> ## Documentation Index
> Fetch the complete documentation index at: https://www.botgauge.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Red teaming overview

> How BotGauge red-teams your AI agent: what an attack is, what the results mean, the journey from connection to report, and what to prepare first.

BotGauge attacks your AI agent the way a real attacker would, then tells you what broke, how sure it is, and what to fix. You can go from zero to a first report in about 15 minutes.

## What an attack means

BotGauge sends your agent carefully crafted messages that try to make it:

* reveal its hidden instructions (the system prompt)
* leak customer or internal data
* drop its rules because someone asked cleverly or hid the request in a document
* take actions nobody asked for, such as a wrong refund amount, a repeated payment, or touching another customer's account
* claim it did something it did not do

## What you get

For every rule tested, you get a result: broke, held, suspicious, or could not be tested, with the reason. For each problem you see the exact prompt, the agent's reply, and the tool calls behind it. You can re-check a fix by replaying the attack, and you can view the results mapped to frameworks such as the EU AI Act, ISO 42001, SOC 2, GDPR, and OWASP.

## The journey

**1. Connect your agent**

Tell BotGauge how to send your agent a message and read its reply, then [test the connection](https://www.botgauge.com/docs/red-teaming/connect-your-agent.md).

**2. Let BotGauge learn it**

BotGauge chats with your agent to learn what it does. This discovery step is called [recon](https://www.botgauge.com/docs/red-teaming/recon.md).

**3. Review the rules and attacks**

See the [rules and plan](https://www.botgauge.com/docs/red-teaming/rules-and-plans.md) that will run.

**4. Approve and start**

Nothing attacks your agent before you approve a plan. See [Approve and run](https://www.botgauge.com/docs/red-teaming/approve-and-run.md).

**5. Watch, or stop at any time**

Results arrive live, and you can stop the run whenever you want.

**6. Read the results**

Understand the [seven possible results](https://www.botgauge.com/docs/red-teaming/results.md) and the evidence behind each.

**7. Fix, verify, and use the compliance view**

[Replay a finding](https://www.botgauge.com/docs/red-teaming/fix-and-verify.md) to confirm a fix, then open the [compliance view](https://www.botgauge.com/docs/red-teaming/compliance.md).

## Before you start

Have these ready.

* A BotGauge account and workspace.
* A test or staging copy of your agent. Use production only if you must. Production runs read-only attacks only, which limits what can be tested.
* The agent's URL and the request format it expects.
* Any API key or token it needs. BotGauge stores these as [secrets](https://www.botgauge.com/docs/platform/secrets.md) and never shows them back.
* Optional: the agent's system prompt and a list of its tools, which improve the results.
* Optional: a developer who can add the BotGauge wrapper to your agent for deeper testing. See [black box and grey box](https://www.botgauge.com/docs/red-teaming/black-box-and-grey-box.md).

No agent yet? Use the sample refund agent in the [red teaming quickstart](https://www.botgauge.com/docs/red-teaming/quickstart.md) to see everything first.

Explore red teaming in BotGaugeFollow the steps from agent connection to compliance report in [BotGauge](https://cloud.botgauge.com).

[Try BotGauge →](https://cloud.botgauge.com)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.