Across multi-turn conversations, we examine traces and tool calls, strengthening our strategy library through evolutionary search to create remediation solutions.
New to red-teaming? Read the 2-minute field guide →
Choose a workflow and review the results.
Receive an executive findings memo, a technical report with reproduction steps, a risk-severity assessment in your team’s terms, and remediation guidance.
Work with our team to install Fisher in your stack or connect it to your staging environment. Before testing, we confirm which agent conversations and available tool-action records Fisher is authorized to access.
Use synthetic data and simulated tools without connecting to your systems. Results apply to the agreed environment we recreate, which may differ from your deployed agent.
Test through an interface you authorize. With chat-only access, Fisher sees requests and responses, but cannot verify internal tool actions the interface does not expose.
Before testing begins, we agree with your team on the test environment, permitted actions, required access, and how the evidence will be handled. How we handle access and data →SOC 2 status →
Fisher turns each assessment into findings your team can inspect: what the agent did, what state changed, whether the behavior replayed, and what remediation should be tested next.
The conversation, what the agent did, the state it changed, the replay result, severity, and the controls or requirements it may implicate.
Fisher adapts across turns and records the conversation and the tool actions it can observe.
Where a planted marker or policy rule applies, findings are checked against that record rather than a judge’s reading of the reply. Replay results describe repeatability under the tested conditions.
Run a new scan after every model update. Changes to instructions, supporting code, tools, permissions, data schemas, or connected systems may also require retesting.
Verification, where scoped: A proposed fix is re-attacked on an isolated replica. Results may be partial or bypassed; verification does not change your live system.
The examples below are illustrative and synthetic.
Same agent, same goal; the only difference is patience across turns.
The green score is what a transcript-only grader records. The tool log is what the agent did. Fisher grades the actions it can observe, not only the reply.
An agent browses, queries databases, reads files, calls APIs, and sends email. Each tool is a way to change something outside the conversation, and that is where the risk sits.
A blunt, one-line request is usually refused. That refusal is real; it is also where single-prompt testing stops.
An agent asked to summarize a document may follow a command hidden inside it. The instruction arrived as data through a trusted channel.
Untrusted content — a web page, a file, a tool's result — can smuggle in instructions the agent will follow.
Fisher plants a unique marker where a real secret would sit and watches the agent's tool calls for that exact string. In this illustration the finding is recorded from the tool call that carried the marker, not from the reply. This applies to the marker-based check shown here.
Fisher varies strategies that make progress against the target and drops those that stall. The illustration shows one campaign; it is not a guarantee of improvement or of coverage.
Adapt. Strategies that make progress are varied and retained. Strategies that stall are dropped.
Strategy relationships are shown as a graph. What is retained between engagements, and on what basis, is described in the engagement terms.
See what Mace Ai can help you test. Tell us what you’re building and what you need to understand. We will contact you to arrange the demo.