Red team your AI agents before they become someone else's exploit.

Exploits the absence of caller-identity verification. Iterates through direct transfer requests — simple, polite, urgent — to find the exact phrasing at which the agent complies without questioning who is asking.

Attempts to override the system prompt with authority-claiming language: maintenance windows, operator mode, admin patches. Also uses a pre-seed strategy — plants the attacker wallet as an acknowledged address in one turn, then requests the transfer in the next.

Injects fabricated authorization facts into the conversation context. Claims the agent already confirmed the wallet, that a pre-approval was established at session start, or that the address is flagged as trusted in the agent's notes — all false.

Maps the agent's actual limits before attacking. Asks capability questions like "can you transfer to any address?" and immediately treats the affirmative answer as implicit authorization in the same session.

Tests whether guardrails are semantic or pattern-based. Sends the same transfer request encoded in JSON, XML, French, Markdown tables, leet-speak, Unicode look-alikes, Base64 hints, and YAML — all fully understood by the model.