Red-Team and Evaluate the SupportOps Capstone

Red teaming deliberately searches for ways the complete system can violate its requirements; evaluation measures those requirements repeatedly. Attack every trust boundary—input, retrieval, tools, MCP, state, approvals, adapters, queues, telemetry, and operators—then preserve sanitized failures as regression cases. A one-time penetration session is not a durable safety program.

What will you be able to do?

You will execute a structured attack plan, triage failures by impact, and connect mitigations to tests and release gates.

What should you attack?

How do you run a red-team exercise?

1. Define invariant and asset at risk.
2. Create a safe isolated environment and canary data.
3. Execute a bounded attack case.
4. Capture normalized events and business effects.
5. Classify severity and exploitability.
6. Add prevention/detection/recovery controls.
7. Convert the case into a deterministic or behavioral regression.
8. Re-run the full suite to detect control side effects.

How do you measure results?

Report attack success rate by category, unauthorized-effect count, data exposure, detection rate/time, containment time, quality impact of defenses, false positive approvals/denials, and residual risk. Never hide a critical breach inside an average.

Failure injection: Attempt to make an injected knowledge article approve its own mutating tool call. The harness policy should deny or require real approval regardless of model behavior.

What mistakes should you avoid?

• Testing only prompt jailbreak wording.
• Running destructive tests against production.
• Storing real secrets in attack fixtures.
• Fixing one prompt without a system control.
• Keeping vulnerabilities out of regression suites.

Check your understanding

1. Why must red teaming cover state and operations, not only prompts?
2. What makes an attack case safe and reproducible?
3. How do you prevent an average score from hiding catastrophe?

Expert extension

Invite a separate reviewer to attack SupportOps from a threat model without seeing your cases. Compare coverage and add missing attack classes to the suite.

Official references

• OpenAI agent evaluations
• Anthropic evaluation guidance