SK Shieldus AI Red Teaming Moves From Model Tests to Agent Actions

SK Shieldus AI red teaming has expanded beyond model safeguards into agent behavior, medical systems, connected data, and external services. That wider scope matters because agents can act, not merely generate unsafe text.

The company says its white-hat hacker group, EQST, is building attack scenarios for systems that combine models with applications, private information, and operational tools. The team is also applying its methods to medical AI, where a manipulated decision can affect patient safety.

This is more than another hacking competition story. Microsoft, OWASP, and security researchers have already shown that prompt injection can survive modern defenses. SK Shieldus is now trying to convert competition experience into repeatable enterprise testing.

That shift puts pressure on security vendors and corporate buyers alike. Traditional penetration tests inspect software boundaries, permissions, and known vulnerability classes. Agent testing must also examine whether an AI follows hostile instructions hidden inside information it was authorized to read.

What SK Shieldus Changed in AI Red Teaming

SK Shieldus is widening the target from an isolated AI model to the complete environment in which an agent makes decisions and takes actions.

The company disclosed the expansion through its EQST white-hat group on September 18, 2026. According to the initial AI security report, EQST targets models, connected data, applications, external services, and agent environments.

That scope reflects the structure of enterprise agents. A model usually provides the reasoning layer, while surrounding software gives it access to files, messages, databases, and business applications.

Attackers do not need to defeat every component. They need one trusted input that changes the agent’s behavior or one excessive permission that turns a mistake into an action.

Prompt injection is central to this problem. It places malicious instructions inside material that an AI system processes, such as an email, webpage, image, or document.

An indirect attack does not require a user to type the hostile command. The agent retrieves the content during a normal task and can mistake embedded text for a legitimate instruction.

EQST says it uses a proprietary collection of attack scenarios and an internal testing methodology. The aim is to expose security risks that an organization may struggle to identify through internal review.

The team also contributed to an AI security red-teaming guide released by South Korea’s Ministry of Science and ICT and the Korea Internet and Security Agency. The July 7 guide covers preparation, execution, team organization, and reporting.

This process focus is important. A clever jailbreak can generate attention, but an enterprise assessment needs defined targets, evidence, severity ratings, remediation advice, and a reliable retest.

The expansion also connects to SK Shieldus’s broader treatment of AI agents as non-human identities. These are software actors that need controlled identities and permissions because they interact with corporate systems.

In August, the company said it was extending zero-trust practices to agents. Its approach treats every agent request as something that requires identity verification, limited authorization, and continuing evaluation.

That zero-trust expansion complements red teaming. Identity controls constrain what an agent can reach, while adversarial testing examines how those controls fail under pressure.

Neither component is sufficient alone. An agent with strong reasoning but excessive access remains dangerous. A tightly restricted agent can still expose data or produce harmful recommendations within its permitted environment.

The notable change is therefore not a single attack technique. It is the decision to test the entire chain between untrusted input and consequential action.

That chain can include retrieval systems, tool selection, authentication, memory, approval screens, logging, and downstream applications. Each connection creates another place where intent can be lost or authority can be misapplied.

For buyers, SK Shieldus agent security now carries a broader promise. EQST is not only testing whether a model refuses prohibited requests. It is testing whether deployed agents behave safely when their normal inputs become hostile.

AI Agents Turn Model Flaws Into Business Actions

The core security problem is excessive agency: a manipulated output becomes dangerous when software has enough permission to act on it.

A chatbot might respond to a hostile prompt with inaccurate or restricted text. An agent can use that same manipulated response to send a message, disclose a file, alter a record, or call another service.

OWASP defines excessive agency around three common design failures: excessive functionality, excessive permissions, and excessive autonomy. Its agency risk guidance describes how prompt injection can trigger damaging actions through overprivileged tools.

Consider an email assistant that needs to summarize a mailbox. Read access supports that purpose. Permission to send messages creates another capability that may not be necessary.

A malicious email can contain instructions that direct the assistant to search other messages and forward sensitive material. The agent may encounter those instructions while performing an authorized retrieval task.

The weakness spans several layers. The model fails to distinguish data from commands, the application exposes a sending tool, and the identity has permission to use it.

A model-only benchmark captures just the first failure. SK Shieldus AI red teaming must reproduce the entire path if it wants to measure operational risk.

Microsoft provided a concrete example through its LLMail-Inject competition. The simulated service could read emails and act for a user, including sending messages.

Attackers tried to place instructions inside emails that the service would retrieve. Their goal was to make the assistant perform an action that the user never requested.

The competition included defenses such as input classifiers, activation analysis, model-based judging, and instruction hierarchy. Participants still adapted their attacks across different scenarios and models.

Microsoft recorded 621 participants, 224 teams, and 370,724 submissions in the first challenge. The prompt injection results illustrate why a single successful evaluation cannot settle the issue.

Defenders change filters, prompts, and models. Attackers then alter wording, placement, encoding, language, or context. Agent security becomes a continuing contest rather than a one-time certification.

That is also why connected data deserves separate scrutiny. Enterprise agents ingest material from sources that employees already trust, including shared drives, customer tickets, internal wikis, and collaboration tools.

A malicious payload can enter through any contributor or compromised account with permission to edit that content. The agent may later retrieve it without recognizing the change as an attack.

Multimodal inputs add another path. Hostile instructions can appear inside an image, audio clip, or video rather than plain text.

In June, EQST researcher Byunghyun Kim won the Judgement Day AI red-team competition after using multimodal prompt injection against industry scenarios. SK Shieldus said the attacks included hidden text and fabricated system-style logs.

The competition covered eight scenarios, including medical, aviation, and disaster-response settings. Two additional EQST researchers placed fifth and seventh, according to the company’s competition disclosure.

Those results demonstrate practical attack-design experience. They do not establish that EQST can prevent every similar attack inside a customer environment.

The distinction matters because a competition presents known rules, measurable goals, and an isolated test environment. A corporate deployment includes changing integrations, inconsistent data, inherited permissions, and employees with different approval habits.

An enterprise engagement must translate attack success into design changes. Useful recommendations could include read-only scopes, narrow tools, deterministic validation, independent approvals, and limits on repeated actions.

It must also examine the approval interface. A human confirmation step offers limited protection when the agent writes the description that the person reviews.

Attackers can manipulate that description or hide the significance of an operation. The operator then approves a dangerous action while believing it serves the original request.

The security target is therefore not just model compliance. It is faithful execution of user intent across every boundary the agent crosses.

The Contest Record Builds Credibility, Not Proof

EQST’s competition results establish a capable attack team, but buyers still need evidence that those skills produce repeatable improvements in deployed systems.

The group has accumulated results across several forms of AI and conventional security testing. That breadth gives SK Shieldus a credible basis for expanding its AI red team.

EQST placed second in Microsoft’s Re:LLMail-Inject challenge in August 2025, according to the company’s account. The contest focused on adaptive indirect prompt injection against an email-based agent.

In June 2026, Byunghyun Kim placed first in Judgement Day. The competition ran for about eight weeks and tested attacks against AI systems in high-risk industry scenarios.

In August, EQST placed fifth at HalCTF, an AI agent hacking event held at AI Village during DEF CON 34. More than 200 teams participated, according to the September report.

The team also received a top prize, an excellence award, and a special award at a medical AI red-team challenge earlier in September. That event examined patient safety, cybersecurity, privacy, fairness, ethics, and agent safety.

These results cover useful categories. Email agents reveal indirect prompt injection. Multimodal systems test instructions hidden beyond ordinary text. Medical scenarios connect model behavior to safety-sensitive decisions.

However, leaderboards measure performance under contest conditions. They rarely answer the questions a chief information security officer needs resolved before deployment.

How many critical findings did a team discover in a production-like application? Which findings reproduced reliably? How quickly did engineers remediate them?

Did the fix stop related attack variants, or only the submitted payload? Did the system preserve useful functionality after stricter controls were introduced?

False positives also matter. A defense that blocks normal documents, customer messages, or legitimate tool calls can make an agent unusable.

False negatives matter more when the system handles sensitive information or irreversible actions. Buyers need measurements for both rather than a broad claim that an agent passed red teaming.

NIST’s generative AI risk profile recommends adversarial testing for prompt injection, data poisoning, model extraction, and other attacks. It also calls for metrics covering bypasses, unauthorized access, penetration attempts, and remediation.

The NIST risk profile frames red teaming as one part of continuing risk management. It does not present a successful test as permanent assurance.

This creates the main challenge for SK Shieldus AI red teaming. EQST must turn individual attacker skill into a service that delivers comparable evidence across customers, industries, and agent architectures.

A mature assessment should begin with an agent inventory. Testers need to know which identities, tools, datasets, memory stores, models, and external services participate in each workflow.

The team then needs threat scenarios tied to business outcomes. Extracting a harmless test string is different from exposing patient data, altering a payment record, or changing a production configuration.

Testers should record the full attack path. That includes the hostile input, retrieval event, model decision, tool call, permission check, approval step, and final result.

Remediation must address the path rather than the prompt. Blocking a specific phrase offers little protection if an attacker can paraphrase it or move it into another data format.

A stronger fix might reduce permissions, separate trusted instructions from untrusted content, validate tool arguments, or require an independent system to approve a high-risk action.

Retesting then needs new attack variants. Otherwise, the evaluation confirms only that developers blocked the known example.

SK Shieldus has not publicly supplied detailed enterprise outcome metrics for this expanded service. The September announcement does not specify detection rates, retest results, engagement volume, or customer remediation times.

That absence does not invalidate the capability. It limits what buyers can infer from awards and company statements.

The most persuasive next step would be anonymized evidence from real assessments. Useful disclosures would show attack categories, affected layers, severity, remediation patterns, and recurrence after fixes.

Until then, EQST’s record should be read as evidence of offensive expertise. It is not yet public proof of consistent risk reduction across enterprise deployments.

Medical AI Raises the Cost of a Miss

Medical AI makes agent red teaming harder because security, privacy, clinical safety, and human oversight can fail in the same workflow.

A medical assistant may summarize patient information, retrieve clinical references, schedule care, or recommend a next action. Each task can involve sensitive data and time-dependent decisions.

The risk changes again when an AI becomes an agent. It may connect to records, external knowledge sources, communication systems, or medical devices rather than simply generating an answer.

An injected instruction could distort which evidence the agent retrieves. It could also influence a recommendation, expose personal information, or direct a tool beyond its intended task.

A safety filter on the underlying model cannot inspect every downstream consequence. The surrounding application must enforce access limits, validate outputs, and preserve accountable human decisions.

The 2026 Advanced AI Digital Medical Products Red Team Challenge reflects that wider problem. Participants tested ways to bypass safeguards across patient safety, privacy, fairness, ethics, cybersecurity, and agent safety.

EQST’s awards suggest the team can work across those categories. SK Shieldus says the experience is helping it extend AI red teaming into medical environments.

Yet a challenge remains distinct from a clinical validation program. Medical systems operate under specific workflows, patient populations, data constraints, and professional responsibilities.

A red team can identify an attack path. It cannot by itself determine clinical effectiveness, acceptable residual risk, or the proper allocation of responsibility between software and clinicians.

That limitation should shape the service design. Security findings need to connect with safety engineering, privacy review, product governance, and post-deployment monitoring.

For example, an agent might retrieve an incorrect document after encountering manipulated metadata. The immediate issue looks like retrieval integrity.

The clinical impact depends on what follows. A low-risk assistant may display a source for human review. A more autonomous system might use the document to prioritize a patient or recommend an intervention.

The same technical weakness therefore carries different severity across deployments. Red-team reports must account for actual permissions, decision authority, and opportunities for human correction.

Medical testing also needs representative edge cases. A system may behave safely with ordinary language but fail when records contain abbreviations, contradictory notes, image annotations, or copied external text.

Attackers can exploit those ambiguities. They can also imitate trusted formatting, authority statements, system notices, or clinical instructions.

The Judgement Day result offers a relevant clue. EQST reportedly increased attack success by crafting input that resembled system logs and by targeting exceptions absent from the system prompt.

That method attacks trust signals, not just prohibited words. It tests whether the AI can distinguish the source and authority of information inside a complex context.

A medical record contains many such signals. Notes come from different professionals, systems, times, and levels of certainty. An agent must not treat every string as an instruction with equal authority.

The problem also exposes a tradeoff. Adding broad context can improve the agent’s usefulness, but each new source expands the untrusted input surface.

Granting more tools can reduce administrative work, but every tool adds possible actions. Greater autonomy can shorten a workflow while reducing the time available for review.

Organizations cannot resolve these tensions through a universal prompt. They need architectural controls aligned with each action’s consequence.

Low-risk retrieval may proceed automatically with logging. Disclosure of sensitive data may require policy validation. A clinical or operational change may need an independent human approval.

The user interface must clearly show the intended action, affected record, information source, and permission being used. It should not rely on an agent-generated summary alone.

Medical AI gives SK Shieldus a demanding proving ground. Success there would show that EQST can connect technical exploits with safety-critical operational controls.

Failure would expose the weakness of treating AI red teaming as an expanded penetration test. Agent security needs a broader view of decision quality, authority, and human accountability.

The Real Test Is Enterprise Repeatability

SK Shieldus must show that its AI red team can produce consistent findings even as models, tools, data sources, and permissions keep changing.

Traditional application testing often starts from a relatively stable release. An agent can change behavior after a model update, prompt revision, connector change, or permission adjustment.

A new document source can introduce hostile content. A new tool can increase the impact of an existing model weakness. A revised approval flow can create a fresh path around human oversight.

This volatility makes annual testing inadequate for important deployments. Organizations need evaluations before release, after material changes, and during ongoing operations.

Automated attacks can help with coverage. They can generate prompt variants, test several contexts, and repeat scenarios across models.

Automation also has limits. It tends to optimize against measurable goals and may miss organizational assumptions that a human attacker would question.

Human specialists can identify those assumptions. They might notice that a read-only agent can still create a damaging recommendation or that an approval screen hides the actual tool arguments.

The strongest service will combine both approaches. Automated checks provide frequency and regression coverage, while human red teams explore unexpected attack paths.

SK Shieldus’s scenario database could support that model. Reusable attacks can become regression tests after researchers validate them against a real system.

However, the library must evolve. Public examples quickly become training data for defenders, while attackers change encoding, context, language, and delivery format.

Microsoft’s research illustrates this cycle. Its updated competition added a high-precision blocklist, sanitization, stronger classifiers, and revised instructions after the first round.

Researchers then received another opportunity to adapt. That process mirrors real enterprise security, where yesterday’s mitigation becomes tomorrow’s test target.

Repeatability also depends on reporting. Two assessors should apply comparable severity criteria even when their attack creativity differs.

Reports should separate model vulnerabilities from application failures. They should also identify weaknesses in identity, permission design, data provenance, tools, and user interfaces.

A single label such as “prompt injection” hides too much. One attack may reveal unwanted text, while another can trigger a payment or expose an entire document repository.

Severity should reflect reachable data, available actions, required attacker access, user involvement, detectability, reversibility, and business consequence.

Organizations also need evidence that fixes reduce risk without destroying the agent’s value. A control that disables every external document may stop injection but defeat the workflow.

That is where buyer participation becomes essential. Security teams define acceptable risk, but product owners understand the task the agent must still complete.

Developers know where deterministic checks can replace model judgment. Identity teams can restrict scopes, while compliance teams clarify logging and retention duties.

Knowledge workers also influence exposure. They decide which documents enter shared systems and whether an agent’s output receives meaningful review.

Clear information boundaries can reduce the danger. Teams should identify trusted instructions, untrusted content, sensitive sources, and actions that require separate authorization.

A searchable knowledge base can improve context management, but retrieval alone does not establish trust. Provenance and permissions still determine how agents should use the material.

Organizations should avoid turning red-team findings into isolated tickets. The results need to update architecture standards, connector policies, approval rules, and regression suites.

SK Shieldus agent security will become more credible when customers can compare results over time. A useful program should show whether critical paths are shrinking after each test cycle.

The company could also publish an anonymized taxonomy mapped to common agent architectures. That would help buyers understand whether its scenario coverage matches their own deployments.

Independent validation would strengthen the case further. External benchmarks, peer-reviewed methods, or transparent evaluation criteria can separate repeatable capability from marketing language.

The central tension remains straightforward. Agents become more useful when they receive context and authority, but those same features increase the consequences of manipulation.

SK Shieldus AI red teaming is aimed at that tension. Its long-term value will depend on whether EQST can measure it consistently and guide customers toward safer designs.

What Buyers Should Watch Next

Three signals will show whether SK Shieldus has built an enterprise discipline or simply extended a successful competition narrative.

The first signal is published methodology. Buyers should look for a clear description of how EQST scopes agents, maps attack surfaces, ranks findings, and performs retesting.

A useful methodology should cover the model, retrieval layer, memory, identity, permissions, tools, data sources, and approval interfaces. It should also distinguish direct attacks from indirect prompt injection.

If SK Shieldus publishes repeatable criteria, its expansion becomes easier to evaluate across industries. If the process remains opaque, customers must assess capability engagement by engagement.

The second signal is evidence from deployed systems. Anonymized case studies should report which attack paths appeared, how customers fixed them, and whether variants succeeded after remediation.

The strongest evidence would include detection rates, false positives, critical findings, retest outcomes, and time to remediation. It should avoid presenting a clean test as proof of permanent safety.

Customer evidence would strengthen the company’s central claim. A continued focus on rankings and awards would leave the operational impact uncertain.

The third signal is integration between testing and agent governance. SK Shieldus has already linked agents with non-human identity and zero-trust controls.

Buyers should watch whether red-team findings automatically inform permissions, monitoring, connector policies, and approval requirements. That feedback loop would convert attacks into lasting controls.

The signal weakens if red teaming remains a separate consulting exercise. Reports often lose value when their recommendations never reach identity systems, engineering standards, or deployment gates.

Competitor activity will matter too, but it should remain supporting context. Microsoft and the broader security community continue to develop defenses, benchmarks, and design patterns for indirect prompt injection.

Those efforts raise expectations for every vendor. Claiming prompt-injection expertise is no longer enough when public research already documents adaptive attacks against layered defenses.

Enterprise buyers should ask a direct set of questions before commissioning a test. Which complete workflows will the team attack, and which consequential actions sit at the end of each path?

They should ask whether testers can examine application code, prompts, tool definitions, access scopes, and logs. Black-box testing offers one perspective, but internal access can expose deeper design errors.

They should request retesting with attack variants after remediation. They should also require evidence that new controls preserve legitimate tasks.

Finally, they should identify who owns unresolved risk. The red team can expose a failure, but business leaders must decide whether to reduce permissions, add review, redesign the workflow, or delay deployment.

SK Shieldus has assembled a credible offensive record and selected an important target. AI agents create a security problem that spans models, software, identities, data, and human decisions.

The next stage is harder than winning a contest. EQST must prove that SK Shieldus AI red teaming produces repeatable evidence and safer enterprise behavior.

For teams deploying agents now, the practical question is not whether a model can be tricked. Public competitions have already answered that question.

The decision is whether each agent has enough authority to turn manipulation into harm. Map that path, restrict unnecessary access, and test the complete workflow before trusting the agent with consequential work.