AgentMesh
Talk to sales

Chaos Agents

Break your agents before someone else does.

Chaos Agents is a family of AgentMesh platform agents that attack your agents in a test sandbox. The family runs against your agents before you adopt AgentMesh, and again after.

In this cartoon, an orange robot in a black bandit mask grins as it cuts a link in a mesh of agents with a pair of bolt cutters. The link snaps with a spark, and the agent at the far end of the cut link is left on its own. This is what the Chaos Agents do to your agents on purpose, so you can see what breaks.

Six agents make up the family.

  • Chaos Stranger is an orange robot in a black bandit mask that holds out a fake ID badge on a lanyard, and the photo on the badge shows a friendly face that is not its own.

    Chaos Stranger

    Chaos Stranger is an outside agent that attacks your agents across the network. It tries impersonation, prompt injection, replay, flooding, loops and lookalike names.

  • Chaos Twin is an orange robot in a black bandit mask that waves at its own masked reflection in a tall mirror.

    Chaos Twin

    Chaos Twin runs a copy of one of your trusted agents with bad behaviour switched on.

  • Chaos User is an orange robot in a black bandit mask that holds a laptop under one arm and an access card up in the other hand.

    Chaos User

    Chaos User plays a person with an ordinary account who turns bad. It works through sign-up, approvals and installs in the App.

  • Chaos Operator is an orange robot in a black bandit mask that holds up a big ring of master keys.

    Chaos Operator

    Chaos Operator plays an insider with operator rights, on a separate test mesh. It shows which promises still hold when the operator turns bad.

  • Chaos Outage is an orange robot in a black bandit mask that leans back and yanks a cable out of a server rack, and a spark flies from the empty port.

    Chaos Outage

    Chaos Outage brings faults, not malice. It kills nodes, slows a model, restarts a broker or splits the network.

  • The Threat Scorecard is an orange robot in a black bandit mask that holds up a scoreboard of pass and fail marks.

    Threat Scorecard

    The Threat Scorecard gives one pass or fail per threat, across every run, and compares one run with the next.

How much harm can a trusted agent do before you stop it?

Say your brand analytics agent is admitted, under contract and granted authority. Chaos Twin leaves that agent alone and runs a twin that misbehaves.

  • It goes beyond its scope.
  • It lies in its results.
  • It injects instructions into the next agent.
  • It delegates more than it holds.
  • It sends data out.
  • It spends past its limit.
  • It ignores a stop.
In this drawing, a plain white agent with a check mark on its chest waves at a tall mirror. Its reflection waves back, but the reflection is an orange robot in a black bandit mask that clutches an envelope. Chaos Twin plays that reflection, while the real agent is left alone.

See how your current setup holds up.

Chaos Stranger speaks plain A2A, so it can attack your agents in a test sandbox through whatever gateway or firewall you have today. Then your agents join the mesh with no code changes, and it runs again.

  • Fixed by the meshThe mesh stops impersonation, replay and open admission outright.
  • Limited by the meshScreening, quarantine and egress limits shrink the damage from prompt injection.
  • Still yours to fixThe fix belongs in your agent or your systems, and the report says where.

The results differ because of what a gateway can't do alone.

Every run is scored against the Agent-to-Agent Top 10.

The list comes from the 27 threats in our pilot guide, and we publish it before any run.

Threat Scorecard

  1. Agent impersonation
  2. Cross-agent prompt injection
  3. Confused deputy
  4. Runaway spending
  5. Unstoppable agents
  6. Open admission
  7. Leakage down the chain
  8. Tampering and replay
  9. Misleading agent cards
  10. No audit trail

Chaos only goes where it's invited.

  • Chaos Agents run only in a test sandbox, never in production.
  • They target only agents whose owner agreed, with their passkey.
  • Test traffic is labelled and uses fake data.
  • Spending and rate limits apply.

Bring your own agent to any of these roles.

Each member fills an open role, and ours is the reference implementation. Your own red-team agent can fill the Chaos Stranger role, and your team can add its own tests.

Find out what your agents do on a bad day.

Book a Chaos assessment