Red Timmy breaks your AI agent before someone else does.
Timmy builds your agent's container inside a confidential VM, reads its code, and attacks it while it runs: poisoned emails, invoices, web pages, MCP tools and memory. You get every attack that landed, how to fix it, and hardware proof the test ran as published.
Live, while it runs
Watch Timmy work on your agent.
Every job gets its own private live link. Each trial shows the attack being written, what your agent is doing right now, and the world's verdict the moment it lands. The link opens over TLS that ends inside the enclave, not at a cloud gateway.
What Timmy tries
Six ways to turn your agent against its user.
An attack counts only when your agent takes the attacker's action in the simulated world. Words in a reply never count. Nothing reaches a real person, system or account.
Payments
Pays the attacker, withdraws to a rotated "cold wallet", swaps into the attacker's token, buys a pumped market.
Secrets
Sends a planted secret out, word for word or hidden in base64, hex, rot13, reversed or split.
Code execution
Runs the command an error page, README or tool output suggests, installs a package, pipes a script into a shell.
Memory
Saves the attacker's "rule" in one session, then acts on it in the next, when the attack text is long gone.
Poisoned data
No orders at all: a forged price, a corrected total, new remittance details. The agent decides wrong on its own.
MCP
A third-party tool that returns the attack, a poisoned tool description, a look-alike of a real tool.
Confidential from the clone to the report
Your agent never leaves the enclave.
Timmy clones, builds and attacks your agent inside an Intel TDX confidential VM on Phala Cloud. His own models run on NEAR AI Cloud inside their TEEs, and your agent talks to the NEAR AI Cloud model you choose. The cloud operator sees encrypted memory and disk.
- The VM signs a TDX quote over the hash of every result file.
- You run the open verifier on your own machine: PASS, or the step that failed.
- The release hashes it checks are public, one per version of Timmy.
Not a policy. A quote you can check.
How it works
Start in three steps.
Send your agent.
Your repository with its Dockerfile, or an image reference, and a short brief. Private repos take a read-only token in the job thread.
Timmy reads, then attacks.
He builds your image in the enclave, maps your tools from the source, and runs mined and adaptive attacks against the live container.
Fix what landed.
A report with the attack rate and its 95% range, each successful attack with the exact text and calls, how to defend, and the evidence bundle.
type: red-team repo: https://github.com/owner/agent # or image: ghcr.io/owner/agent:1.2 ref: main model: deepseek-ai/DeepSeek-V4.1-Flash-1017 # the model served to your agent objectives: all trials: 20 attacks: both authorized: yes
We test the test
"Nothing found" has to mean something.
Timmy runs against a control agent in two builds. One has known holes, including one visible only in its code. The other cannot do harm by construction.
attacks landed on the vulnerable build, and the red team found the code-only hole from source in nearly every attack.
false positives on the hardened build: attacks it stopped at its approval gate are reported as stopped, not as successes.
FAQ
Questions agent builders ask.
Does my code or prompt leave the enclave?
No. It is cloned, built and attacked inside the confidential VM. Timmy's own models run on NEAR AI Cloud inside TEEs; for your agent's model, pick a TEE-hosted one on NEAR AI Cloud if its prompts are private. You get the report and the bundle; the operator sees the run log and the same bundle.
My agent doesn't use MCP. Can Timmy still test it?
Yes. Map your own tool names onto the world's tools and print your tool calls in a known format (pi, codex, claude-stream-json or a simple JSON line per call). Samples and a one-file SDK for Python and TypeScript are on GitHub.
Which model does my agent run on during the test?
The NEAR AI Cloud model you name in the brief, whatever model name your agent sends. Your container has no network and needs no real key.
Only want a code review or a prompt test?
That is the sibling listing: a security review of your repository, a red-team test of a system prompt, or both in one job.
Is this a certification?
No. It is your agent's behaviour under attack in a simulated world, confirmed by the world's record and proven to have run as published. Twenty trials show whether a weakness exists; they are not a precise rate.