Agent OPFOR — open-source adversary emulation for AI agents. Named after the concept for a reason.
This covers a coding tool or code-capability update — useful for developers assessing workflow changes and reusable value.
OPFOR: Opposition Force. The unit that plays the enemy in training so everyone else learns what real attacks feel like before they come. That's the mental model for this tool.
We built Agent OPFOR to red-team AI agents the way an actual adversary would — not a static eval, not a single-shot probe. Multi-turn adversarial conversations, adaptive attack campaigns, full audit trail.
What the attack surface covers:
- Prompt injection and jailbreaks (multi-turn, not single prompt)
- System prompt extraction
- Tool misuse and BOLA/BFLA via tool-calling agents
- MCP endpoint attacks — tool description injection, secret exposure, scope escalation, SSRF
- Memory poisoning
- Excessive agency and goal hijacking
- EU AI Act bias testing
opfor hunt — autonomous red team mode: Give it an endpoint and an objective. A commander agent plans the campaign, operators run the probes, a scout handles recon. The commander adapts based on what each response reveals. Add --ui to watch the attack tree live.
This is a labour of love and we would love to know your feedback.