Definition
Plain language
A second AI whose only job is to attack the AI being tested, adjusting its tactics until it finds a way in.
As stated in the literature
An adversarial agent that runs adaptive, multi-turn attacks against a target agent, establishing legitimate context before escalating harmful intent over successive rounds, and reporting suspected successes for independent verification.
Why it matters: It lets testers probe an AI the way a persistent real attacker would, uncovering weaknesses that a single scripted prompt would miss.
For example, it might first chat casually to seem trustworthy, then over several messages nudge the target AI into revealing something it should refuse.
Heard on the show
“Third, the Control Agent — a second AI whose entire job is to attack, adaptively.”Episode 202 — How Do You Know an AI Agent Actually Refused? Check the World, Not the Words