ai-agent-redteam

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

AI Agent Red Teaming

Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing (see ai-security): the attack surface here is the agentic pipeline — untrusted data channels, tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement.

When to Activate

• Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter
• Testing RAG / email / browser assistants for indirect or zero-click prompt injection
• Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping
• Assessing persistent memory / long-term context for poisoning and belief drift
• Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions
• Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR
• Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Indirect / zero-click prompt injection (EchoLeak-class)	T1566.002 / AML.T0051.001	CWE-1427	references/indirect-prompt-injection.md	scripts/indirect_injection_forge.py
RAG corpus poisoning & markdown/image exfiltration	T1567 / AML.T0070	CWE-1426	references/indirect-prompt-injection.md	scripts/indirect_injection_forge.py
Browser-agent hijack (Comet/CometJacking, Atlas)	T1071.001 / AML.T0051	CWE-1427	references/indirect-prompt-injection.md	scripts/indirect_injection_forge.py
MCP tool poisoning / line-jumping	T1059 / AML.T0053	CWE-1427	references/mcp-tool-poisoning.md	scripts/mcp_tool_poison_server.py
MCP rug-pull (silent redefinition)	T1554 / AML.T0010	CWE-494	references/mcp-tool-poisoning.md	scripts/mcp_tool_poison_server.py
Persistent memory poisoning (MINJA/MemoryGraft)	T1565.001 / AML.T0070	CWE-349	references/memory-context-poisoning.md	scripts/memory_poison_minja.py