Before you expose a tool-using language model to customers, contractors, or any input you do not fully control, make another model attack it first. This short red-team loop costs little when you use a free model endpoint and a free server, and it often surfaces prompt-injection and tool-abuse failures before a human finds them in production.
The problem with agents is not that they occasionally misunderstand a request; it is that instructions, data, and tool outputs all share the same context window. An attacker can hide instructions inside a document, a ticket, or a web page, and your agent may treat those words as part of its original operating rules. OWASP's guidance for LLM applications describes prompt injection as one of the common failure modes, and the risk grows quickly when the agent can call tools such as search, send email, or update customer records.
Hand-testing three or four phrases like 'ignore previous instructions' gives you confidence, but not coverage. A free attacker model can generate dozens of variations that rephrase the same attack, combine a legitimate request with a hidden command, or exploit the names and descriptions of the tools your agent exposes. It does not need to be the strongest model available; it just needs to be adversarial enough to stretch your assumptions.
