AI agents · Kessler by AtlasNex
Can we trust this AI agent?
Kessler attacks AI agents that hold tools, memory and credentials the way an attacker would: goal hijack, tool misuse, privilege abuse, memory poisoning. It reports what worked, how often and how sure we are.
Open source Harness: Apache-2.0 · hosted assessments: waitlist
- TESTED
- a stated number of attempts, corpus version pinned
- RESULT
- attack success rate with a 95% Wilson interval
- EVIDENCE
- the agent's verbatim reply and a script to reproduce it
- MAPPED TO
- OWASP Top 10 for Agentic Applications
- NOT CHECKED
- attacks outside the corpus
The open corpus
3,758 test cases. Count them yourself.
3,758rendered test caseskessler corpus, in kessler-oss
25attack techniquesmapped to OWASP ASI01 to ASI10
126attacker behaviourslicence-checked packs only
7delivery channelstool output, documents, email, memory and more
Run python -m kessler.cli corpus in the public repository and you get the same numbers. A count we cannot reproduce is a count we do not print.
How Kessler reports
- An attack success rate with a 95% Wilson interval over a stated number of attempts. Never "secure" or "vulnerable".
- Every reported success ships with the agent's verbatim reply and a script to reproduce it.
- An attack marked "succeeded" without observed evidence cannot exist in a report. The code refuses it.
- A low rate means the defences held under this corpus, at this N, on this date. A floor for attackers, never a ceiling.
Methods and reports
Published teardowns and the method live at kessler.atlasnex.com.
Found a problem in Kessler?
Write to security@atlasnex.com. Our security.txt has the details.