Approve, run, and watch the attack

​

Approve

BotGauge never attacks your agent until you approve a specific plan. An approval has four properties.

• It covers exactly what you reviewed. If the agent, rules, or settings change afterwards, you review again.
• It states the limits: attempt budget, time, tools that may be touched, channels, and environment.
• It expires. The default is 60 minutes, and the maximum is 7 days, so an old approval can’t be reused.
• It is refused in production if it would allow real actions or tests inside the agent’s data.

In the console wizard, choosing Start Attack is your approval of the plan you just saw. In the API you approve explicitly, or inline when you start.

​

Why a start can be refused

​

What happens when you start

BotGauge freezes the plan and everything the run depends on: your agent’s profile and rules, the attack library version, and the judge and attacker models. This run pin lets you later reproduce and fairly compare results. Then it queues the run.

​

The attack, in two rounds

Prepared round. A library of about 50 attack categories, each tried in several disguises. Examples include hiding the request in encoding (base64, hex, ROT13, look-alike characters, leetspeak), wrapping it in a story, role-play, hypothetical, citation, or survey, and using known jailbreak templates and special tokens. Adaptive round. An AI attacker reads how your agent actually answers and adjusts. It may escalate gradually over several messages (crescendo), rephrase until something works, try to pivot into another customer’s account, or hide instructions in a document, tool result, or memory that the agent will read (grey box only). The adaptive round runs only if there is something worth adapting to and budget and time remain. If it is skipped, the report states why: budget, time, approval expired, blackout, stopped, or error. Multi-turn limits. Up to 8 messages per conversation, 5 attempts per rule and method, and 300 AI-driven attempts per run.

​

Watch the run

In the console, results arrive live. A phase bar shows Core, Stress, and Deep, each marked to do, running, done, or skipped, with a count of flagged attacks. Results are grouped by category with a progress bar and a counter such as “X attacks tested so far, Y flagged”. Click any resolved row for its evidence. The live stream reconnects automatically. If it can’t, a banner says “Lost the live connection” and the page checks the run’s status for you.

​

Stop a run

Choose Stop attack, or stop the run in the API. Attempts already finished are kept and appear in the report. A run can also stop on its own when the budget is used up or when the time limit is reached. If the connection to your agent keeps failing, the run ends with an error rather than reporting false passes.

​

Safety guarantees

• The most dangerous content categories, such as weapons or child exploitation, are never probed.
• In production, runs are read-only attacks only.
• Every attempt is recorded and can’t be edited afterwards.