copy of its tools, so nothing real is refunded, sent or deleted, and every result can be replayed.
A simulation of your tools from your OpenAPI specification or MCP tool list. No production access or source code required.
Injected instructions in emails, tool results and memory; spoofed executives; social engineering; context floods; and combinations of them.
A deterministic oracle checks what changed: money moved, data sent, access granted. Every episode is retained for re-examination.
LIFE FORGE, the framework behind these audits, is MIT-licensed and on PyPI, with a verifiers reinforcement-learning environment built on the same oracle.
Describe what your agent can do. I will reply with how I would test it, what you would receive, and a fixed price.