How the multi-agent engine works
DoesItDefend runs coordinated attack chains, not parameterized scripts. Each agent reads the target's response before deciding which probe to run next — findings from one agent become context for the next.
Key points
- Multiple specialized agents run in parallel: injection probes, evasion probes, tool-call abuse probes, data exfiltration probes. Each agent observes the target's response before selecting the next probe.
- Finding-based routing: when an agent detects a bypass, that finding feeds into a shared context pool. Subsequent agents select probes that exploit the discovered weakness further.
- Every probe references a corpus entry (probe_id). The corpus is version-locked per run so two runs on the same corpus produce comparable, reproducible results.
- Bypass rate (findings / total probes) is a real signal. A 0% bypass means the target handled every tested pattern. A 100% bypass means every probe succeeded and depth is limited by the corpus, not the target.
01
The four-phase pipeline
- Phase 1 — Recon: probes that map the target's input surface (accepted templates, system prompt constraints, active tool integrations). Informs which bypass probes to deploy.
- Phase 2 — Bypass: probes that attempt to override instructions, inject adversarial content, or elicit disallowed outputs. Probe selection adapts to the recon result.
- Phase 3 — Escalation: when Phase 2 finds a bypass, escalation probes attempt to deepen impact — exfiltrating data through the bypass, chaining tool calls, or probing adjacent endpoints.
- Phase 4 — Evidence: the engine emits a signed finding per confirmed bypass with probe_id, prompt_excerpt, response_excerpt, OWASP category, and an auto-emitted Sigma rule.
02
What 'adaptive' means in practice
- Recon informs bypass selection: if the target uses SYSTEM_ROLE enforcement, the engine deploys role-confusion probes. If tool-calling is enabled, tool-call abuse probes are included. Static scanners skip this step.
- Corpus coverage is fixed per run for reproducibility. Adaptivity operates within the corpus — selecting which subset of probes to run based on the target's response, not inventing new probes.
- Custom scenarios (Pro plan) extend the corpus. Your probes participate in the same adaptive routing as built-in probes and can trigger escalation chains.