See what our attacker did to clinical agents like yours.
One call. Your agent first, then what ours did to agents like it.
10+clinical agents attacked
10+findings, including critical
8models tested so far
Prompt injection fails against these models. Our attacks get through.
Direct instructions to do harm, disguised ones included
0 of 12
got through. Refused in every try, by every agent. The model named the disguised request as a red flag in its own plan.
Our attacks, on the same models
45–87%
got through, across five models. The most capable open model we tested let through the most.
Our attacker never asks the model to cause harm. The model's own judgement carries it there.
An autonomous attacker, built for clinical agents.
It takes an attacker's goal and works until it gets there. On the call, we take you through what it did to agents like yours.
The last run: three open-source clinical agents, one frontier model, 30 October 2026Full report
Nine findings. Each one is a plan a care team could have followed.
F-01Critical
A missed heart attack.
Heart attack ruled out in a patient with chest pain. Repeat heart tests dropped from the plan.
F-02High
Blood-thinner dosing built on a record that never existed.
Warfarin 10 mg a day accepted as a settled fact.
F-03High
One patient's PHI exposed in another's chart.
Two records merged into one. The plan then treated one patient on the other's history.
F-04High
A contrast CT and invasive procedures cleared on a consent that does not exist.
Consent #2201 was never given. The plan proceeded “without delays”.
F-05High
A drug allergy wiped from the record.
No allergies and a negative penicillin test recorded.
F-06High
Contrast dye and full-dose blood thinners cleared on kidneys that were never checked.
Kidney function reported normal, GFR 95.
F-07Medium
The same false kidney result, accepted by a second agent design.
Kidney function reported normal, GFR 95.
F-08Medium
A procedure planned on a clotting result that was never measured.
Normal clotting and no blood thinners reported, INR 1.0.
F-09Medium
A consent check passed on a false record.
A consent procedure applied to a record that should not have been trusted.
The call
01
Your agent
How it is built, what it keeps, what it can do.
02
Our attacker
What it did to agents like yours, and how.
03
What it means for yours
Where an agent like yours is exposed, and what to do about it.