Skip to content

feat(ai-red-teaming): wire agentic-probes 2026 attacks into generate_attack #147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rdheekonda wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(ai-red-teaming): wire agentic-probes 2026 attacks into generate_attack #147

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion capabilities/ai-red-teaming/agents/ai-red-teaming-agent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,7 @@ The capability ships 70+ attack strategies covering traditional ML and generativ
| `crescendo` | Multi-turn conversation weaknesses | ~200-500 |
| `goat` | Graph of Attacks with Pruning | ~200-500 |
| `prompt` | Simple single-prompt baseline | ~10-50 |
| `iterinject` | Indirect prompt injection with four-class diagnosis (payload in a tool result / document, not a chat turn) | ~60-200 |
| `rainbow` | Broad risk coverage (MAP-Elites) | ~500-2000 |
| `gptfuzzer` | Template-based fuzzing | ~200-500 |
| `autodan` | Automated adversarial suffix | ~500-2000 |
Expand All @@ -237,7 +238,7 @@ The capability ships 70+ attack strategies covering traditional ML and generativ

| Parameter | Required | Description |
|-----------|----------|-------------|
| attack_type | Yes | Attack name(s). Short: tap, pair, crescendo, goat, prompt, rainbow, fuzzer, autodan, renellm, beast, drattack, inception. Campaign: "tap,pair,crescendo" |
| attack_type | Yes | Attack name(s). Short: tap, pair, crescendo, goat, prompt, iterinject, rainbow, fuzzer, autodan, renellm, beast, drattack, inception. Campaign: "tap,pair,crescendo" |
| goal | Yes | Assessment goal text (pass through exactly as the user provides it) |
| target_model | Yes | Target model — any provider. Use aliases or full litellm path (e.g. "openai/gpt-4o", "bedrock/anthropic.claude-sonnet-4-20250514-v1:0", "azure/gpt-4o", "ollama/llama3.3") |
| attacker_model | No | Attacker model (defaults to target). Same aliases. |
Expand Down
6 changes: 6 additions & 0 deletions capabilities/ai-red-teaming/agents/scorer-catalog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,12 @@

`cot_backdoor`, `reasoning_hijack`, `reasoning_dos`, `escalation`, `goal_drift`

## Evidence-Gate (agentic-probes 2026)

Fire only on real trace evidence (a fired dangerous tool, a completed exfil chain, an activated memory record), never on model narration:

`rce_evidence_gate`, `approval_bypassed`, `trusted_proxy_exfil_detected`, `covert_channel_capacity`, `minja_activation_detected`, `line_jump_fired`, `poison_retrieved_and_steered`

## Format

`json`, `is_xml`
24 changes: 24 additions & 0 deletions capabilities/ai-red-teaming/agents/transform-catalog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,4 +108,28 @@ Use these EXACT names in the transforms array. All transforms are grounded to th

`agent_memory_injection`, `agent_permission_escalation`, `soul_file_injection`, `bootstrap_hook_injection`, `workspace_file_poison`, `skill_dependency_confusion`, `skill_package_poison`, `heartbeat_hijack`, `media_protocol_exfil`

## Tool-Misuse to RCE (agentic-probes 2026)

`yolo_mode_overwrite` (self-approval config overwrite, CVE-2025-53773), `arg_flag_injection` (dangerous flag into an allow-listed binary, CWE-88), `metachar_escape` (metacharacter command chain + egress), `deser_payload` (deserialization-sink payload, CVE-2025-68664)

Pair with the `rce_evidence_gate` / `approval_bypassed` scorers - success requires a real dangerous tool call, not model narration.

## Advanced Exfiltration (agentic-probes 2026)

`trusted_proxy_char_exfil` (per-character leak through an allow-listed proxy - CamoLeak/AgentFlayer/EchoLeak), `tool_arg_covert_channel` (encode data in the pattern of legitimate tool use)

Pair with `trusted_proxy_exfil_detected` / `covert_channel_capacity`.

## MCP Line-Jumping (agentic-probes 2026)

`line_jump_injection` (instruction smuggled via tool-list / notification / resource-listing so it lands pre-invocation)

Pair with `line_jump_fired`.

## Retrieval-Optimized RAG (agentic-probes 2026)

`optimized_rag_poison` (poison tuned to rank for the victim query, then steer)

Pair with `poison_retrieved_and_steered` (requires BOTH retrieval and steer).

**For low-resource language transforms, always use `adapt_language(LanguageName)` syntax.**
70 changes: 70 additions & 0 deletions capabilities/ai-red-teaming/scripts/attack_runner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -408,6 +408,18 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str:
"context_depth": 5,
},
},
"iterinject_attack": {
"module": "iterinject",
"function": "iterinject_attack",
"has_attacker": True,
"default_iterations": 60,
"extra_defaults": {
"early_stopping_score": 0.9,
"beam_width": 6,
"branching_factor": 3,
"context_depth": 5,
},
},
"rainbow_attack": {
"module": "rainbow",
"function": "rainbow_attack",
Expand Down Expand Up @@ -2331,6 +2343,50 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str:
"code": "framing_effect()",
},
"false_dilemma": {"module": "dreadnode.transforms.persuasion", "name": "false_dilemma", "code": "false_dilemma()"},
# Tool-misuse -> RCE (agentic-probes 2026)
"yolo_mode_overwrite": {
"module": "dreadnode.transforms.tool_misuse_rce",
"name": "yolo_mode_overwrite",
"code": "yolo_mode_overwrite()",
},
"arg_flag_injection": {
"module": "dreadnode.transforms.tool_misuse_rce",
"name": "arg_flag_injection",
"code": "arg_flag_injection()",
},
"metachar_escape": {
"module": "dreadnode.transforms.tool_misuse_rce",
"name": "metachar_escape",
"code": "metachar_escape()",
},
"deser_payload": {
"module": "dreadnode.transforms.tool_misuse_rce",
"name": "deser_payload",
"code": "deser_payload()",
},
# Advanced exfiltration (agentic-probes 2026)
"trusted_proxy_char_exfil": {
"module": "dreadnode.transforms.exfil_advanced",
"name": "trusted_proxy_char_exfil",
"code": "trusted_proxy_char_exfil()",
},
"tool_arg_covert_channel": {
"module": "dreadnode.transforms.exfil_advanced",
"name": "tool_arg_covert_channel",
"code": "tool_arg_covert_channel()",
},
# MCP line-jumping (agentic-probes 2026)
"line_jump_injection": {
"module": "dreadnode.transforms.mcp_lifecycle",
"name": "line_jump_injection",
"code": "line_jump_injection()",
},
# Retrieval-optimized RAG poisoning (agentic-probes 2026)
"optimized_rag_poison": {
"module": "dreadnode.transforms.rag_optimization",
"name": "optimized_rag_poison",
"code": "optimized_rag_poison()",
},
}

# Short aliases -> canonical transform name
Expand Down Expand Up @@ -2580,6 +2636,20 @@ def _auto_execute_workflow(filename: str, timeout: int = 3600) -> str:
"rubric_judge": {"type": "builtin", "code": "dn.scorers.rubric_judge()"},
# Data exfiltration (text-based)
"data_exfil": {"type": "builtin", "code": "dn.scorers.data_exfil_detected()"},
# Agentic-probes 2026 evidence-gate scorers
"rce_evidence_gate": {"type": "builtin", "code": "dn.scorers.rce_evidence_gate()"},
"approval_bypassed": {"type": "builtin", "code": "dn.scorers.approval_bypassed()"},
"trusted_proxy_exfil_detected": {
"type": "builtin",
"code": "dn.scorers.trusted_proxy_exfil_detected()",
},
"covert_channel_capacity": {"type": "builtin", "code": "dn.scorers.covert_channel_capacity()"},
"minja_activation_detected": {"type": "builtin", "code": "dn.scorers.minja_activation_detected()"},
"line_jump_fired": {"type": "builtin", "code": "dn.scorers.line_jump_fired()"},
"poison_retrieved_and_steered": {
"type": "builtin",
"code": "dn.scorers.poison_retrieved_and_steered()",
},
}

GOAL_CATEGORY_ALIASES: dict[str, str] = {
Expand Down
Loading