Security
Whether an attacker can make your agent leak, bypass, or misuse what it can access, including:- Prompt & instruction attacks: leakage, override, jailbreaks, indirect injection
- Disclosure: secrets, debug access, model and tool discovery
- Agentic abuse: unauthorized tool use, privilege escalation, task hijacking, data exfiltration
Safety
Whether your agent produces harmful content or advice, including misinformation, violent or criminal facilitation, radicalization, illegal-goods guidance, sexual content, and unsafe-practice advice.What counts as exposed
Agents rarely emit one flat answer. A response arrives as a stream of frames — thinking or reasoning blocks, tool calls, status events, debug fields — and only some of them become the text your UI renders. A leak in any of those frames is a finding, at full severity. If our harness read it over your agent’s own documented interface, so can any other client reading that stream. Whether your production UI happens to hide the frame is a property of that UI, not of the agent, and a second client — a mobile app, a partner integration, a browser devtools panel — is not bound by it. So a finding can be real even when the answer opens with a refusal — either because the evidence sits in a frame beside the answer, or because the refusal itself quotes the rule it is enforcing. The finding detail shows the full answer and labels each surrounding channel with your agent’s own name for that frame type. Same category, same severity rubric; the label is attribution. Channel evidence is captured for runs recorded from the release that introduced it onward. Findings from earlier runs show the answer and say plainly that the surrounding frames were not kept.The machine-readable catalogue
This page is the summary; the exact category list is available programmatically.GET /api/v1/category (or the list_categories MCP tool) returns each security
category with its key and description. Those keys are what you pass to focus a run
on part of the taxonomy — see
Scoped, change-relevant runs.
Standards
Findings map to the frameworks your reviewers use:- OWASP Top 10 for LLM Applications (2025)
- OWASP Agentic Top 10 (2026)
- MITRE ATLAS