Agent breaker

[eliyacohen-hub]

Agent Breaker: Multi-turn red-team probe for agentic LLM applications

Adds a new probe (agent_breaker.AgentBreaker) that performs automated security testing of agentic LLM applications — systems that use tools (e.g. code execution, database queries, file access, API calls).

A red team model analyzes each tool for vulnerabilities, generates targeted exploits, attacks the agent in multi-turn conversations (learning from failures), and verifies attack success.

Key features:

• Auto-discovery — if no tools are defined in config, the probe queries the target agent to discover its tools automatically
• Parallel tool attacks — configurable max_parallel_tools (default: sequential)
• Adaptive attacks — each attempt analyzes previous prompts/responses to improve exploits
• Early stopping — stops attacking a tool immediately upon success

OWASP LLM Top 10: LLM01 (Prompt Injection), LLM07 (Insecure Plugin Design), LLM08 (Excessive Agency)

Verification

• Create a scan config YAML pointing to your target agent REST endpoint
• python -m garak --config scan_config.yaml
• python -m pytest tests/probes/test_agent_breaker.py tests/detectors/test_detectors_agent_breaker.py -v
• Verify auto-discovery works when agent.yaml has no tools defined
• Verify parallel and sequential tool attacks both work correctly
• Verify results display: agent_breaker.AgentBreakerResult: FAIL ok on X/Y

Environment notes

• Requires a red team model via NVIDIA Inference API, or the user can change it to another llm endpoint
• Requires a target agent exposed as a REST endpoint (or any garak generator)
• No specific hardware requirements (all inference is remote API calls)

[github-actions]

DCO Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by just posting a Pull Request Comment same as the below format.

---

I have read the DCO Document and I hereby sign the DCO

---

_{You can retrigger this bot by commenting recheck in this Pull Request}