Part 1 of 4 · 1 min read
Overview
Defences feel convincing until someone attacks them. Interviewers ask "how do you know your agent is secure?" The answer is not "we added guardrails", but "we attack it systematically, report success rates with intervals, test fixes on held-out attacks, keep a regression suite and re-run on every change".
About the example, and what is real
Real: the attack generator, the runner with Wilson intervals and per-category breakdown, the n-gram blocklist learner, the action gate, the attempts-needed calculation, the regression-suite extraction, the CI exit-code rule and the 15 tests in code/mini-redteam. Assumed: the agent is an imitation that attempts an attack with probability equal to an assumed per-family susceptibility (0.20 to 0.50) times a carrier factor (0.7 direct, 1.0 otherwise), halved for obfuscated text; attack severities (100, 50, 80, 20, 30); which actions each gate blocks. Not real: no language model was attacked and no red-team tool was run; attack strings are generic and non-operational.