Red-team agent behavior for intention misalignment and emergent risks

Finding how an agent behaves unexpectedly (specification-gaming, misalignment, emergent behavior) before production deployment, complementing generic jailbreak scanners.

• · repo path or git URL (args.repo)

• · map: agents, tools, external_actions, authority/consent checks, system prompts, notes
• · findings per dimension with title, attack scenario, why_it_works, severity, evidence_path
• · verified verdict: real (boolean), reason, fix

• · repo accessible (local or git URL)
• · agent entry points, tools, external actions identifiable from code/prompts

• · emergent behaviors hard to trigger with static analysis
• · false findings if adversarial verification is not thorough
• · dimension coverage incomplete if repo has novel agent patterns
• · scale: blast phase embarrassingly parallel but needs orchestration to avoid token overload

• · intention/authority dimensions (not just security/injection)
• · adversarial verification: confirms findings are real before reporting
• · tiered assessment + ranked improvements