AI security topic
LLM and AI-agent red teaming
Updated · Class: Reviewed claim · Review: Reviewed by Dread team guidance · Maintainer: Dread Research · Contact [email protected]
LLM red teaming is structured adversarial testing of language-model behavior. For AI agents, the scope expands to tools, memory, retrieval, authorization, and workflow side effects.
What to test
A useful red-team plan tests both model-only behavior and system behavior. The goal is not to collect shocking transcripts; the goal is to identify reproducible failure modes and the controls that reduce them.
- Prompt injection and instruction hierarchy failures
- Sensitive data disclosure and retrieval leakage
- Unsafe tool calls and authorization bypass
- Policy boundary failures under multi-turn pressure
- Behavior drift after fine-tuning, baking, or system changes
Evidence standard
Each finding should include the exact input, model or agent version, relevant system instructions, observed output, reproduction steps, impact analysis, and a proposed fix. Claims without traces should be treated as hypotheses.
Crawler identity coverage
Agent-mediated browsing tests should record request identity, headers, retrieved representation, and whether the agent discloses representation variance. Janus is a small public experiment showing why crawler identity belongs in red-team coverage.
Authorized red-team harness: scope, prohibitions, and findings
The dread.ltd safety model describes Bread research surfaced through the Dread research lane. The harness is designed for owned infrastructure, scoped test pages, and publishable safety boundaries rather than operational detail.
- dread.ltd is an authorized red-team harness that runs only against infrastructure the project owns. Its question is narrow: when an agent browses a page, does the text on that page change what the agent does?
- Consent comes first. The harness studies agent behavior against the project's own domains and test pages. It is not a general-purpose prompt-injection toolkit, and it is not pointed at third-party sites.
- A standing set of prohibitions is built into the design rather than promised in a policy: no credential collection, no arbitrary file reads, no environment-variable dumps, no capture of arbitrary command output, no shell-pipe or installer instructions, and no automatic exploitation.
- Attribution uses server-generated synthetic canaries, never a real secret. Callback payloads are bounded and schema-validated, and a callback can only reach an endpoint the project owns.
- There is no public dashboard and no model in the loop choosing what to inject. Experiment control is authenticated and local to the operators.
- The research is about representation-dependent retrieval. The same URL can present differently depending on who is asking, and an agent acts on what it is shown rather than on what a human would see in the same place.
- Measured finding, on presentation: an instruction placed in an HTML comment or inside a noscript block was not acted on, while the same instruction in visible page text was. What reaches the model is the rendered, agent-visible content, not merely the presence of text in the document.
- Measured finding, on compliance: in controlled trials against the project's own test page, a current coding agent running with automatic permissions did not follow page-injected callback instructions in any of seven trials across three generations. Callbacks occurred only when the operator's own top-level prompt explicitly authorized a canary-only request, which shows the measurement wiring works while the agent declined to take instruction from the page.
- That result is bounded. It covers the instruction variants tested, not all possible instructions. It is not a claim that any agent resists every prompt-injection variant, and it is not a general claim about any vendor's product.
- Relation to Janus: Janus demonstrates selective delivery, where one URL returns different pages according to the identity a request presents. dread.ltd is the discipline around that capability, measuring representation-dependent agent behavior without turning the technique into credential collection, hidden monitoring, or request-classification overclaims.
DREAD.TECHNOLOGY relevance
The site's Bread materials discuss durable behavior changes and model adaptation. Those ideas make red-team coverage more important because adapted systems need pre-change and post-change evaluation.