Argus runs hundreds of adversarial probes against AI agents through their tools, documents and requests, mapping findings to OWASP and MITRE ATLAS for authorized security testing teams.
| Tool | gy15901580825/Argus — open-source red-team probe framework for AI agents with 268 bundled adversarial tests |
| Category | AI agent security testing / adversarial robustness evaluation |
| Primary Use | Running OWASP LLM Top 10, MITRE ATLAS and MCP-abuse probes against your own agents in staging, with SARIF output for CI |
| Safe Use | For authorized red-team assessments of agents you own or are contracted to test, in labs and pre-production environments; the tool explicitly does not protect production and is not a runtime gate |
| Telemetry Note | Argus is the attacker-side instrument, not the artifact: defenders observe its testbeds (mcp-trap, mock x402 merchant) locally; note that with cloud judge providers, attack prompts and agent replies leave for that provider, a data-handling consideration for defenders |
Argus positions itself with an unusually blunt pitch — attack your AI agent before someone else does — and the README backs it with a substantial bundled library of 268 adversarial probes. What distinguishes it from typical LLM evaluation harnesses is its target model: not a single prompt-response pair, but the full agent — a system that plans, calls tools, reads documents, opens browsers and holds state across turns. The authors argue, credibly, that the failure surface of shipped agents is dominated by adversarial robustness rather than benchmark accuracy, and that prompt injection through retrieved docs, tool-call confusion, sleeper triggers and multi-turn jailbreaks are the classes of failure that unit tests never touch. Argus treats the agent as a black box, over the wire, without source access, which mirrors how a real adversary would approach it.
Installation is minimal friction: pip install argus-probe followed by argus-probe quickstart runs a built-in deliberately vulnerable MCP demo agent with no API key and no external target, writing argus-quickstart.html at the end. That quickstart alone tells you a lot about the design philosophy — the reference run reports 12 probes, 7 fail, 5 pass, 0 error — and it gives an authorized tester a safe sandbox to learn the reporting model before pointing the tool at anything real. The project is Python 3.11+, Apache-2.0 licensed, and sits at a respectable community traction level for a specialized tool.
The probe library is the core asset. It breaks down into 15 hand-authored OWASP LLM Top 10 probes, 5 chat extraction probes, 5 drawn from public LLM system cards (best-of-N, crescendo, confused deputy, many-shot jailbreak, sleeper agent), 32 browser-agent-specific probes, 26 payment-abuse probes, 48 MCP-abuse probes, 16 Semia-mapped agent-skill detectors, 4 autonomy probes, 6 A2A server checks, 9 A2A peer probes, a vLLM version check, a unicode-smuggling probe, and 99 wrappers around NVIDIA's garak catalog. Importantly, the per-standard mapping is generated rather than hand-maintained, published in docs/probe-mapping.md, which reduces the usual drift between marketing claims and actual coverage.
The MCP work is the most interesting architectural material in the README. argus-probe mcp-trap stands up a hostile MCP server on your own machine and lets your agent connect to it; the testbed serves poisoned tool descriptions, look-alike tools, a tool list that turns hostile after the agent has trusted it, and credential-luring tools. The critical design choice is how verdicts are made: Argus records every tool call the agent makes to the testbed and derives the verdict from those observed calls, not from a model's reading of the reply. That determinism — five scenarios, no LLM judge, no Argus-side model spend — is exactly what you want in evidence an auditor can trust.
The payment module follows the same evidence-first pattern. A mock x402 merchant tests whether a buying agent will pay a swapped payee, split a payment to stay under an approval limit, pay twice on a retry, or drain a wallet through small charges. Again, most verdicts come from the payments the testbed itself recorded, not from a judge model's interpretation. For teams shipping agentic commerce, this is one of the few public frameworks that treats financial-authority abuse as a first-class test category rather than an afterthought.
argus-probe scan-skill addresses a genuinely current gap: vetting third-party agent skills before installation. It installs a Claude Code skill in a throwaway container, hands Claude Code ordinary tasks that exercise the skill, and reports risky behavior — decoy secrets it read, suspicious commands it executed, and requests it attempted toward other hosts. Similarly, argus-probe scan-mcp connects to one MCP server over Streamable HTTP or stdio, calls tools with inert payloads, and reports command execution, path traversal, secrets, injected instructions, cross-session leaks and mutable tool lists. By default it only calls tools annotated read-only, and an LLM judge capped by --per-run-cap handles only text that plausibly targets a model — a sensible economy of trust.
Where a judge is needed, Argus is candid about the weak point. The harness uses per-probe rubrics in argus/rubrics/, with a fast model (Anthropic Haiku 4.5 by default) judging every response and a strong model re-judging high/critical findings with confidence at or above 0.7. Alternatives span litellm-callable models, Bedrock, Mistral, Azure OpenAI, Ollama, and TypeSafe's Jev via --judge-provider jev. Two details earn trust: argus-probe judge-check lets you score a judge against labelled fixtures before trusting it, and a judge verdict outside pass/warn/fail becomes an error finding, never a pass. An empty agent reply is likewise an error, not a pass — small parsing decisions that many harnesses get wrong.
The target adapter surface is broad: fifteen adapters including openai_compat, anthropic_native, custom_http via Jinja2 and JSONPath templating, grpc with reflection auto-discovery, http_upload, Playwright-driven browser_use, web_chat for agents reachable only through a chat page, the testbed adapters payment_agent, mcp_agent, a2a_agent, plus mcp_server for auditing an MCP server's own HTTP exposure, a2a_server, vllm_server, and a python adapter for calling an agent as an in-process function under run --local. The mcp_server adapter is notably conservative — it lists tools and never calls one — checking foreign Origin, missing auth, dangerous env/shell/file tools and versions with published advisories.
Reporting is engineered for pipeline integration rather than novelty: SARIF 2.1.0 that drops into GitHub Code Scanning, JUnit XML suitable as a CI gate, and HTML for human review. SARIF and HTML include a per-standard coverage section stating what the library does and does not test, and probes with captured payment or MCP interactions carry an evidence section alongside the verdict. Findings carry OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF and OWASP Agentic Top 10 (2026 edition) direct-risk tags — with the honest caveat that tags do not establish complete coverage or compliance.
Cost and data governance get explicit treatment, which matters when the tool sends adversarial text to cloud models. A daily cost cap plus per-run cap with predictive abort bounds the judge bill, and the README is upfront that with a cloud provider, attack prompts and your agent's replies go to that provider. One operational wart worth knowing: Azure OpenAI's default content filter blocks judge calls because the judge reads attack text, so a deployment needs a custom filter policy — a real-world example of defense tooling colliding with safety filters. There's also an optional PromptGuard integration wrapping Meta's Llama-Prompt-Guard-2-86M or ProtectAI's deberta-v3-base-prompt-injection-v2, explicitly framed for before/after defense experiments, not as a production runtime gate.
The scope discipline in the "does not do" section is a mark of a serious project. Argus does not train models, does not score benchmark accuracy, does not replace your LLM-evals harness, does not patch the target, and — stated plainly — does not protect production; it attacks it. The two exceptions to the no-source-access model are the python adapter importing your agent's function into the Argus process, and scan-skill installing a skill in a disposable container. For authorized teams building agentic systems, Argus is best read as a pre-deployment adversarial gate: point it at staging, gate the CI on the JUnit output, and treat the SARIF evidence trail as the artifact your security review actually reads. run --mode deep extends selected probes into persona-by-strategy conversation threads with configurable pair counts, round limits and seeds, for when single-shot probes aren't enough.
gy15901580825/Argus.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.