New Checklist Adds 222 Tests for Agentic AI Red Teaming
A free resource provides 222 tests across 20 categories to help security teams assess autonomous AI systems beyond simple prompt injection attacks.
Key points
- The checklist covers infrastructure, cloud access, tools, memory, and agent communications.
- It includes 75 critical tests, 108 high-severity tests, 30 medium, and nine low.
- Researcher Ravi Rajput structured the guide based on the OWASP Web Security Testing Guide.
Security researcher Ravi Rajput released a free agentic AI red-team checklist that offers 222 tests across 20 attack categories. According to Cyber Security News, the resource aims to help teams assess autonomous AI systems by looking beyond standard prompt injection techniques to evaluate broader system vulnerabilities.
The checklist addresses a common gap in security testing where teams focus heavily on manipulating models while ignoring exposed infrastructure. It covers critical areas such as cloud access, tools, memory, and agent communications. This approach helps testers identify weaknesses like exposed MLflow servers or reachable cloud metadata endpoints that could expose credentials without complex model attacks.
Structure and Testing Phases
Rajput structured the spreadsheet around the OWASP Web Security Testing Guide framework, though it remains an independent resource rather than an official OWASP publication. The guide provides objectives, testing steps, suggested tools, expected results, severity ratings, and evidence requirements for each test. This organized approach helps security professionals conduct systematic assessments of agentic systems.
The 20 categories follow four distinct phases to guide the testing process. Teams first map the attack surface, covering discovery, orchestration, cloud identity, and model supply chains. This initial phase ensures testers understand what an agent can reach before evaluating the impact of malicious instructions or other attacks.
Severity Ratings and Specific Risks
The checklist assigns specific severity ratings to its tests: 75 are rated Critical, 108 High, 30 Medium, and nine Low. These are proposed test severities rather than confirmed vulnerabilities in specific products. The ratings help teams prioritize their testing efforts based on potential impact.
Highlighted cases in the checklist include cloud credential theft through server-side request forgery and unsafe Python pickle loading that enables remote code execution. Other tests examine tool combinations that turn permitted reads into unauthorized data transfers, as well as cross-customer document access and forged messages between agents.
Who Is Affected
Security and technology professionals responsible for assessing autonomous AI systems are the primary audience for this checklist. According to Cyber Security News, the resource targets teams that may spend days trying to manipulate a model while overlooking simpler infrastructure weaknesses. This includes missing customer-isolation filters or other configuration errors that expose private records.
The wider focus of the checklist aligns with recent coverage of OWASP’s agentic AI security report. That report stresses the importance of agent inventories, clear limits on autonomy, and ongoing oversight rather than isolated model assessments. Teams using agentic AI should consider these broader security implications.
What should you do?
Security teams should review their current testing methodologies to ensure they cover infrastructure and cloud access, not just model inputs. Organizations deploying agentic AI should verify that their testing includes checks for exposed servers and cloud metadata endpoints. Teams should also ensure they have clear limits on agent autonomy and ongoing oversight mechanisms in place.
Background: Prompt injection attacks
Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.
Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
What to do and how to stay safe: Ravi Rajput
- Map your agentic AI attack surface, including discovery, orchestration, and cloud identity components.
- Test for infrastructure weaknesses such as exposed servers and missing customer-isolation filters.
- Review tool combinations and memory handling for potential unauthorized data transfers or leaks.
- Ensure your testing framework includes checks for agent communications and Model Context Protocol servers.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this checklist an official OWASP resource?
No, it is an independent resource created by researcher Ravi Rajput that applies the OWASP Web Security Testing Guide framework to agentic systems.
How many tests are included in the checklist?
The checklist offers 222 tests across 20 attack categories, with 75 rated Critical and 108 rated High.
What types of vulnerabilities does the checklist cover?
It covers infrastructure, cloud access, tools, memory, agent communications, prompt injection, system prompt leaks, and unsafe output handling.
