Assistants that read private data
Customer support, internal search and RAG applications.
Can an attacker retrieve another customer’s records or turn a retrieved document into instructions?
AI red teaming / Oktsec AssessmentAI red teaming.
AI red teaming.
Test what your
agents can expose.
A scoped security testing service for AI agents and their connected systems. Find paths to unauthorized data access, tool use and privileged changes. Get reproducible findings, remediation priorities and one retest of the original findings.
Your application, with its actual access.
AI red teaming tests how an AI workflow behaves under adversarial conditions. For agents, the test must follow what happens after a prompt: which tool is called, what authority it uses and whether a harmful action reaches a real system. We agree which of these workflows belongs in your engagement.
Agents that use tools
MCP servers, API integrations and coding or operations agents.
Can an agent misuse a permitted tool, expose a credential or send data to an unauthorized destination?
Workflows with privileged actions
Delegated tasks, production changes and human approval steps.
Can authority expand between agents, or can a consequential action run without the required approval?
The scope covers deployed AI applications and agent workflows. Model training, model-weight analysis and a full model safety evaluation require a separate scope discussion.
Could a support ticket trigger a data export?
The agent’s task is to summarize a customer issue. We test whether instructions hidden in the ticket can turn that task into an unauthorized transfer.
- 01 / Input
A ticket carries instructions.
An untrusted ticket asks the agent to send a diagnostic export to an external destination.
Controlled adversarial input - 02 / Action
The agent attempts a transfer.
We trace whether the agent calls a database tool and attempts to send data using its existing access.
Tool call → data → destination - 03 / Finding
We test the control.
Does parameter or egress policy stop the transfer? We record the observed decision, recommend a correction and repeat the agreed test during the retest.
Reproducible evidence for your team
Tests use agreed targets and test data. Demonstrating the path does not require exporting live customer data.
Problems found. Fixes merged.
Two examples of the founder’s public security work. These are upstream contributions, not customer red-team engagements or endorsements.
- The problem
- Debug output printed sensitive response headers, exposing session cookies in logs.
- The change
- Redact sensitive response headers while preserving the original response.
- What to test in an agent workflow
- Can a tool response leave credentials in agent transcripts, CI logs or shared reports?
- The problem
- A preexisting symbolic link could redirect credential writes to another file.
- The change
- Create the file exclusively with restricted permissions and reject symbolic links on POSIX systems.
- What to test in an agent workflow
- Can an agent-controlled workspace redirect a tool’s credential or output files?
A clear path to remediation.
Test before a release or after a change in tools, permissions or approval steps. Bring the workflow, its owner and the boundary that must hold.
Define the boundaries.
Agree targets, identities, test data and stop conditions before work begins.
Testing safeguardsGet a reproducible finding.
Receive the attack input, tool sequence, observed impact and remediation priorities. One retest of the original findings is included under the proposal’s scope, environment and request window.
Assessment deliverablesRemote, on-site or hybrid. Client-paid travel, lodging, travel days and other agreed on-site expenses are specified in the proposal.
OWASP Agentic control referencesStart with a clear answer.
What do AI red teaming services include?
Oktsec tests agreed AI applications and agent workflows for prompt injection, unauthorized access, tool abuse and approval failures. The handoff includes an executive summary, reproducible findings, remediation priorities and one retest of original findings within the proposal’s scope, environment and request window.
How long does an AI red team engagement take?
Timing and fees depend on the number of workflows, tools, identities, environments and available access. Share those details during scoping; the proposal defines testing dates, deliverables and retest conditions before work begins.
Is AI red teaming part of Oktsec Assessment?
Yes. Assessment is Oktsec’s offensive security engagement for AI agent workflows. AI red teaming describes the adversarial testing work; Assessment defines the scope, delivery and engineering evidence.
How is this different from testing a model alone?
A model test examines generated behavior. An agent assessment also follows tool calls, credentials, permissions and connected systems to determine whether that behavior becomes a consequential action.
What do we need to start?
Start with one workflow and a description of its agents, tools and access. The engagement defines the environment, permitted testing and deliverables before testing begins.
Does an assessment guarantee that every attack is blocked?
No. An assessment evaluates an agreed scope at a point in time. Its findings help improve controls; changes to tools, permissions or workflows can introduce new paths.
Research on agent attacks and defenses.
Test the workflow you plan to deploy.
Tell us which agent you use and what it can access. We will agree the targets, test conditions and deliverables.