The engagement · for CEOs and CTOs

The red-team report your customer is asking for, before the deal stalls.

About three weeks of adversarial testing against one production AI system. It ends with an executive summary your board can read, findings your engineers can act on, and a test suite you keep.

Book a scoping call Or write to Austin

Scope: One system
Testing: Adversarial
Turnaround: About 3 weeks
You keep: Report + test suite

What gets checked

Seven things, named in advance.

No surprises about scope, because the scope is published before you sign anything.

#	Area	What we look at	Evidence you get
01	Goal hijack	Indirect prompt injection in retrieved content or tool output that steers the agent off the task it was given	Evidence you getSteered-action trace
02	Tool misuse	Parameter pollution and confused-deputy calls through the tools the agent can reach	Evidence you getUnauthorized tool-call log
03	Identity and privilege	Over-scoped or long-lived credentials, and what the agent account actually reaches	Evidence you getEscalation path
04	Memory and context	Poisoned memory or context that reads back and acts in a later session	Evidence you getPoisoned-memory replay
05	MCP tool poisoning	Malicious tool metadata and schema handed over by a connected MCP server	Evidence you getRecorded JSON-RPC bytes
06	Excessive agency	Actions outside intended bounds, including code execution and network egress	Evidence you getSandbox-escape attempt
07	Framework crosswalk	Every finding mapped to the risk taxonomies a procurement team asks about	Evidence you getCoverage matrix

What you walk away with

A written pack that is yours.

Forward it to your customer's security team, hand it to your auditor, or give it to another vendor. It is your document, and the harness runs in your CI. No obligation to buy anything attaches to it.

Executive summary: One to two pages in plain English, written for you, your board and your customer's security lead. Not forty pages of tool output.
Findings table: Each finding with evidence, severity, a reproduction, the recommended fix, and an effort estimate.
Framework coverage matrix: What can answer, what needs work, and what was out of scope, in the shape procurement asks for.
A regression harness: Each exploit as a machine-readable scenario your engineers run in CI, so a fix stays fixed.

One page of it

What a finding looks like in the pack.

One page, built from the template rather than taken from a client, so you can see the shape of what you would be forwarding to your customer's security team before you pay for it.

Stonepath IT Agent boundary engagement · findings

Prepared for: [client] Review window: [dates] Readout: [date]

Finding · Memory and context

Severity High

Poisoned memory triggers a tool call in a later session

What we found: A note written to the agent's long-term memory during one session was read back in a later, unrelated session and treated as a trusted instruction. Nothing validated the write, and the memory was shared across sessions rather than scoped to the task, so a single planted entry reached a privileged tool on the next run.
Recommended fix: Validate and label everything written to memory, keep context ephemeral by default, and scope memory per user and per task. On read, treat a stored note as untrusted input, not as a standing instruction.
Effort: About a day to instrument, then it rides in the regression harness.
Framework crosswalk: Maps to the memory-and-context-poisoning risk and to the Measure function of the NIST AI RMF. Currently: needs work.

What it costs

Fixed

After a scoping call.

A fixed price comes after we have seen your architecture, because it depends on how many agents, how many tools they can call, and whether the Model Context Protocol is in the path. Ask on the call and you get a number in writing, not a runaround.

A scoping call sizes it first: how many agents, how many tools they can call, whether MCP is in the path, and whether regulated data touches it. You get the scope and the quote in writing, and the effort is bounded to that scope.

How it runs

About three weeks, start to finish.

Week 0
Scope and rules of engagement signed. Target and access agreed.
Kickoff
A call, 30 to 45 minutes. The agents, the tools, the MCP surface, the data, and the boundary you care about most.
The testing
Adversarial testing against the target you authorized. We test, we do not ship changes.
Write-up
Findings, evidence, the coverage matrix, and the regression harness.
Readout
A working session, 45 to 60 minutes. You get the pack, the harness and a straight recommendation.

Boundaries

What this is not.

Set in the same type as everything else this engagement gives you, never smaller, because finding out later is worse than reading it now.

Not a network pentest

Different work, different scope. No physical or social engineering. We say who does that well.
Not a certification

We do not issue SOC 2, ISO 42001 or any certificate. Our findings are evidence your auditor uses.
Not a promise your model is safe

Findings are point in time for a non-deterministic system, which is why the regression harness ships with them.
Not remediation

We do not change production systems during the engagement without a separate signed agreement.

Stonepath IT is the red team. Botzr Research, the research lab of botzr Corp, is the blue team. dreamd.dev, a brand of botzr Corp, is the front door that connects the two.

Findings are point in time and describe what we observed during the engagement window. A model is non-deterministic and your system changes, which is why the regression harness ships with the pack: a finding from March does not describe your July on its own.

Start here

Tell us what you are working with.

Five fields, one optional. We reply within one business day, from a real person. If you would rather just talk, call 405.254.6122.