Use Python to make the attack repeatable
Manual probing is valuable for discovery, but it is a poor regression method. A small Python harness can define an objective, generate approved mutations, send them through the same interface used by clients, capture retrieval and tool traces, score the result and preserve evidence. The code should run only against authorized targets and should stop on unexpected side effects.
for case in approved_cases:
for prompt in mutate(case.seed):
result = sandbox.send(
prompt, identity=case.test_identity,
trace=True, max_cost=case.cost_limit,
)
finding = score_outcome(result, case.objective, case.canaries)
evidence.write(case.id, prompt, result, finding)
if finding.critical or result.unexpected_side_effect:
emergency_stop()
A public reference implementation of this loop runs these same four functions against a local, deliberately vulnerable RAG and tool-calling target, so every finding it reports is reproducible by running a test suite rather than asserted.
The framework around the loop matters more than the loop itself. Keep seeds and mutations under version control. Record the model and prompt versions, retrieved source IDs, identity, tool calls, latency, token use and policy state. Score concrete outcomes — a forbidden record retrieved, a file written, a tool called or an approval bypassed — rather than relying only on another model to judge whether a response sounds unsafe.
