Attack tests

Attack your agent with the built-in attack library, see what got through, and fix it before real users find it.

Before you start

• Your repository is connected with agentfox init (see the Quickstart), and init is still running. The attacks run your agent on your machine, with every tool faked.

1. Run the attack test

   Open Agents and pick the project. With nothing selected on the map, the panel shows the Attack test: one row per attack set. Press the play button to run it. Use + to add more sets from the library.

   

2. Read what got through

   Each row shows how many attacks in that set got through. A set that got through also raises an issue on Issues, with each attack that was tried and the verdict it got.

3. Add guardrails and test again

   Press Add and test again. It turns on the basic guardrails and reruns the same attacks. Each row then reads no guardrails → basic guardrails. For what is still getting through, add a custom rule or tighten tool access, then run it again.

4. See past runs

   Testing → Attack tests runs the library against any agent and lists every past run: attacks tried, stopped, got through.

   

   In the appCLI

   Choose an agent under Run attack test and press Run.

How to read a result

• Blocked: a rule that blocks stopped it. Live traffic is stopped too.
• Would block (watching): only a rule in Watch stopped it. Real requests still go through until you switch that guardrail to Block.
• The library includes a few ordinary requests. If one of those is refused, the test reports it as over-blocking.
• A clean run means these attacks were stopped, not that every attack would be. Adaptive mode retries blocked attacks in disguised forms; see In CI and in production.

Try one message

Testing → Try it checks a single message or tool call against an agent's real rules and shows the verdict and the rules that matched. It is not counted as traffic.

The public playground

The playground needs no account. It has three sample agents: try a prompt attack, or ask an agent to call a tool it was not given, and see the decision and why. Press switch to enforce to see watching (it calls this observe) turn into blocking. No model runs and no tool does anything real. A sandbox expires 30 minutes after your last action; don't paste real data into it.

If something goes wrong