On 27 July 2026, Microsoft announced the External Red Team Alliance (EXTRA), a global expansion of its internal AI Red Team. In the blog post Enhancing AI security through global AI red teaming, the company explicitly positions red teaming of AI systems as a structural part of AI security, and no longer as an occasional testing activity. This is more than a programmatic change: it marks a turning point in how organisations view the security of generative AI and autonomous agents.
The message behind EXTRA aligns with a broader development that has taken shape in recent months. Where red teaming was long a one-off, human exercise, a continuous system is now emerging with three recognisable layers: provider programmes, independent frameworks and taxonomies, and autonomous red-team agents that carry out attacks themselves. For professionals who deploy AI near confidential information, this is relevant, because it shows which control layer may still be needed here.
From pentest to ecosystem
The security ecosystem is now delivering concrete frameworks. In its research note CAISI's AI Agent Security Agenda, the Cloud Security Alliance describes how NIST's taxonomy for adversarial machine learning (NIST AI 100-2 E2025) should be integrated into red-team planning for AI agents. The note links this to empirical findings from large-scale agent-hijacking tests, in which each of the thirteen frontier models tested exhibited at least one successful agent compromise. Agent-specific threat models such as MAESTRO are also covered, which explicitly map the layers of an agent workflow — from orchestration to memory.
The OWASP GenAI community outlines in its AI Security Solutions Landscape For AI and Agentic Red Teaming (Q2 2026) how the associated tooling is developing. The overview describes solutions for agentic red teaming, automated prompt-injection attacks and exploit frameworks that test agent behaviour and tool chains. Together, CSA and OWASP show that serious red teaming of AI agents requires its own methodology, taxonomy and scope — including indirect prompt injection via documents, memory and orchestration layers.
Autonomous red-team agents in practice
That autonomous red-team agents exist not only conceptually is shown by two recent academic works. The paper AgentXploit: End-to-End Red-Teaming for AI Agents introduces a fully automatic, multi-agent framework with a two-phase architecture: an Analyzer agent and an Exploiter agent. On the AgentDojo benchmark it achieves an attack success rate of 79 per cent, and it also carries out successful attacks on real agents such as OpenHands.
The publication RedAgent: An Autonomous Agent for Context-Aware Red Teaming of LLM Jailbreaks describes an agent that generates context-specific attacks against custom LLM applications. According to the authors, RedAgent can jailbreak most black-box models within five queries and identified six hundred vulnerabilities in sixty OpenAI applications. Both works substantiate that automated, context-aware red teaming exposes substantial vulnerabilities in agentic systems — vulnerabilities that classic pentests and model validation usually do not touch.
What this means for working with confidential information
The common thread running through these sources is that AI agents have their own attack surface. Not only the model, but also the configuration, the tool permissions, the memory and the external content channels can be misused. For lawyers, civil-law notaries, occupational physicians, journalists and compliance teams who work with sensitive data, that is a reason to look not only at the output, but also at the way in which AI produces that output.
I am Vera is a privacy-focused verification console and not a chatbot or a proprietary language model; it is a control layer around the use of AI. That role aligns with the picture that emerges from this research. The Semantic Privacy Shield is designed to anonymise documents on EU infrastructure before content is offered to AI models, with the workflow set up so that only anonymised content goes to the selected models; if a privacy check fails, nothing is forwarded. That limits what can leak through prompts or context channels.
In addition, the multi-model verification makes visible how different models respond to the same question. Vera thereby guarantees no correctness and eliminates no hallucinations, but it makes the verification steps transparent, so that a professional can better assess whether an answer holds up. Viewing and editing documents takes place in Vera Office within the same secure environment, which helps to keep the context in which AI is used under control.
The developments around EXTRA, the CSA agenda, the OWASP landscape and frameworks such as AgentXploit and RedAgent all point in the same direction: red teaming of generative AI and AI agents is becoming a continuous process. For organisations that work with confidential information, this above all means that access rights, logging and human oversight must be taken just as seriously as the model itself. The professional final judgement always remains with the user; tooling can support that assessment, but not replace it.