Skip to main content
Every red-team run is assembled from a catalog of attack types. Each type has a set of intents — the outcome the attacker is trying to force — and vectors — the tactics it uses to get there. Bluejay selects intents and vectors automatically based on the attack type and your agent’s surface; you don’t have to hand-author them.

​
Attack Types

A caller impersonates a real customer and uses pressure, urgency, partial details, and false authority to trick the agent into skipping identity checks.Intents: Credential Reset · Account Takeover · Push Payment / Move Funds · Information Harvest · Card Data Extraction · Synthetic ID / New AccountVectors:
  • Bluffs with partial info
  • Plays on sympathy and urgency
  • Pretends to be someone official
  • Claims to be calling from abroad
  • Dodges extra verification (OTP / 2FA)
  • Claims a previous rep already helped
  • Tricks it into taking a gated action without auth
  • Gets it to confirm something false
The caller feeds the agent crafted wording designed to make it ignore its rules, reveal its instructions, or act outside its scope.Intents: System Prompt Disclosure · Guardrail Override · Unauthorized Action · Data Exfiltration · Persona HijackVectors:
  • Tells it to ignore its rules
  • Hides the ask inside a pretend scenario
  • Pretends to be the system
  • Disguises the wording (encodes, splits it up)
  • Hides it inside pasted text
  • Forces a tool to fire (injection → gated action)
  • Makes it emit unsafe output (links, HTML, code)
Attacks the voice channel itself rather than relying on persuasion alone.Intents: Information Harvest · Account Takeover · Push Payment · Credential ResetVectors:
  • Exploits the keypad / tone channel (DTMF bypass)
  • Weaponizes delivery and interruptions (barges in mid-verification)
  • Sells an insider persona through the soundscape (office ambience pretext)
Structure exploits specific to text channels such as chat and SMS.Intents: System Prompt Disclosure · Guardrail Override · Unauthorized Action · Information Harvest · Card Data ExtractionVectors:
  • Forges chat-template tokens
  • Wraps the ask as a configuration policy
  • Primes with a fake compliant history
  • Hides state in a fenced block
  • Encodes the instruction
Tests whether the agent can be walked off-topic and into producing harmful content. Unlike the types above, the target isn’t data the agent holds or an action it can take — it’s the text the agent itself produces.Harm categories: Violence, Weapons & Terrorism · Illegal Activity & Illicit Goods · Harassment, Hate & Threats · Sexual & Non-consensual Intimate Content · Self-harm, Suicide & Disordered EatingVectors:
  • Never names the artifact, assembles it from innocuous parts (benign decomposition)
  • Wraps the ask in fiction (novel, screenplay, game, training scenario)
  • Claims a role that would plausibly need it (nurse, chemist, inspector)
  • Inverts it into a safety question (“what should someone avoid”)
  • Aims the harm at a fabricated named third party (harassment, threats, defamation)
  • Presents as a caller in crisis (duty-of-care probe, not a jailbreak)
Findings land on a separate Content Safety Scorecard rather than an OWASP category.
More attack types — Voice Cloning, Tool Invocation Hijack, Volumetric / DDoS, and Compliance & Policy Probe — are on the roadmap and appear as coming soon in the launcher.

​
Techniques

Under the hood the attacker draws on a transport-agnostic library of proven adversarial moves grounded in published research (persuasion tactics such as authority endorsement, foot-in-the-door, evidence-based persuasion, social proof, reciprocity, and false urgency, alongside jailbreak-style prompt-escape methods). On each turn it selects one technique, and rotates to an untried one whenever the agent refuses — so a run doesn’t loop on a tactic your agent already shrugged off.

​
OWASP Coverage

Security findings roll up to the OWASP LLM Top 10, so a run produces a scorecard you can report against a recognized standard. Every run reports the following categories:
Some categories may report Not Tested on shorter runs. Bump the intensity to Thorough for the broadest coverage across categories.

​
Content-Safety Coverage

The OWASP LLM Top 10 has no category for harmful content, so content-harm findings are graded on their own scorecard, keyed by harm category and aligned to the MLCommons AILuminate hazard taxonomy. On the secondary framework map they land on MITRE ATLAS AML.T0048 — External Harms. A content failure alone is enough to fail a run. See Content Safety for the categories, the scoring shape, and the evidence-redaction policy.