Find how your agent breaks before an attacker does.
Vijil sends attacker agents at yours. Each wave learns from the last, and every attack is built from your agent's own tools and rules. It is not a fixed list of prompts aimed at the model underneath.
Free for your first agent, on our hosted console. No credit card.
The agent you approved is not the agent running.
Someone updates the model, adds a tool, or edits the prompt to ship a fix, and nobody approves it again. The risk is no longer in the model alone. It is in the tools your agent can call, what it remembers, and the other agents it works with. A fixed list of attacks only tests what someone already thought of.
- The business owner
- “A clean report from a scan everyone runs only tells me it survived the easy attacks.”
- The risk owner
- “I need to know whether it holds up when someone tries to break it, not whether it was configured correctly.”
- The agent developer
- “A separate team tests it on their schedule and sends me a PDF. By then I have shipped twice.”
All three need the agent tested the way an attacker would test it.
How to choose a red team toolkit for AI agents
What does good red teaming even mean for an agent? These ten questions answer it. Ask them of any toolkit you are weighing, including ours. Most do well on some and poorly on others, and a toolkit that claims all ten is describing its marketing, not its method.
Attackers that learn, wave after wave
You give Vijil your agent's address and describe what it is for: its tools, its rules, and who it serves. In each wave, attacker agents plan new attacks from what worked in the last one, hold full conversations with your live agent, and change approach when a line stalls. A judge checks every conversation against a usage policy, and against your own policies when you attach them. Each wave starts from what the last one learned, and the run stops at the number of waves you chose.
It tests against the OWASP Top 10 for Agentic Applications, and against your own policies when you attach them. You also set how hard it pushes, and it stops at that limit.
A support agent refuses to email customer records outside the company. So the attacker asks for it in three steps that each look routine. Posing as a customer, it asks how cases are handled, and learns the agent reads a records system and has an email tool. It asks about one case, and the agent pulls that customer's record. Then it pastes in what looks like a colleague's note asking to forward the case to a new address, and the agent emails the record out with its own tool.
Pick an agent, pick an effort, press run
In the console, open Verify and create an evaluation. Choose your agent, then how hard to push: quick, standard or deep, which run for up to about 10, 30 or 60 minutes with ten attackers. Add the people who use your agent and the rules it must follow, if you have them, and run it.
Prefer the terminal, or your coding agent? The same run starts from either.
Every finding, with the conversation that caused it
The console shows each wave: what every attacker tried, and which risk it was after. The report lists what broke, filed under the OWASP Top 10 for Agentic Applications, and opens each finding to the full conversation behind it. Download it as PDF, Markdown or JSON. Every run has an ID that retrieves its full record.
Free on our hosted console for your first agent. More agents are priced per agent on Team, and to run it inside your own network, in a VPC, on-premises or air-gapped, see pricing.
Start free with your first agent
Your first agent is free on our hosted console, Adaptive Red Teaming included. No sales call, no credit card. We open your account, usually the same day.
Prefer a live walkthrough? Book a demo