New Agentic AI Red Team Checklist Adds 222 Tests for 20 Attack Categories

Key Takeaways

• A new, free checklist provides 222 tests across 20 categories for red-teaming agentic AI systems.
• The resource addresses critical security gaps beyond traditional prompt injection, focusing on infrastructure, cloud access, and inter-agent communication.
• Developed by security researcher Ravi Rajput, it structures tests around the OWASP Web Security Testing Guide framework.
• The checklist assigns severity ratings (Critical, High, Medium, Low) to potential findings, with 75 tests rated Critical.

Comprehensive Red-Teaming for Autonomous AI Systems

A newly released, free checklist offers security teams a robust framework for red-teaming agentic AI systems. Comprising 222 distinct tests categorized across 20 attack vectors, this resource moves beyond basic prompt injection techniques to address a broader spectrum of vulnerabilities, including those found in underlying infrastructure, cloud access configurations, integrated tools, memory management, and inter-agent communication protocols.

The initiative aims to bridge a significant gap in current AI security assessments. Many organizations focus heavily on manipulating AI models directly, often overlooking critical weaknesses such as exposed MLflow servers, accessible cloud metadata endpoints, or inadequate customer isolation filters. Such oversights can lead to the compromise of sensitive credentials and private data without requiring complex exploits against the AI model itself.

Structured Approach to Agentic AI Security

Security researcher Ravi Rajput developed the checklist, drawing inspiration from the well-established OWASP Web Security Testing Guide. This foundational framework provides a systematic methodology for conducting security tests, which Rajput has adapted for the unique challenges presented by agentic AI systems.

His spreadsheet-based resource details specific objectives, testing procedures, recommended tools, expected outcomes, severity ratings, and evidence requirements for each test. It is important to note that this is an independent contribution and not an official OWASP publication.

The 20 attack categories are organized into four distinct phases, guiding red teams through a logical progression of assessment:

1. Attack Surface Mapping: Initial efforts focus on discovery, orchestration mechanisms, cloud identity management, and the AI model’s supply chain.
2. Input and Prompt Analysis: This phase examines various inputs, potential for prompt injection, risks of system prompt leaks, and the handling of unsafe outputs.
3. Tool, Memory, and Network Assessment: Testers then investigate integrated tools, evaluate excessive agent autonomy, scrutinize memory systems, analyze agent networks, and assess Model Context Protocol (MCP) servers.
4. Deployment and Post-Exploitation: The final phase covers deployment pipelines, privilege escalation, lateral movement, persistence mechanisms, data exfiltration, resource exhaustion attacks, integrity failures, and vulnerabilities related to voice or multimodal inputs.

This structured progression ensures that testers first understand the agent’s reach and capabilities before evaluating the potential impact of malicious instructions.

This comprehensive scope aligns with broader industry perspectives, including the OWASP agentic AI security report, which emphasizes the necessity of maintaining agent inventories, enforcing clear limitations on autonomy, and implementing continuous oversight, rather than merely conducting isolated model evaluations.

Severity and Key Vulnerabilities

The checklist assigns severity ratings to each of its 222 tests: 75 are rated Critical, 108 High, 30 Medium, and nine Low. These ratings represent proposed test severities and do not indicate confirmed vulnerabilities in specific products or imply that every system will exhibit these flaws.

Highlighted critical scenarios include the potential for cloud credential theft via server-side request forgery (SSRF), remote code execution facilitated by unsafe Python pickle loading, and the misuse of tool combinations to transform authorized read access into unauthorized data transfers.

Other tests delve into cross-customer document access vulnerabilities, the forging of messages between autonomous agents, and scenarios where delegation leads to the misuse of privileges from other components.

For memory and retrieval systems, an illustrative test checks whether disabling a tenant identifier filter could inadvertently expose documents belonging to other customers. This specifically targets the integrity of customer isolation boundaries, rather than focusing solely on the model’s response generation.

Related research underscores the importance of scrutinizing connected tools, particularly malicious MCP servers. Manipulated server requests can, in the absence of adequate safeguards, redirect conversations or trigger unauthorized actions by tools integrated into the AI system.

A crucial element of the checklist is its evidence classification system. Results can be reflective (appearing directly in responses), blind (inferred from timing or state changes), or out-of-band (utilizing controlled callbacks). Under the checklist’s guidelines, reflective or callback-based evidence provides strong confirmation, while blind-only evidence is considered probable.

What You Should Do

• Before initiating any testing, Rajput urges teams to clearly define the scope in writing, explicitly mark any excluded checks, and meticulously document all supporting logs or screenshots for each test result.
• Destructive tests should only be performed with explicit authorization and, whenever possible, in staging or non-production environments.
• Utilize the downloadable spreadsheet, which maps tests to the OWASP and MITRE ATLAS frameworks, to organize and execute your red-teaming efforts systematically.
• Always verify current CVE identifiers before reporting any findings, as the initial release of the checklist avoids fixed CVE references to ensure broader applicability.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.