redteam-an-agent

# Red-team an agent · the real process This is the process a capable red-teamer actually follows against one specific agent. It is **not** a scanner and **not** a fixed payload list — the work is *adaptive*: you read the target's own code, form hypotheses about how it can be reached by an attacker, and settle each one with an exploit. The value is the **credible verdict** (what breaks, what holds, and why), not any single "gotcha." > Written from real engagements. Every rule below exists because skipping it produced a wrong > conclusion — an over-claimed break, or a "vulnerability" that was really just local access. ## Authorization & safety — read first Follow every rule in [`../README.md`](../README.md): authorized target only, **disposable environment only**, never handle the target's real credentials (the owner configures provider keys; you reference them, never see or print the value), harmless proof markers only, no destruction/ exfiltration/persistence, method-not-weapons, responsible disclosure. Otherwise **stop**. ## Phase 1 — Recon THIS target (map it; assume nothing) Read the target's *own* source. Do not assume "lightweight = weak" or "popular = safe." Map the attack surfaces and record each **defense as a fact**: - **Tool / command execution:** what can it *do* (shell, file, network, browser, real-world actuators)? Is execution gated (human/LLM approval)? Sandboxed? Confined to a workspace? A regex deny-list? **What are the defaults** (a control that ship...