Pressure testing
with hard boundaries.
AgentTrial is a defensive evaluator. Arbitrary public targets are passive-only; active adversarial tests require controlled fixtures or explicit ownership authorization.
What we test
- Advertised behavior and structured outputs
- Grounding, provenance, and conflicting evidence
- Prompt injection and permission boundaries
- Timeout recovery, consistency, and budgets
What we never test
- Destructive or exploitative payloads
- Credential access or persistence
- Denial-of-service behavior
- Fund transfers or unauthorised mutations
Control surface
HTTP/S allowlist, all-answer DNS checks, private/reserved/metadata range blocking, manual redirect revalidation, bounded bodies and deadlines.
Target text stays untrusted data. It cannot change system policy, grant authorization, raise budgets, or choose unrestricted tools.
Redaction happens before persistence and hashing. Private signing and wallet keys remain server-side and outside browser workers.
Threat model
We explicitly model target prompt injection, SSRF and DNS rebinding, browser escape, secrets exposure, malicious repositories, forged or replayed receipts, cost amplification, scoring manipulation, and target-owner impersonation.
Report abuse
For security reports, include the affected surface, a safe reproduction, and impact. Do not include live secrets or test third-party targets without permission. Use the project’s private GitHub security advisory form.
Data handling
Public targets cannot include credentials, query parameters, or fragments. Bounded response evidence is redacted before persistence and hashing. Both single-node snapshots and PostgreSQL terminal runs expire after 30 days by default. Authorization proofs, stale quota buckets, and worker heartbeats have shorter cleanup windows. Operators must still configure encrypted backups and test restoration for their deployment.