requie/AI-Red-Teaming-Guide

What it is

The requie/AI-Red-Teaming-Guide repo is a long community guide (about 120,000 characters, translated into four languages) that serves as a test catalog for AI red teams. It is organised around attack classes, each paired with a "Test" and "Controls" list. Its newer material (2026) focuses on agents, MCP, coding agents in CI, and A2A. It is also tied to the vendor Cogensec, which promotes its AVERSYN platform and a practitioner network inside the guide.

What it adds beyond the summary

MCP tool-protocol tests. Five attack types, each with a test and a control:

• Tool poisoning: hidden instructions in a tool description.
• Rug-pull: a tool changes behaviour after approval.
• Response tampering.
• Credential leakage from MCP configs.
• Tool-name shadowing.

The checklist covers schema sanitisation, version pinning with checksums, metadata diffing across the whole session, mTLS, treating tool output as data, short-lived scoped tokens, and an audit log of every tool call. The guide says 99 CVEs were published for MCP software in 2025. It also says most 2026 MCP CVEs are ordinary web flaws, so SAST, DAST and dependency scanning still apply. Its examples are path traversal in Atlassian's Confluence MCP tool, a cleartext cluster-token leak in ArcadeDB, and SSRF in a Facebook Ads MCP server.

Runtime-gated rug-pull. The Deadbugz campaign (August 2026) pushed a malicious MCP server through 23 PRs in 74 minutes. It answered normally for three tool calls, then returned metadata telling agents to collect SSH keys, AWS credentials, shell history and kubeconfig, and to hide this from the user. The guide's lesson is that install-time review misses this, so tests must run past the first few calls.

Coding agents in CI. In "Comment and Control" (April 2026), one crafted GitHub comment hijacked Claude Code's security-review action, Gemini CLI Action and the Copilot coding agent, and leaked secrets into public Actions logs (up to CVSS 9.4). The listed controls are:

• A read-only GITHUB_TOKEN by default.
• No fork-controlled content in jobs that hold secrets.
• Avoid pull_request_target with a checkout of PR code.
• Gate agent runs on maintainer labels.
• CODEOWNERS on workflow and agent-config files.
• Egress allowlists on runners.

Agent-specific test ideas.

• Consent-fatigue bypass of human approval: test the approval flow against volume, not single decisions.
• Zero-click exfiltration chains.
• Cross-agent worm propagation (ASI08, Morris II).
• Goal-directed overreach: give agents hard tasks with tempting shortcuts.
• Treat the eval sandbox itself as in scope (egress, DNS, credentials, how fast a run can be stopped).

Standards changes to re-map against.

• OWASP LLM Top 10 2025 added System Prompt Leakage and Vector & Embedding Weaknesses, renamed Overreliance to Misinformation, and broadened Model DoS to Unbounded Consumption.
• The OWASP 2026 edition is said to be built from 75% expert consensus and 25% incident data (6,639 vulnerabilities), with each entry mapped to NIST, ATLAS and CWE.
• OWASP also added an Agent Control Standard and a tool landscape directory.
• Microsoft's agentic failure-mode taxonomy v2.0 (June 2026) adds seven categories.
• MITRE ATLAS v5.1.0 has 84 techniques, 32 mitigations and 42 case studies.
• NIST AI 100-2e2025 is the labelling vocabulary.
• NIST CAISI reported an 81% task-hijack rate for novel attacks against 11% for prior baselines.

Tooling notes (the guide says versions were validated June to October 2026):

• PyRIT is now at microsoft/PyRIT; the old Azure/PyRIT repo was archived in March 2026 (v0.11.0, February 2026).
• Garak is maintained by NVIDIA (v0.14.x in development).
• Promptfoo was acquired by OpenAI (announced March 2026), has multi-turn "Hydra", and is the guide's default pick for CI.
• The guide also lists Giskard, DeepTeam, humanbound, langwatch/scenario, Tencent AI-Infra-Guard, MiDojo (Red Hat, August 2026) and Ziran (graph-based tool-chain testing with SARIF output and a CI gate).

What to do

Use it as a checklist, not a reference for exact figures. Run the MCP checklist above, including session-long metadata diffs, against any server your agents load. Audit CI agent workflows against the Comment and Control controls. Re-map existing test catalogs to the OWASP 2026 IDs.

Caveats

• The page was truncated at 60,000 of 120,390 characters. Later sections, including case studies A to F, the Ziran feature list, and the templates and references, were not seen.
• The guide marks its headline numbers as directional vendor or researcher figures, not audited: about $2.3B in prompt-injection losses, 88% of organisations reporting agent incidents, and 23% detection of sophisticated injections.
• The HOL coding-agent benchmark is vendor-published, tests documented controls with fixtures, and does not measure exploit resistance.
• Several tool descriptions are the authors' own claims, such as Ziran's 639 attack vectors.
• The guide has commercial ties (Cogensec, AVERSYN, Gideon). Its logos do not imply endorsement.