llm red teaming Shipped
What this lens looks for
Adversarially test LLM/agent systems against the OWASP LLM Top 10 (v2025): direct + indirect prompt injection (LLM01), jailbreaks, sensitive-info disclosure (LLM02), improper output handling (LLM05), excessive agency/tool abuse (LLM06), system-prompt leakage (LLM07). Indirect injection (poisoned RAG/tool output) MUST be tested explicitly; use a version-pinned attack suite; run in CI on prompt/tool/model/RAG changes; test the deployed config (system prompt + guardrails + tool wiring), not the bare model.
What its verifier checks
Indirect prompt injection and jailbreaks tested explicitly, not just direct user-input injection; excessive-agency tests confirm the agent cannot exceed least-privilege tool/permission scope even when instructed; attack-suite version pinned per run for reproducibility; deployed configuration (not the bare model) under test; an explicit attack-success-rate (ASR) threshold gates release, ASR tracked over time, and a regression blocks release; each finding recorded with a reproducer, OWASP mapping, and severity; model output treated as untrusted downstream (least-privilege tools, human-in-the-loop for destructive actions, output validation).