The multi-agent engine
DoesItDefend runs coordinated attack chains, not parameterized scripts. Each agent reads the target's response before deciding which probe to run next — findings from one agent become context for the next.
The engine runs coordinated chains, not parameterized scripts: each agent reads the target's responses and decides what to probe next, with earlier findings becoming context for later steps.
This page walks the four-phase pipeline and explains what 'adaptive' means — and what it does not mean — for determinism and evidence.
Key points
- Multiple specialized agents run in parallel: injection probes, evasion probes, tool-call abuse probes, data exfiltration probes. Each agent observes the target's response before selecting the next probe.
- Finding-based routing: when an agent detects a bypass, that finding feeds into a shared context pool. Subsequent agents select probes that exploit the discovered weakness further.
- Every probe references a corpus entry (probe_id). The corpus is version-locked per run so two runs on the same corpus produce comparable, reproducible results.
- For conclusive evidence, bypass rate is findings divided by usable active probes. Zero means no finding in that usable set; one hundred means every usable active probe produced a finding. Neither value extrapolates beyond the recorded corpus and scope.
The four-phase pipeline
- Phase 1 — Recon: probes that map the target's input surface (accepted templates, system prompt constraints, active tool integrations). Informs which bypass probes to deploy.
- Phase 2 — Bypass: probes that attempt to override instructions, inject adversarial content, or elicit disallowed outputs. Probe selection adapts to the recon result.
- Phase 3 — Escalation: when Phase 2 finds a bypass, escalation probes attempt to deepen impact — exfiltrating data through the bypass, chaining tool calls, or probing adjacent endpoints.
- Phase 4 — Evidence: the engine emits an evidence-backed finding per confirmed bypass with probe_id, prompt_excerpt, response_excerpt, OWASP category, and an auto-emitted Sigma rule.
Phases separate concerns: reconnaissance narrows the surface, chained probing exercises it, scoring grades what came back, and the evidence phase emits findings only where canonical evidence supports them. A phase that cannot complete honestly stops the chain instead of guessing.
What 'adaptive' means in practice
- Recon informs bypass selection: if the target uses SYSTEM_ROLE enforcement, the engine deploys role-confusion probes. If tool-calling is enabled, tool-call abuse probes are included. Static scanners skip this step.
- Corpus coverage is fixed per run for reproducibility. Adaptivity operates within the corpus — selecting which subset of probes to run based on the target's response, not inventing new probes.
- Custom scenarios (Pro plan) extend the corpus. Your probes participate in the same adaptive routing as built-in probes and can trigger escalation chains.
Adaptive refers to the chaining behaviour, not to free-form generation. Probes stay inside the declared corpus and scope; custom scenarios join the same pipeline and grading as built-ins, so adaptivity never becomes an excuse for unaccountable requests.
Related resources