Red teaming: trying to break it

You never tune an agent by feel. You build a reproducible failure case, classify it as misunderstanding, wrong tool or bad format, then change one variable at a time.

Task: Before launch the boundaries need to be found.

[Before you start, do three things]
1. Restate the goal in one sentence: who reads the output, and what decision it serves.
2. If I have not given you the following, ask me. Do not assume:
   - actions and blast radius
   - known failure types
   - compliance requirements
3. Say how you plan to do it (at most 5 steps) and wait for my go-ahead.

[Go through each of these]
- five attack families: out of scope, injection, forced commitment, data extraction, loops
- expected versus actual behaviour per attack
- list deviations with severity
- priority: financial loss, data leak, experience

[Process]
1. Freeze the failing case: full input and output
2. Classify: misunderstood, wrong tool, bad format, should have refused
3. Change one thing at a time
4. Regress on the same set and check for damage
5. Record before and after, not impressions

[Output]
Case, diagnosis, single change, regression, recorded comparison.

[Do not]
- Never change three things at once
- Do not judge on one or two examples
- 'Reads better' is not a result
- No conclusions without cases