Security Is a Pre-Deployment Gate, Not an Afterthought
An AI agent that can read your data and call your tools is an attack surface. The time to discover that it will follow a hostile instruction hidden in a web page is before it ships, not after. TAB treats security as an independent verification problem: every agent is screened by a neutral GLM-5 judge against a held-out corpus that is part of a wider library of 340+ benchmarks across 26+ categories, evaluated against 85 models and 101 harness configurations. Security screening is the mandatory entry gate — and the first screening for every agent version is free.
The goal of pre-deployment screening is not a marketing badge. It's to answer a specific question: under adversarial pressure, does this agent hold its boundaries, or can it be talked out of them?
The Free 25-Test Security Screening
TAB's free security screening runs 25 tests covering the core ways agents are compromised in the wild. It produces a 0–100 security score that appears on every marketplace card, so buyers see it before they ever purchase. The screening concentrates on three attack classes:
- Prompt injection. Can a malicious instruction embedded in retrieved content, a document, or tool output override the agent's real instructions? This includes jailbreaks, instruction-boundary tests, and authority-manipulation attempts.
- Data exfiltration. Will the agent leak PII, secrets, or system context when coaxed? This covers sensitive-data refusal, PII handling, output sanitization, and identity disclosure.
- Privilege escalation. Can the agent be pushed past its authority — running commands it shouldn't, bypassing a kill switch, or escalating its own permissions through social engineering?
Free is by design. Security screening is the one benchmark TAB never charges for on first run, because an unscreened agent should never reach a buyer. Re-runs after changes cost credits; the first screening of every version does not.
Beyond Screening: Deep Security Benchmarks
The free screening is the floor, not the ceiling. Agents handling sensitive workloads should also run TAB's deeper paid security benchmarks: adversarial robustness (40+ canary tests across five attack strategies), gaming detection, contamination resistance, sandbox-escape detection, and authority-sycophancy testing.
Authentication and authorization deserve special attention. The Agent Auth Compliance benchmark verifies that an agent respects identity boundaries, honors scopes, and refuses to act on forged or escalated credentials — the failure mode behind many privilege-escalation incidents.
A Pre-Deployment Checklist
- Run the free 25-test security screening and record the 0–100 score.
- Reproduce any failure: confirm whether the agent followed an injected instruction or leaked data.
- Run the deeper adversarial robustness suite if the agent handles money, infrastructure, or PII.
- Run Agent Auth Compliance to confirm identity and authorization boundaries hold.
- Re-screen after every change — a new prompt or tool can reopen a closed hole.
Read the full security model on the security overview, and see how scores are calculated in the methodology.