Backed by Noma Labs research, Noma's next-generation engine combines attack techniques, verifies agent actions, and delivers initial results in minutes so your team can turn findings into fixes.
An agent can refuse a malicious request in response and still carry out the action. It can withstand a direct attack, then fail when the same attack combines a convincing pretext, an encoded instruction, and pressure to comply. Security teams need tests that expose those failures and evidence that helps them fix what went wrong.
Building on Noma’s existing AI Red Teaming capabilities, the next generation of our engine brings together compound attack changing, faster testing, and cleared evidence of how an attack succeeded or a defense held. It helps teams test the agents and AI applications they build, along with the models behind them.
Noma Labs, our security research team, powers the engine’s attack library with research into how attackers probe AI applications. Ongoing benchmarking helps keep testing caused on effective techniques as models and defenses change. Here’s what the next generation brings to your testing program.
Attackers don't use one trick at a time
A direct request for sensitive data is easy for an AI application to refuse. What happens when the same request shows up framed as an authorized internal task, with part of it encoded and a push to comply quickly? The goal hasn't changed, but the request now looks very different to the target, and testing those techniques separately can miss the failure their combination exposes.
Noma's engine builds every test around a single attack goal, such as sensitive data disclosure, and chains techniques from five categories to reach it: Framing, Obfuscation, Delivery, Pressure, and Trigger. Instead of trying one technique at a time, each test layers them the way an attacker probing your application would. The engine draws on several hundred techniques and an expanded library of attack goals, built from Noma Labs research and real-world attacks.
You can also test against the rules your organization already has. With Custom Goals, you describe what you want to test in plain language, such as a requirement from your internal AI use policy, and Noma generates attack prompts aimed at that goal before applying its techniques on top. That gives security and leadership teams a direct, evidence-based answer to a hard question: do our AI applications follow our own policies when someone pushes on them?
Prove what the agent did, not just what it said
Agents read content, call tools, and take actions. For those agents, the action is where the risk lives. Consider an agent that replies "I can't do that" and then makes the request anyway. If testing only judges the text of the reply, that agent looks safe.
Action Boundary closes that gap. Its first goal, Web Exfiltration, tests whether an agent can be manipulated into carrying out an injected web request. When the request reaches infrastructure Noma controls, the test fails, no matter what the agent's reply claims. The result is backed by hard evidence, and you don't need to install or connect anything for it to work.
Start with the right test instead of a blank configuration
Several hundred techniques create a lot of options, and most teams don't want to design a red teaming suite from scratch just to learn whether their AI applications are safe. So the engine starts with presets curated by Noma Labs, which turn that research into a meaningful first result in minutes:
- Recommended is the default, a balanced assessment you can run on a new target without touching configuration.
- QuickScan runs in minutes, fast enough to gate every release in your CI/CD pipeline, with a pass/fail threshold through the SDK.
- Full Coverage runs the full catalog when a target needs a deeper assessment.
- Framework presets for the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS map results to the controls your team reports on.
A common pattern is to run QuickScan on every release and Recommended or Full Coverage on a nightly or periodic schedule. Teams that want more control can still adjust the techniques and goals for any target.
Keep test current with Noma Labs Research
Speed matters after the first scan, too. A suite configured once at onboarding keeps running the same attacks while models and defenses move on, and a single model update can make yesterday's attacks fail while opening new weaknesses. Noma Labs keeps pace by adding new techniques as attacks emerge, and Noma continuously benchmarks every technique by attack success rate (ASR), how often an attack reaches its goal under benchmark conditions. Those results keep QuickScan and Recommended focused on the techniques that are working now, so your testing picks up the latest research without your team having to track it.
Test the Models your Teams want to Use
The same flow covers the models your teams want to approve. Alongside OpenAI, Gemini, Claude, and Amazon Nova, you can test open-weight models from Qwen, Kimi, and DeepSeek, plus the long tail of models on Hugging Face, and compare how an open-weight model holds up against a commercial one before you decide which to use.
Get results your team can act on
A score without context creates more investigation work than it resolves. After each test, An AI evaluator called the judge reviews how the target responded and decides whether the attack reached its goal. Every result in Noma shows the attack goal, the techniques that were combined, the judge's rationale for the outcome, and the evidence behind it, including every prompt sent and every response returned. Passed tests get the same explanation as failed ones, so you can see why a defense held as well as where it broke.
Context also matters when deciding whether an attack succeeded. Take an application built to analyze suspicious content. If it quotes part of a malicious instruction while explaining why the content is dangerous, it hasn't followed that instruction. Target descriptions tell Noma what each application is supposed to do and what it shouldn't do, and the judge's guidance can be tuned for a specific target so expected behavior isn't scored as a failure. That keeps your team focused on real findings.
Findings also map to OWASP and MITRE ATLAS, with impact details and mitigation guidance, so they fit directly into the frameworks you already use for audits and reporting.
Turn findings into stronger runtime protection
Red teaming shows you where an agent breaks before it reaches production. Runtime protection enforces the limits you set once that agent is working inside the business. The two work best when they inform the same security program.
A failed test might show that an agent follows instructions it should reject, returns information it should protect, or steps outside the task it was given. The failure should determine the fix. An agent with more access than it needs may need tighter permissions. An agent that untrusted content can redirect may need stronger runtime policies. Some findings will call for changes to the application itself. After the change, rerun the same test and confirm the weakness is closed.
Within Noma's agent security and governance platform, red teaming for homegrown agents feeds that broader work of discovering exposure, controlling access, and stopping risky behavior across endpoint, SaaS, and cloud environments.
Keep testing as your agents change
The next generation of Noma AI Red Teaming gives your team more ways to challenge agent behavior and understand the outcome. Use the findings to adjust application instructions, tighten permissions, or strengthen runtime policies, then rerun the tests to assess whether those changes addressed the failure.
Repeat the process as models, tools and agent access change. Red teaming provides evidence to guide those decisions, while Noma’s runtime controls enforce policies as agents work inside the business.
See Noma’s next-generation AI Red Teaming engine in action. Request a demo.
-optimized.webp)
