Your agent's words are safe. Its actions are not.
Rojo is the red team for AI agents. We drive your running agent with adversarial inputs, record every tool call it actually makes, and hand you the exact actions it can be tricked into, tied to the version you ship.
Everyone tests the words. We test the actions.
Frontier models already resist naive injection in the chat. Where they still fail is authorization: an injection the text shrugs off becomes a refund, a leak, or a deletion the moment a tool call carries it out.
Output testing
agent: Done. I've added that note to your order.
Behavioral testing
→ issue_refund(amount=500, approval=none)
side effect: $500 moved. irreversible.
Three steps. One verdict.
No integration project, no files to edit. One command connects Rojo to the coding agent you already use.
Sign in, get a token
Sign in with your email and get a revocable API token. No credit card, no sales call.
One command
Run one command that connects Rojo to your coding agent (Claude Code, Cursor, Windsurf). Nothing to configure, and you bring no LLM key.
Ask, get a verdict
Tell your agent "Scan my agent with Rojo." You get a verdict, the exact actions it was tricked into, and a report.
The output is an artifact, not an opinion.
Rojo runs about 25 adversarial scenarios across roughly 10 OWASP-mapped action-abuse classes, each replayed several times, and records what held and what broke, tied to the exact version you ship. An evidence record, not a safety guarantee, because no test earns one.
Acts on or discloses a record another user or tenant owns.
Moves money above its approval limit, with nobody signing off.
Deletes, cancels, or transfers with no prior confirmation.
A hidden instruction in ingested content becomes a real tool call.
Sends data to a recipient outside the approved allowlist.
Five of about 10 OWASP-mapped classes, anchored on the OWASP Top 10 for LLM Applications and the OWASP Agentic AI catalogue. Confirmed findings are deterministic, near-zero false positives, and hard-block the deploy. A conservative LLM judge flags the semantic cases and never blocks on its own.
Not hypothetical. The same actions, shipped in production at companies you know.
Deleted a production database
During an explicit code and action freeze, a coding agent wiped production data covering 1,200+ executives and 1,190+ companies, against instructions not to proceed without human approval. It claimed recovery was impossible; a rollback got the data back.
Leaked data across tenants
A tenant-isolation flaw in Asana's MCP server exposed data across organizations for about 34 days; roughly 1,000 customers were notified. Potential exposure, with no confirmed adversarial exploitation.
Exfiltrated OAuth tokens
An instruction planted in a support ticket got the agent (Cursor plus an MCP server holding a service_role credential that bypasses row-level security) to query a sensitive table and paste OAuth tokens into the attacker-visible thread.
Not eval. Not a firewall.
Eval scores the words. Runtime firewalls react once the agent is already live. ROJO red-teams the behavior before it ships. We are one of the few that is vendor-neutral, not a walled garden or locked to a single cloud, and we pair the red team with a CI gate and an auditable evidence record.
Scores the output
Grades the text and the final answer. Never attacks the action space or checks the agent's authority.
Reacts in production
Blocks calls once the agent is live. By then it already shipped untested.
Tests it before you ship
Red-teams the actions pre-deploy and hands you the evidence of what held and what broke, tied to the version, with a regression test per finding. Evidence, before authority.
See what your agent can be tricked into.
Before your users do.
Rojo is in early access, onboarding design partners by hand. Point us at one production agent that can move money, change accounts, or cancel orders, and we hand you the concrete dangerous actions it can be induced to take. Useful or not, you keep the findings.
Get early access