Red teaming · Reference

Configuration

The campaign request separates the vulnerability, delivery method, target and execution budget. This keeps simple tests short while allowing Promptfoo-shaped plugin entries when migration needs more metadata.

Request schema

curl -sS -X POST https://www.agentleak.org/api/projects/$PROJECT_ID/redteam \
  -H "Cookie: $AGENTLEAK_SESSION" \
  -H 'content-type: application/json' \
  -d '{
    "vertical": "healthcare",
    "adversary_level": "A2",
    "plugins": [
      "pii:session",
      {"id":"coding-agent:secret-env-read","numTests":2,"config":{"examples":[]}}
    ],
    "strategies": ["basic", "base64", "crescendo"],
    "n": 10,
    "mode": "scripted"
  }'

verticalhealthcare, finance, legal, hr or customer_support.

adversary_levelA0 latent failure; A1 public-input attacker; A2 tool, RAG or shared-state attacker.

nGlobal scenario budget, 1–20.

pluginsString IDs or Promptfoo-style objects with id, numTests and config.

strategiesDelivery IDs; independent from vulnerability selection.

modescripted, live or auto. Prefer an explicit mode in automation.

targetProject agent configuration, or authorized base_url/model override.

Plugin selection

Use either plugins or plugin_preset. Object entries preserve Promptfoo's id, numTests and config shape in campaign coverage. AgentLeak uses n as the hard campaign budget.

"plugins": [
  "pii:direct",
  {"id":"rag-poisoning","numTests":3,"config":{"examples":[]}}
]

Strategy selection

Use either strategies or strategy_profile. A plugin answers “what can fail”; a strategy answers “how the probe is delivered.” AgentLeak builds their Cartesian matrix and truncates it to the requested budget.

Execution targets

scripted

Offline deterministic trace with intentionally vulnerable behavior.

live

Requires a configured endpoint and fails closed when it is unavailable.

auto

Uses live only when a project or request explicitly configures endpoint and model.

Adversary levels

A0No active attacker. Tests accidental retention, delegation and logging failures.

A1External attacker controls public inputs but not trusted tools or memory.

A2Internal/strong attacker can control tool output, retrieved content or shared state.

Validation and limits

20 scenariosMaximum per API campaign; split larger suites into stable batches.
100 pluginsMaximum distinct plugin IDs per request.
Unknown IDsRejected with HTTP 400; inspect /api/redteam/catalog before generation.
No matchRejected when the selected adversary level cannot exercise any chosen class.

Complete examples

Use privacy_core for data disclosure, agent_core for tools/RAG/memory/roles, tool_security for callable boundaries and complete for every native AgentLeak plugin.

# Project settings define the authorized agent endpoint and model.
# mode=live never falls back silently to a scripted target.
curl -sS -X POST https://www.agentleak.org/api/projects/$PROJECT_ID/redteam \
  -H "Cookie: $AGENTLEAK_SESSION" -H 'content-type: application/json' \
  -d '{"plugin_preset":"agent_core","strategy_profile":"balanced","mode":"live","n":10}'