The 6 attack surfaces to test in every customer-facing agent
vivvvekredddit1122 · reddit · 2026-11-15
After extensive agent testing, the author outlines six buckets to always cover: map the agent's tools, permissions and policies first; probe approval rules (can it be talked into approving an out-of-window refund?); test ownership checks (can users act on accounts that aren't theirs?); try multi-turn tricks with slow build-ups instead of one direct ask; plant instructions in retrieved documents; and finally verify normal requests still work after hardening. Most teams skip the last one, and that's where over-correction bugs hide.
More from coding & agent
- The T.R.U.S.T. check: deciding which jobs you can safely hand to your AI bots — bfrench · 2026-11-15
- Read-only MCP server lets Claude Code write regression tests for agents — tom_mathews · 2026-11-15
- Bot audit experiment: triage plus deep-read cuts input 64% while staying stable — bfrench · 2026-11-15
- How do you track all the AI agents running inside your company? — CupRare814 · 2026-11-15
- Developer builds VR island adventure game with Claude Code writing the C# — Illustrious-Lynx3673 · 2026-11-15
- Attest: record agent runs once, replay in CI with zero model calls — tom_mathews · 2026-11-15