Review results and troubleshoot

Every agent you test gets a row in Red teaming, with its latest score, open findings by severity, and last run. Click a row to open the agent’s latest campaign. To see an earlier run, pick it from the run menu at the top of the page.

Red teaming agents list with the security score, findings by severity, and last run for each agent, a Resume action on a paused run, 7 runs left, and Add agent

Read the report

The report builds on the campaign page while the campaign runs, and it’s final once the campaign is complete.

A completed report: the verdict, a security score of 60 (grade D, up 23 since the last run), 17 attacks, 4 got through, 4 open findings, the attack surface by category, and a moment showing a leaked system prompt

Part	What it shows
Verdict	The worst things the agent did, with the run’s date, duration, and whether it was a CLI or sample run.
Security score	0 to 100, higher is safer, with a grade: A 90+, B 80+, C 70+, D 55+, F below 55. Shows the change since the agent’s previous run.
Attacks and Got through	Attacks sent and attacks that succeeded. Partial leaks show as +N partly.
Open findings	Findings that still need a fix.
Attack surface	One row per category and one mark per attack: Got through, Partly, or Blocked. Click a row to filter the findings.
Moments	The key exchanges, one per slide. Click Evidence to open the details.
Findings	Confirmed breaches with severity, status, leaked text, category, and OWASP code.
Attack log	Every attack and profiling message, in order.
Agent profile	What profiling learned about the agent: type, persona, guardrails, tools, refusal style, and its reconstructed instructions.

Replies that may contain your agent’s instructions stay hidden until you choose to reveal them.

A good grade doesn’t prove your agent is secure. It means no severe breach was confirmed in the attacks this campaign ran.

Work through a finding

Open the finding

Click a row in Findings. The panel shows the leaked text, a Suggested fix, the attack and your agent’s reply, and the category, technique, OWASP, and MITRE ATLAS mappings.

A finding panel for Invent a refund policy that doesn't exist, marked Medium and Open, with the leaked text, the suggested fix, the attack and agent messages, and details

Set its status

Open the status menu, which starts at Open:

Mark fixed after you change the agent. The finding becomes Ready for retest.
Accept risk or False positive closes the finding without a fix. You can add a reason.

Retest

Click the retest button at the top of the page, such as Retest 2 fixes. It takes you to the launchpad to start a new run on the same agent. For a CLI agent, run the scan command again. When the run completes, each fixed finding becomes Verified fixed, or Reopened if the attack still works.

Finding statuses are saved in your browser only, so teammates don’t see them.

Share › Copy image or Download image creates a card of the result with sensitive leaks redacted. Copy link copies a link to the campaign.
The ⋯ menu has Run again, Copy scan command for CLI agents, Export JSON for complete campaigns, and Copy campaign ID.

Campaign states

State	Meaning	What to do
Queued	Waiting to start.	Keep the CLI running.
Running	Attacks in progress.	Follow the campaign page.
Paused	The CLI disconnected before the run finished.	Run `respan-redteam scan adapter.py` again to continue. For the sample agent, click Run again.
Complete	The report is ready.	Read the report.
Failed	The run stopped with an error.	Fix the cause shown under Campaign failed, then click Run again.

Coverage and limits

Categories that need more access than chat messages, such as retrieval, embeddings, or training data, are listed under N not tested. That’s neither a pass nor a failure.
Campaigns adapt to your agent, so two runs can use different attacks and get different results.

Troubleshoot

Problem	What to check
Your agent isn’t answering	The adapter is running and can reach your agent. The notice names the cause: an HTTP status, rejected credentials, a reply the adapter couldn’t read, or a timeout.
The scan doesn’t open on the launchpad	The CLI is signed in to this project. A started scan also shows up in Red teaming.
The adapter fails	`open()` returns a fresh conversation, and `send()` takes and returns strings. Test it with the one-line check in Write a good adapter.
No runs left	Click Upgrade to run, then View plans. On Team and above, the dialog also shows when your allowance resets.

Handle report data safely

Reports can contain attack prompts, agent replies, reconstructed instructions, secrets, and personal data. Limit who can open them, and treat exported JSON and shared images the same way.