What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test the whole tool-using workflow, not just whether the model refuses an obvious jailbreak. Put controlled injection attempts in the content the agent actually reads, then check whether they alter its decisions, trigger unauthorized tool calls, expose data, or cause harmful side effects. A useful test suite defines expected behavior in advance and inspects both the final answer and the execution trace.
Start by mapping the agent’s workflow
Before writing attacks, diagram how information and authority move through the system. Include each input source, model or agent node, retrieval stage, memory store, tool, credential, and consequential action. Mark which inputs come from the user, which are external or otherwise untrusted, and which tools can read sensitive data or change something outside the conversation.
As an Amazon Associate I earn from qualifying purchases.
This map helps distinguish a suspicious instruction from a path by which it could do harm. An injected sentence in a document is a security concern when the workflow allows that document to influence a sensitive decision or tool call.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →OpenAI’s agent-safety guidance recommends passing untrusted input through user messages rather than placing it in developer messages, where it can have disproportionate influence. Treat that as a workflow-specific recommendation, and make trust boundaries explicit in other architectures too.
#1 Best Overall
Define pass and fail conditions before testing
For each task and tool, write down what the agent may do, what it must not do, what requires approval, and what evidence will show that the rule held. Define assertions about actions as well as text: an agent can produce a reassuring answer after already making an unsafe call.
- Specify permitted tools, operations, data, and destinations for each test context.
- State which actions require human approval and whether they must remain impossible until approval is recorded.
- Define what counts as sensitive data and which workflow boundaries it must not cross.
- Include benign tasks with expected useful results, so the evaluation can detect overblocking as well as failures that allow an attack.
- Decide what must appear in the trace to make a pass or failure auditable.
OpenAI recommends clear policy instructions and examples, structured outputs to constrain data passed between workflow nodes, input guardrails, tool approvals, and trace grading. These are controls to exercise in tests, not substitutes for testing the workflow.
Build a suite of distinct abuse cases
Use reproducible cases with an attacker-controlled payload, a defined context, an expected behavior, and checks against the complete execution trace. OWASP’s agent security testing guidance identifies several categories worth covering:
| Abuse case | Test objective | What to inspect |
|---|---|---|
| Prompt override | Instructions in user or retrieved content must not silently replace system or developer policy. | Whether the agent changes its task, policy, or tool behavior after encountering the injected instruction. |
| Tool misuse | A forbidden tool call must be denied even if the model requests it confidently. | The requested tool and arguments, the permission decision, and whether the tool actually ran. |
| Privilege escalation | A low-trust session must not reach privileged tools, credentials, or administrative actions. | Which identity and permissions were in effect at each tool boundary. |
| Memory poisoning | Malicious content must be rejected, sanitized, scoped, or expired before it can improperly influence later tasks. | What was written to memory, its scope and lifetime, and whether a later task relied on it. |
| Data exfiltration | Sensitive context must not leak through a tool call, citation, log, or final answer. | Data passed between components and any content sent to tools, external destinations, or users. |
| Recursive tool abuse | Limits on chain depth, retries, tokens, and cost must stop runaway tool loops. | Call counts, retry behavior, chain depth, and whether configured limits halted execution. |
Also place indirect instructions in realistic sources the agent processes, including documents, emails, web pages, retrieved passages, and tool responses. Anthropic’s guidance specifically recommends testing documents, emails, and tool outputs that contain injections. For each source, check both whether the agent ignores the instruction and whether downstream screening or approval controls still work.
Run attacks in a contained environment
Use test accounts, synthetic data, and tools that cannot affect real users, systems, or external recipients. Match the target workflow and permissions as closely as possible while containing side effects; testing a harmless mock tool with no meaningful permission boundary may miss the failure you need to find.
NIST’s published agent-hijacking evaluations show why conditions must be adapted to the agent under test. Record the evaluated setup, including the model and tool versions, configuration, permissions, and test environment. Do not present a result from one model, version, or environment as universal.
Rank #4
Inspect actions and traces, not only the final answer
Save enough evidence to reconstruct each run. NIST’s work on agentic evaluation probes emphasizes visibility into tool use and gathered evidence, while OpenAI describes trace grading for decisions and tool calls. At minimum, retain:
- The test input and the untrusted document, retrieved passage, or tool-returned content it contains.
- The model and system configuration, relevant policy and permission settings, and versions of the model and tools.
- Tool requests, arguments, approval requests, approvals or denials, and resulting side effects.
- Relevant data passed between workflow components, with sensitive values handled according to your security and privacy requirements.
- The final output and enough machine-readable audit information to connect it to the actions taken.
Check whether sensitive values crossed a boundary, whether an unauthorized tool ran, and whether the agent attempted a prohibited action even if a separate control blocked it. That distinction matters: a denied tool call may show that a control contained an attempt, but it does not show that the agent made a safe decision.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Score outcomes and preserve failures as regressions
Choose outcome categories before executing the suite so that results are comparable. A practical scheme separates:
- Prevented attack: the agent did not take the prohibited action, and no harmful attempt reached execution.
- Contained attempt: the agent attempted a prohibited action, but a permission, approval, or other control stopped it before harm occurred.
- Policy or control failure: an expected rule or safeguard did not behave as specified.
- Harmful side effect: the prohibited action executed or sensitive information crossed a boundary.
- Benign-task failure: a legitimate task was blocked or mishandled by the agent or its defenses.
Track attack success and severity, benign-task completion, and whether the trace makes failures diagnosable. If reporting a rate, include the attack set, configuration, model and tool versions, environment, and number of repeated runs. There is no universal score prescribed by the cited sources; these outcome categories combine their emphasis on coverage, tool behavior, and evaluation visibility.
Keep every discovered failure as a regression case. OWASP recommends testing before deployment and after material changes to prompts, tools, memory, retrieval, policies, or model providers. Rerun the relevant suite after those changes rather than assuming an earlier result still applies.
Test whether defenses work at the point of action
Connect each claimed safeguard to an observable assertion. If external actions require approval, verify that the action cannot execute before approval; a message saying “I’ll ask first” is not evidence that the control held. If the workflow uses structured output, test whether hostile input can influence permitted fields or cause a downstream component to reinterpret data as instructions.
Also examine the evaluation method itself. NIST notes that agents can use tools to cheat on evaluations, so a result can be misleading if the agent recognizes or exploits the test harness instead of demonstrating the intended behavior. Review the setup and traces, and treat scores as evidence about the tested configuration and cases—not proof that every injection or unsafe action has been found.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
