Rules of engagement
Scope, target environment, safety boundaries and escalation path agreed in writing before anything is sent.
Warden · Agentic Assurance
An agent that has never been attacked is an assumption, not a control
Adversarial testing of your live agents by the team that builds Argus — prompt injection, tool abuse, privilege chaining and exfiltration, run against the system as deployed rather than against a model in isolation.
Model evaluations do not test your system
A benchmark tells you how a model behaves on a prompt. It tells you nothing about what happens when your agent reads an attacker-controlled document and then calls a tool that has your credentials attached.
- Injection arrives as dataThe payload is in the ticket, the PDF, the web page or the calendar invite the agent was asked to summarize.
- The chain is the vulnerabilityIndividually safe tools compose into an exfiltration path once one of them can be steered.
- Guardrails are tested by adversaries, not by unit testsA filter that passes your own examples is not evidence against an attacker who gets to choose the input.
How the exercise runs
Reconnaissance
Map the agent's tools, memory, retrieval sources and trust assumptions — the surface an attacker would work from.
Campaign execution
Injection, tool abuse, privilege chaining, memory poisoning and exfiltration attempts, run adaptively rather than from a fixed checklist.
Retest
After remediation, the attacks that succeeded are replayed so the fix is demonstrated rather than asserted.
What you hold at the end
- Reproducible attack traces for every finding, with the exact inputs used
- Findings rated by achieved impact, not by theoretical severity
- The specific boundary change that closes each one
- A retest report showing which attacks no longer succeed
- An executive read-out that distinguishes what was proven from what was inferred
What runs underneath
Argus is delivered as a Warden engagement rather than as software you install.
Find it in an exercise
The alternative is finding it in an incident, where you also have to explain why nobody had looked.