agent-redteam-fuzzer
An adversarial prompt-injection fuzzer for tool-calling agents: 5 attack categories fired at a target support agent, measuring which ones trigger a tool call without real authorization.
What it does
It builds both sides of the problem: a small, realistic target agent with three tool tiers (safe, sensitive, critical), and a fuzzer that tries to break it. The bug is a confused deputy: the agent trusts bracketed system banners, and nothing stops a user from typing one.
Measured results
15 of 45 payloads succeed overall, but the number hides a sharp split. Banner and delimiter injection reach 83%. Role confusion, instruction override and nested tool-result injection are 0%, as expected. They are a control group, included so the result is not cherry-picked.
A second finding came from the failures: every failed payload in the strong categories targeted the critical tier, which needs two forged claims instead of one. The same parsing bug is defeated by requiring two independent factors, and a regression test locks that in.
Stack
Python · FastAPI · SQLAlchemy · React · Hypothesis · Pytest
Honest notes
The target agent is deterministic and rule-based, not a live LLM, because the build environment had no model API access. The vulnerability class is the same either way. The database layer targets Postgres and is tested on SQLite.