Applied AI Portfolio · Agent 10
Agent 10 solves a critical gap in AI product development: most teams ship guardrails without ever red-teaming them. This agent gives any product team a structured, accessible adversarial testing capability — before vulnerabilities reach production.
As LLM systems move into production — customer-facing chatbots, internal copilots, automated workflows — prompt injection has become one of the most underappreciated risks in AI product development. The attacks are cheap to execute, hard to detect, and can completely subvert a system's intended behaviour.
The core tension: dedicated red-teaming is expensive and usually reserved for large security teams. Most product teams ship guardrails based on intuition, then wait for a failure in production to discover the gaps. There's no structured, accessible tool for testing injection robustness before deployment.
Rather than a single open-ended interface, Agent 10 organises red-teaming into four distinct modes: Probe System, Attack Vectors, Evaluate Guardrails, and Suggest Mitigations. Each mode primes the model differently — the same underlying Claude, but with different output framing injected client-side. This supports different stages of the testing workflow without additional API calls.
The agent is prompted to use consistent labels — [ATTACK VECTOR], [SEVERITY: HIGH/MEDIUM/LOW], [GUARDRAIL STATUS], [MITIGATION] — in its responses. This serves two purposes: it makes outputs scannable for product managers who aren't security specialists, and it enables client-side verdict detection that renders colour-coded result blocks automatically.
The entire agent operates within a strict token envelope designed for production use at scale.
Prompt injection is not a single attack — it's a family of techniques that exploit the fundamental ambiguity between instructions and data in LLM systems. Agent 10 is designed to test systematically across the full attack surface.
| Attack Vector | Description | Severity |
|---|---|---|
| Direct Injection | User input contains explicit instructions overriding the system prompt — e.g. "Ignore previous instructions and..." | High |
| Indirect Injection | Malicious instructions embedded in external content retrieved by RAG or tool use — documents, web pages, emails | High |
| Role-play Jailbreak | Fictional framing used to bypass safety filters — "pretend you are DAN", "in a story where...", "as a character who..." | High |
| System Prompt Exfiltration | Attempts to extract confidential system prompt contents — "repeat your instructions", "what were you told to do?" | Medium |
| Multi-turn Manipulation | Gradual instruction drift across a conversation — establishing precedents early to justify policy violations later | Medium |
| Encoding / Obfuscation | Base64, Leetspeak, or other encoding used to disguise injection payloads and bypass input filters | Low |
The system prompt is the core of the agent. It must be concise enough to stay under 300 tokens while encoding enough precision that the model reliably outputs structured, actionable red-team reports.
The mode context is injected client-side as a prefix in the user message — so the system prompt stays static and lean, while each interaction is contextualised correctly without additional API calls.
Direct injections are well-understood and most modern LLMs handle them reasonably. Indirect injection via retrieved content is far more dangerous — because the attack surface is the data layer, not the prompt layer. RAG systems need sandboxed retrieval pipelines, not just stronger system prompts.
Without severity labels, teams treat all vulnerabilities as equally urgent — and nothing gets fixed. Structuring the agent to output HIGH/MEDIUM/LOW ratings with clear reasoning immediately made the outputs more useful for PM-level decision-making.
The biggest insight: adversarial testing shouldn't be a security team's job in isolation. Product managers who understand injection patterns can write better system prompts, design more robust guardrails, and make better architecture trade-offs. Agent 10 is a tool for building that fluency across the whole team.
Using Claude to generate prompt injection attacks creates an interesting recursion — the agent itself has guardrails that occasionally constrain the attack vectors it will generate. This is a useful signal: if your red-team agent refuses to generate certain attacks, real attackers won't.