Cortega Red Team
Run adaptive conversations, poisoned-memory tests and unauthorized tool-access attempts. Review what the attacker controlled, how the agent responded and the evidence behind each finding.
Explore the attack tests →Application test coverage
Included application scenario
Get a support agent to grant a refund outside the policy.
Explanatory test sequence, not a recorded campaign.
Included application scenario
Make the agent bypass an identity or transaction rule.
Explanatory test sequence, not a recorded campaign.
Included application scenario
Test whether a convincing pretext overrides a boundary.
Explanatory test sequence, not a recorded campaign.
Included application scenario
Redirect contact or recovery information without proper authority.
Explanatory test sequence, not a recorded campaign.
Included application scenario
Obtain protected records by claiming investigative authority.
Explanatory test sequence, not a recorded campaign.
Included application scenario
Turn a planted memory into an unauthorized later action.
Explanatory test sequence, not a recorded campaign.
Included application scenario
Fetch or search a record under an identity expected to be denied.
Explanatory test sequence, not a recorded campaign.
Targets: configured model endpoints, JSON HTTP chatbots and supported read-only MCP servers. Each assessment declares an authorized identity and boundary.
The basis of the tests
Inspect attack definitions adapted from published research, including escalation after refusal, long-context pressure and injected tool output.
Policy overrides, role-play, prompt injection, credential abuse and cyber-harm requests. Harmless security questions measure unnecessary refusals.
JailbreakBench basis ↗An attacker generates its next turn from the actual reply. The pack includes gradual escalation and revised attempts after a refusal.
Crescendo research ↗Pack 8, 16, 32 or 64 apparently compliant exchanges into one request, then ask for the target behavior. Include benign long-context controls.
Many-shot research ↗Scripted escalation, refusal repair and untrusted content in email, payment, travel, ticket and memory workflows.
AgentDojo basis ↗The seven application scenarios above are campaign tests. The four research packs are inspectable benchmark definitions, not additional executable campaign types. The adaptive pack also draws on GOAT and PAIR/TAP patterns; the scripted pack includes Crescendo and PAIR/TAP-style trajectories. No claim is made to implement every method or reproduce a published leaderboard.
How to interpret an outcome
A judge identifies a possible policy breach. Inspect the input, reply and boundary.
A pre-seeded restricted test marker appears in the target’s reply.
A simulated tool action crosses its configured boundary.
A timeout, infrastructure failure or ambiguous error provides no defense result.
Published model-safety evidence
The application can inspect 640 saved samples from the historical two-arm model evaluation. This imported benchmark is separate from application campaign results.
