Adversarial testing
Primary offer
We attack the agent, its tools, and the stack around them the way an adversary would, including the permission and integration failures that standard evals miss.
What an attacker can make your agents and MCP servers do.
Production agents hold tools, MCP servers, and identities. We map what each agent can call and reach, then attack the paths between them that standard evals miss.
Example findings reachable
4/ 4
With every crossing below set to checked: each call is logged but still goes through, so nothing on the path is closed.
Five surfaces, four crossings.
An agent holds tools. A tool is served by an MCP server. The server presents an identity. The identity reaches a data path. The failures we find in this use case sit on the four crossings in between. Set each crossing below to see what stays reachable.
5 surfaces4 crossings4 of 4 findings reachable4 crossings checked
A vertical chain of five surfaces: Agent, Tool, MCP server, Identity and Data path, joined by four crossings numbered C1 to C4. C1 carries AG1, C2 carries LLM01, C3 carries AG2, C4 carries AG4. Each surface is a button: arrow keys move along the chain, Enter selects a surface to filter the classes below, Escape clears.
Arrow keys move along the chain · Enter filters the classes below · Esc clears
Crossing 01
Agent Tool
AG1A tool call: a name, the arguments, and the intent the model inferred from what it read.
Permissions carried: the agent’s full tool grant. The call carries no record of who actually asked for it.
What checks it
Nothing. Any tool the agent can see, the agent can call.
What checks it
Calls are logged, allow-listed, and alerted on, read after the fact.
What checks it
The tool grant is scoped to the task, and a high-impact call stops for a human.
Reachable
Logged, but the call still runs. AG1 is still reachable.
AG1 · Agents steered into unsafe tool use
Nothing in the model is broken: it follows persuasive text, and it holds real credentials.
Crossing 02
Tool MCP server
LLM01The call itself, and the identity the server decides to present on the other side of it.
Permissions carried: the trust a tool places in a server it did not build and cannot see into.
What checks it
Nothing. A server is added to the configuration and its tools appear in the agent’s list.
What checks it
Servers are inventoried, and their tool lists are diffed when they change.
What checks it
Only pinned, reviewed servers are reachable, and their tool lists are fixed at review time.
Reachable
Logged, but the call still runs. LLM01 is still reachable.
LLM01 · Prompt injection past your filters
The server’s tool descriptions and results reach the agent as instructions no human approved, across a boundary assumed to be internal.
Crossing 03
MCP server Identity
AG2A credentialed request to a system the server fronts, already inside your perimeter.
Permissions carried: the service account the server holds, whoever or whatever triggered the request.
What checks it
Nothing in the flow says no.
What checks it
The call is attributed in logs and reviewed later.
What checks it
Short-lived, least-privilege credentials you can revoke at any moment.
Reachable
Logged, but the call still runs. AG2 is still reachable.
AG2 · Authority boundaries that leak
One component acts with the privileges of another, and nothing in the flow says no.
Crossing 04
Identity Data path
AG4A read or a write that lands on real records, at the end of a chain of permissions nobody re-checked.
Permissions carried: everything the identity can do, including the operations that cannot be undone.
What checks it
Nothing. A destructive call proceeds like any other.
What checks it
Writes are audited after the fact, so you learn what happened once it has.
What checks it
Irreversible operations stop for a human gate, and the credential is scoped to the records in play.
Reachable
Logged, but the call still runs. AG4 is still reachable.
AG4 · Unsafe autonomy
A destructive or irreversible action proceeds without a human gate. This class escalates severity on its own, whatever the demonstrated action was.
The rule. A finding is reachable when nothing on its path is gated and everything upstream arrived. Checked means detected, not prevented: you learn about the call, and it still goes through. Gate one crossing and everything downstream of it closes too.
Illustrative example, not client data. Severities and the full class catalog are on the threat register.
The same chain, one task, span by span.
Each crossing also shows up in a trace. Below is one agent task with every span listed: the same four crossings appear as spans, each tagged with the class it can leak.
10 spans4 flagged with a class
10 of 10 spans shown10 of 10 spans shown · 4 carry a class4 of 10 spans shown · ancestors hidden
spanoffset, ms
task.run0-1240
agent.turn40-300
context.load60-110
retrieval.fetch70-100
model.turn150-280
policy.check330-380
tool.call400-900AG1
mcp.invoke440-880LLM01
identity.assume470-880AG2
datastore.write640-860AG4
Illustrative example, not client data. Focusing a span marks its ancestors, because a span inherits its permissions from the one that called it.
Four classes, one per crossing.
Four classes carry most of the risk on this chain. Each is a named entry on the threat register, so coverage can be counted. Select a surface on the chain above to keep only the classes that cross it.
| Class | Crossing | Surface path | What we test |
|---|---|---|---|
| AG1 | Crossing 01 | Agent → Tool | Tool abuse and unauthorized tool invocation: an agent calls a tool it should not reach, or calls an allowed tool with arguments outside its intended use. Lives on Agent and Tool. |
| LLM01 | Crossing 02 | Tool → MCP server | Prompt injection (direct and indirect): instructions arrive inside content the system already trusts, such as a tool description or a tool result. Lives on Tool and MCP server. |
| AG2 | Crossing 03 | MCP server → Identity | Authority-boundary and confused-deputy escalation. Lives on MCP server and Identity. |
| AG4 | Crossing 04 | Identity → Data path | Unsafe autonomy: an agent deletes, sends, pays, or deploys with no person in the loop. Lives on Identity and Data path. |
Showing 4 of 4 classes. The chain above is unfiltered.
Each finding records one class, the path it traveled, and the permissions along that path. Each fix attaches to one hop, so your team can point to the change that closed it.
Where to start.
Most first engagements are a scoped adversarial test on one production slice; a secure design review of the agents and MCP servers is the lighter start. Continuous Assurance follows a first engagement.
Map
Every surface in scope. Each finding is a path on that map, so you can point to where it lives.
Attack
A scoped adversarial test on one production slice, or a secure design review when you need ranked failure modes before live exploitation.
Deliver
Every paid engagement produces a living Atlas map of the reviewed surface. You keep it, and it stays useful after we leave.
Secure design review
The lighter start
Architecture and code, read against your own threat model. On an agent surface that means the tool grant, the MCP server, and the identity behind them.
Continuous Assurance
After a first engagement
Re-checks closed paths every month, in Atlas. A gate on crossing 03 only protects you while it stays in place, so it gets re-checked.
Other entry points: LLM applications, where the persuasion that starts this chain is tested · Existing systems, what you already run, against AI-era abuse. The same team tests the applications, APIs and infrastructure around the agent, and runs chaos engineering and binary reverse engineering. All seven offers are on Services.
What you receive.
A scoped engagement on an agent surface ends with four artifacts. The Atlas map keeps the other three usable over time.
- 01Findings report
Every finding with the path it took, its rating, the steps to reproduce it, and the change that closes it.
- 02Executive summary
What was tested, what held, and what to fix first, written for the person who approves the fix.
- 03Evidence bundle
The record behind each finding, pinned to the run that produced it, so your team can replay it without us.
- 04Atlas map
The machine-readable map of every surface in scope. You keep it, and the next engagement starts from it.
Coverage, severity, and the six phases are on the method page. Evidence for regulators is on Assurance. Engagement options and how we quote are on Services.
Bring us an agent surface.
We will tell you how we would break it, and how we would help you close what breaks.