Augustus expands from prompt injection into six new attack categories — testing multimodal vision models, agentic tool-use, tool selection hijacking, reasoning model internals, structured-output exploitation, and PDF document attacks — with full per-probe risk coverage and multi-provider support now live in the Guard platform.

What's New

• Multimodal image attack probes — 13 probes test vision-capable LLMs across visual prompt injection, steganographic payloads (LSB, adaptive LSB, DCT, neural), image scaling attacks (nearest-neighbor, bicubic, bilinear), typographic scene injection, near-invisible text overlays, tiny-font injection, and metadata injection (EXIF and standard).

• Tool-use attack probes — 14 probes test function-calling manipulation with a native wire layer that sends real tool definitions through the OpenAI, Anthropic, Gemini, and Cohere APIs across chat-mode, native tool-calling, and agent-loop surfaces.

• Tool selection hijacking probes — 8 probes target attacks that trick an LLM into choosing the wrong tool: authority injection, MCP tool description poisoning, parasitic chaining, and causality laundering.

• Structured-output exploitation probe — TrojanSchema tests adversarial JSON schemas that trick models into simulating code execution over innocuous-looking class definitions whose harmful intent rides in hidden parameters.

• Reasoning model attack probes — 5 probes target reasoning model internals: adversarial chain-of-thought injection (static and adaptive multi-turn variants), logically steered reasoning, computational DoS via excessive token consumption, and spurious decision criteria injection.

• PDF document attack probes — 5 probes test document-capable models with invisible text, off-page text, one-point-font text, metadata injection, and annotation injection hidden in PDF documents.

• Agent configuration injection probe — tests whether indirect content (internal memos, colleague updates, documentation references) can inject attacker-controlled operational rules into an agent's behavior.

• WebSocket and hybrid generators — test LLM frontends that use WebSocket or mixed HTTP+WebSocket transports, including GraphQL subscription chat and async job-polling patterns.

• 4 new encoding buffs — CamelCase, MathPrompt, Emoji, and Pig Latin encoding transformations for testing whether security filters catch obfuscated payloads.

• LLM-judge tool-leak detection — opt-in judge that evaluates whether tool information was leaked during chat-mode interactions, with goal-conditioned scoring for tool-use attack probes.

• Per-probe risk granularity in Guard — each probe now generates its own risk instead of one risk per scan, with multi-turn attack findings surfacing as individual risks and user-settable judge and attacker model selection.

• Multi-provider support — scans run against any supported LLM provider through Guard's model routing layer, with tool-format translators for all major APIs.

Get Started

go install github.com/praetorian-inc/augustus/cmd/augustus@latest

Guard Platform customers already have these capabilities available — all new probe categories run as part of Augustus scans within the platform.