Agent Testing

Overview

Tachyonic can test AI agents that run as CLI programs, not just HTTP APIs. This covers agents like Codex, Claude Code, custom chatbots, and any agent accessible via a command-line interface.

Local CLI Agent

Test an agent that runs as a local command:

tachyonic scan \
  --cli-command "my-agent" \
  --categories prompt-injection,tool-abuse \
  --max-attacks 10

Tachyonic sends payloads to the agent's stdin and reads responses from stdout.

With Agent Name

Some CLI tools (like Clawdbot) require an --agent flag:

tachyonic scan \
  --cli-command "clawdbot" \
  --cli-agent "my-assistant" \
  --categories prompt-injection

Declare Capabilities

Tell Tachyonic what the agent supports so it selects the right attacks:

tachyonic scan \
  --cli-command "my-agent" \
  --cli-supports-tools true \
  --cli-supports-rag true \
  --cli-supports-multi-turn true

Flag	Default	Effect
`--cli-supports-tools`	false	Include tool-abuse attacks
`--cli-supports-rag`	false	Include indirect-injection attacks
`--cli-supports-multi-turn`	false	Include multi-turn manipulation attacks

Remote Agent via SSH

Test an agent running on a remote machine:

tachyonic scan \
  --cli-command "my-agent" \
  --ssh-host "user@staging-server.com" \
  --categories prompt-injection,system-prompt-extraction

Tachyonic SSH-es into the host, runs the command, and sends payloads over the SSH session.

SSH Requirements

SSH key-based authentication (no password prompts)
Agent command must be in the remote PATH
Remote host must have the agent installed and configured

Examples

Test a Customer Support Bot

tachyonic scan \
  --cli-command "./support-bot" \
  --categories prompt-injection,sensitive-disclosure \
  --max-attacks 20 \
  --format html \
  --output support-bot-report.html

Test a Code Generation Agent

tachyonic scan \
  --cli-command "code-agent --no-interactive" \
  --cli-supports-tools true \
  --categories tool-abuse,permission-escalation,jailbreak \
  --format json \
  --output code-agent-results.json

Test a Remote Staging Agent

tachyonic scan \
  --cli-command "production-agent" \
  --ssh-host "admin@staging.example.com" \
  --categories prompt-injection,system-prompt-extraction \
  --max-attacks 10

On this page