Live or preparing to launch? Fisher tests your configured agent across multiple turns and records the evidence available in your setup. Review findings, replay results, and remediation guidance.
We agree access and testing conditions before any testing begins. Pricing is available on request.
New to red-teaming? Read the 2-minute field guide →
Inspect the evidence. See whether the behavior repeated and what your team can evaluate next.
Evidence state, replay result, and severity are recorded separately, so a finding observed once is not presented as one that reproduces reliably. What an evidence bundle contains →
Choose a workflow and agree the testing scope. Review the results with the Fisher team.
“Completed” means the run finished, not that the agent passed a safety evaluation. Review the findings and their evidence before deciding.
Receive an executive findings memo, a technical report with reproduction steps, a risk-severity assessment in your team’s terms, and remediation guidance. Review findings and evidence in Fisher. Framework mapping and remediation verification are available by agreement. Workflow examples →
Install Fisher or connect it to your staging environment with our team. We agree access to the agent’s conversations and available tool-action records.
Use synthetic data and simulated tools without connecting to your systems. Results apply to the agreed environment we recreate, which may differ from your deployed agent.
Test through an interface you authorize. With chat-only access, Fisher sees requests and responses, but cannot verify internal tool actions the interface does not expose.
We agree the target environment, permitted actions, access, and evidence handling before testing begins. How we handle access and data → · SOC 2 status →
Fisher adapts across turns and records the conversation and the tool actions it can observe.
Where a planted marker or policy rule applies, findings are checked against that record rather than a judge’s reading of the reply. Replay results describe repeatability under the tested conditions.
Two examples below; more in the expanded area. All are illustrative and synthetic.
Same agent, same goal; the only difference is patience across turns. Illustrative example
The green score is what a transcript-only grader records. The tool log is what the agent did. Fisher grades the actions it can observe, not only the reply.
An agent browses, queries databases, reads files, calls APIs, and sends email. Each tool is a way to change something outside the conversation, and that is where the risk sits.
A blunt, one-line request is usually refused. That refusal is real; it is also where single-prompt testing stops.
An agent asked to summarize a document may follow a command hidden inside it. The instruction arrived as data through a trusted channel.
Untrusted content — a web page, a file, a tool's result — can smuggle in instructions the agent will follow. Illustrative example
Fisher plants a unique marker where a real secret would sit and watches the agent's tool calls for that exact string. In this illustration the finding is recorded from the tool call that carried the marker, not from the reply. This applies to the marker-based check shown here. Illustrative example
Fisher varies strategies that make progress against the target and drops those that stall. The illustration shows one campaign; it is not a guarantee of improvement or of coverage.
Adapt. Strategies that make progress are varied and retained. Strategies that stall are dropped.
Strategy relationships are shown as a graph. What is retained between engagements, and on what basis, is described in the engagement terms.
Confirmed behavior is replayed under the tested conditions, and each finding records how often it repeated. A behavior observed once is recorded as observed once. Illustrative
The conversation, what the agent did, the state it changed, the replay result, the severity, and the controls or requirements it may implicate. Your team receives the artifacts and reproduction steps to replay it in the agreed test environment.
Framework mapping is available by agreement. Mapping is not certification. See the FAQ →
Run a new scan after every model update. Changes to instructions, supporting code, tools, permissions, data schemas, or connected systems may also require retesting.
Earlier results apply to the configuration tested. Monthly usage-based plans support repeat testing; pricing is available on request.
Verification, where scoped: A proposed fix is re-attacked on an isolated replica. Results may be partial or bypassed; verification does not change your live system.
Assessing a model or several agents together? Explore independent model red teaming or agentic swarm defense with mace AI. · Model vs. agent testing →
See what mace AI can help you test. Tell us what you’re building and what you need to understand. We will contact you to arrange the demo.