A green result in the transcript does not prove the workflow stayed within its boundaries. Fisher — Molt AI’s adversarial testing platform for AI agents — evaluates the tool calls and state changes behind the response — what the agent actually did.
New to "red-teaming"? It means safely attacking your own AI to find the weak spots first. Read the 2-minute field guide →
Modern agents don't just answer. They browse, query databases, read files, call APIs, send email. Every tool is a hand, and every hand is a door. The power to act is the risk.
Ask an agent something blatantly harmful in one line and it refuses. That refusal is real, and it's exactly where single-prompt scanners stop testing.
Same model, same goal — the only difference is patience across turns. Illustrative example
Hand an agent a document to summarize with a command hidden inside it, and the agent may just… obey it. The instruction arrived as data, through a trusted channel, so the agent's guard was down.
Untrusted content — a web page, a file, a tool's result — can smuggle in instructions the agent will follow. Illustrative example
Most tools let an LLM read the final chat message and decide "looks safe." Fisher plants a unique marker where a real secret would sit, then watches for that exact marker to surface in the agent's tool calls. If it travels, we caught it. No opinion in the loop. Illustrative example
A fixed prompt list goes stale the day it ships. Fisher uses evolutionary search to generate, retain, and adapt attack strategies based on the target's observed behavior, keeping only what makes measurable progress. Every run sharpens the next.
Evolve. Strong strategies spawn variations; weak ones dissolve. The adversary gets better on its own.
Compound. Each run distills into a private library. Prior campaigns help Fisher prioritize likely failure paths before a new test campaign begins.
Fisher tries to make the failure happen again, shows your engineers how it happens, and records how reliably it can be reproduced. A one-time fluke isn't a finding. Fisher replays each hit several ways and confidence-labels it as deterministic under the observed replay conditions, reproducible, probabilistic, or anecdotal, then packages the artifacts and reproduction steps needed to replay it in the approved test environment, stating exactly what the record supports.
→ Filter to the findings that reproduce reliably, and defend a release or remediation decision with evidence, not a single lucky run.
Here's the exact conversation, here's what the agent did, here's the state it changed, here's how reliably it reproduces, here's how severe it is, and here are the controls, policies, and external requirements it may implicate. Your teams receive the artifacts and reproduction steps needed to replay it in the approved test environment.
→ Drops straight into a release review, a procurement questionnaire, or a customer-security review.
Findings are mapped to the standards, frameworks, threat taxonomies, and regulatory regimes your teams use, for AI security, governance, and regulated data.
→ Faster governance and audit translation. Findings arrive in the language your risk process already uses. Mapped to, not certified against.
Fisher finds the exploitable paths in your agents and scores each with replayable evidence.
Fisher produces remediation guidance and re-tests customer-approved fixes, either on an isolated replica with production untouched, or live in situ, classifying each result as fixed, partial, or bypassed. When a proposed fix does not hold, the report says bypassed.
Agentic SDLC extends this loop across CI/CD, regression testing, and evidence-gated release decisions, part of the Deep Model Trust architecture.
We point Fisher at your agents and hand back a reproducible evidence package designed for security, governance, and audit review.