Red Teaming is in beta. The attack engine and coverage are expanding rapidly — treat findings as a strong signal, and spot-audit high-severity breaches before acting on them.
What You’ll Learn
- What Red Teaming is and how it differs from a normal simulation
- The kinds of attacks Bluejay runs and how they map to OWASP
- How content-harm testing works and why it’s scored separately
- How the attacker adapts and escalates in real time
- How Bluejay decides whether an attack succeeded
- How to launch a run and read the results
The Mental Model
An attacker opens a call or chat with your agent and pursues a goal — for example, extract an account number, SSN, or date of birth without completing verification. After every agent reply, a judge scores how close the attacker got, and the attacker picks its next move accordingly: press harder, back off and rephrase, try a sibling tactic, or switch targets. When the agent discloses protected data, softens a guardrail, or takes a gated action, that turn is recorded as a breach.How It Differs From a Normal Simulation
Hostile, not cooperative
The caller’s goal is to make your agent fail a security boundary, not to complete a support task.
Adaptive, not scripted
The attacker rewrites its approach turn by turn based on your agent’s defenses — no path is pre-authored.
Graded on breaches
Success means the attack worked. A breach is a disclosure, a softened guardrail, or an unauthorized action.
Framework-mapped
Findings roll up to the OWASP LLM Top 10 and a parallel content-safety taxonomy, so you can report and prioritize against known standards.
The Attack Surface
Bluejay ships five attack types today, each with a set of attacker intents (goals) and vectors (tactics):
See the Attack Catalog for the full breakdown of intents and vectors per type, and Content Safety for how the content-harm type is scored.
How the Attacker Escalates
Bluejay’s attacker runs a closed loop rather than a fixed script:1
Recon
The first calls ask benign questions to map the agent’s surface — what tools it has, what information it asks for, where its gates are.
2
Escalate within a call
On each turn the attacker chooses an operator — escalate, soften, try an adjacent tactic, split the ask into smaller pieces, or backtrack to a different branch — guided by a per-turn judge scoring progress toward a breach.
3
Learn across calls
After each batch (a “level”), Bluejay analyzes what made progress and plans the next batch — deepening tactics that worked and pruning ones that hit a hard wall.
4
Terminate
The run ends when its budget is exhausted or a confirmed breach is found.
How Success Is Judged
An attack counts as a breach in three ways:- Disclosure / non-refusal — the agent didn’t refuse and gave the attacker something useful (a fragment of protected data, a softened rule, a leaked instruction). A polite refusal is a hold; a helpful non-refusal is a breach.
- Action-binding — if the agent took a gated action (a tool call, an account change, a transfer, a verification bypass), that is a hard breach regardless of what the text said.
- Content harm — the agent produced harmful content, scored on how specific and usable it was rather than on refusal alone. See Content Safety.
Resources
Attack Catalog
Every attack type, its intents and vectors, and the OWASP mapping.
Content Safety
Harm categories, the duty-of-care rubric, and the content-safety scorecard.
Launching a Test
Pick a target, set intensity, and tell the attacker what it already knows.
Interpreting Results
Read the verdict, the OWASP scorecard, the risk radar, and the attack swarm.
Digital Humans
The cooperative counterpart — test whether your agent works, not whether it breaks.