What is the problem your project solves?

Companies are handing AI agents the keys to their email, money, customer databases, and now their phone lines — with zero standardized safety testing. Cars have crash tests. Bridges have load tests. AI agents ship with nothing.

The failures are already happening in production:

• Prompt injection hidden in content an agent reads (the EchoLeak / Copilot class) — no malicious user required.
• Cross-customer data leaks where an over-scoped tool hands one customer another's record (the Salesforce ForcedLeak class).
• Credential and system-prompt extraction, jailbreaks, unauthorized actions (refunds over policy), and toxic/off-brand output under the company's name.

And the fastest-growing surface is voice: every bank, telecom, and airline in India is replacing call-center staff with AI voice agents. Phone agents face attacks text tools never test — authority impersonation, urgency, emotional manipulation, and language-switch bypasses (rules that hold in English but break in Hindi). Nobody is stress-testing them, in the languages people actually call in.

CrashTest is the pre-deployment crash-test lab that catches these failures before an agent goes live — not after it leaks a customer's account number on a recorded call.

How you are solving it?

You bring your agent (a system prompt, a config, or a voice bot); CrashTest drops it into a battery of adversarial traps and hands back an auditable safety grade.

How it works

1. An AI attacker (Claude, in persona) social-engineers the agent under test across multiple turns, escalating tactics and adapting to every refusal.
2. Deterministic canary scanning proves a leak: each trap plants exact secret strings, and if one comes back out of the agent's mouth it's a leak — a string match, not an opinion. The judge explains; the canary proves.
3. A Claude judge scores each run 1–5 across the relevant harm dimensions with the exact offending line cited. A proven leak clamps the rating no matter how charitable the judge feels.

Coverage — 30 scenarios across 5 categories + 6 voice tests

• Data & secret leakage · Injection (direct, indirect/EchoLeak, crescendo, encoding) · Policy & action violations · Content & brand safety · Robustness (incl. over-refusal and language-switch).
• Voice red-team: an AI attacker phones a VoiceBank agent and tries to talk it past verification — played as a live call in the browser (text-to-speech), with a replay-the-leak moment.

The output

• A graded report (A–F) with a per-dimension radar, and for every case: the exact system prompt, the full transcript (attacker turns, tool calls + results, agent replies, leaks), and the verdict with cited evidence — downloadable as HTML/PDF and as a complete plain-text log.
• A scenario composer that uses Claude to auto-generate new domain-specific traps for any agent.

Disclosure: built during the hackathon. Trap scenarios are adapted from Anthropic's published Agentic Misalignment research; all engine, scoring, reporting, and voice work was built at the event.

How Did You Use Claude?

Claude is the entire intelligence layer — three Claudes in a loop, plus one more building it.

1. Agent under test — Claude runs the pasted system prompt inside the trap, believing its tools are real.
2. The attacker — a second Claude plays an adaptive red-teamer: it never sees the planted secret, stays in persona, escalates tactics turn by turn, and adapts to refusals. It replies through a structured next_message tool call.
3. The judge — a third Claude reads the full transcript + the deterministic canary hits and returns a structured verdict via forced tool use (star rating, per-dimension triggered/reasoning, cited evidence).
4. The scenario composer — Claude auto-generates new adversarial scenarios for a user's own agent domain.

Built on the Anthropic TypeScript SDK (@anthropic-ai/sdk) with Claude Opus, using tool use and structured outputs throughout. We also built the whole app with Claude Code. Claude isn't a feature here — it's the attacker, the target, and the referee.

What is the deployed URL for this project?

https://crashtest-mauve.vercel.app