MiDojo: Red-Team Any Agent in Any Environment

Abstract

Tool-using AI agents are vulnerable to prompt injection: adversarial instructions delivered through their inputs or hidden in the data they read while doing legitimate work. Resisting these attacks is a system-level property — it depends on the LLM, its tools, and their data environment as a unit — yet most red-teaming systems are based on simulations that rarely reflect the agent's actual deployment.

We present MiDojo, a framework that red-teams agents right where they run. MiDojo follows a man-in-the-middle design: it interposes fake tools and environment artifacts between the agent and the real world. Payloads are spliced into normal tool outputs so the agent encounters attacks as a side effect of ordinary work — the way real prompt injections land. The interception is swiss-cheese: each fake tool can forward to its real counterpart, intercept and inject, or both — you control what the agent touches for real and what is staged. Pluggable environment backends — from in-memory state to sandboxed containers — supply runtime observations, and verification providers consume this evidence to grade attacks that leave no trace in the agent's reply.

MiDojo lets you battle-test your agent at every level of attacker access: a malicious prompt (input-level), a compromised data source (data-level), or a hijacked tool response (tool-level) — mirroring the black-, gray-, and white-box progression from traditional penetration testing.

Benchmarks draw from an attack library aligned to the OWASP Agentic Security Initiative Top 10 or from custom corpora. Each evaluation pairs one legitimate task with one adversarial objective and grades utility (task completion) and security (predicate assertions over behavior and state).

MiDojo supports a variety of agent protocols, enabling red-teaming across frameworks without modifying the agent under test.