Offensive AI

Document model/provider, user roles, data classes, tool permissions, allowed tests, and explicit no-go actions before testing begins.

Rules of engagement addendum, architecture sketch, permission inventory.

Test direct and indirect instruction conflicts across user input, retrieved content, files, tickets, web pages, and third-party connectors.

Prompt, source content, model response, guardrail behavior, impact notes.

Run at least one end-to-end authorized abuse path that starts with adversarial input and reaches an unsafe answer, data exposure, permission decision, or attempted tool action.

Abuse-case objective, fixture data, model context, response, downstream effect, and business-impact statement.

Convert accepted findings into repeatable evals with expected safe behavior, owner, severity, and rerun instructions.

Prompt/eval file, fixture IDs, scoring rule, model version, prompt version, pass/fail output.

Verify that generated output cannot trigger unsafe rendering, hidden links, credential disclosure, or automated downstream actions.

Rendered output capture, sanitizer behavior, blocked content examples.

Confirm prompts, retrieval hits, tool calls, approvals, and high-risk denials are logged with enough context for incident response.

Log samples, alert rules, retention policy, privacy notes.

Test cross-tenant retrieval, document-level ACLs, stale index entries, poisoned chunks, and citation integrity.

Corpus sample, retrieval trace, denied-document test, citation diff.

Seed harmless poisoned documents, cross-tenant canaries, stale index records, and citation-laundering fixtures to prove retrieval trust-boundary failures.

Document ID, chunk ID, retrieval score, source ACL, answer text, citation comparison, and canary result.

Review upload, crawl, sync, and connector paths for malicious instructions, hidden text, metadata injection, and unsafe file parsing.

Ingestion path map, sample poisoned document, sanitizer output.

Confirm read tools cannot access secrets, unrelated tenants, local credential stores, or out-of-scope repositories.

Allowlist, denied read tests, data-boundary notes.

Prefer local or approved enterprise endpoints, redact secrets before prompts, and record exactly where client data is processed.

Data-flow record, redaction examples, approved endpoint list.

Verify sensitive prompts route only to approved local/private endpoints and fallback behavior does not leak data to public providers.

Routing policy, fallback test, denied external call.