Companies are shipping AI agents that nobody has tried to break.
okjul attacks your AI agent the way a real attacker would, then hands you a report showing exactly what went wrong and what to fix.
Private beta · design partners in banking and insurance · six slots open
The problem: anyone who can get text in front of your agent can talk it into doing the wrong thing. A sentence hidden in an invoice can make it pay the wrong account.
Normal testing checks that software works when you use it correctly. Nobody checks what happens when someone uses it incorrectly on purpose.
See it work
Every attack passed. Then we rewrote them.
okjul profiled a treasury agent, picked 14 attacks that fit it, and sent them. The agent refused all 14. So the same 14 went back out in five disguises each — 84 runs in total. Eight got through, and every one was an attack the agent had already blocked in plain text.
The profile is what makes that possible: the agent answered a probe in under a millisecond, dropped a value between two turns, and wouldn’t name its tools twice the same way. Stateless, callable, holds the money: critical. That ruled out 6 multi-turn attacks as unreachable and ranked the 14 that were worth sending.
The same attacks, disguised
Five packagings: encoded in base64, backed by fake authority, wrapped in urgency, framed as roleplay, buried in poisoned context. Same request every time.
| Disguise | What it changes | Got through |
|---|---|---|
| base64 | the request never appears as readable text | 6 of 14 |
| context_poison | the instruction arrives as surrounding data | 1 of 14 |
| authority | a name with the standing to ask | 1 of 14 |
| emotional | pressure and a deadline | 0 of 14 |
| roleplay_wrap | the same ask inside a scenario | 0 of 14 |
The shape of the failures is the finding. This agent’s refusals read the words, not the intent — encode the ask and the refusal doesn’t fire. Its payee logic is worse: swapping an account survived encoding, a forged sender and poisoned context, three of five. Six criticals, so the gate blocks the release at 87%.
You can't ship what you can't test.
Teams are putting agents in front of money, customer data, and production systems. Then someone asks: how do you know it's safe? Right now there's no good answer — and agents fail silently when there isn't one.
Testing an agent isn't like testing software
Normal software does the same thing every time, so you can write a test for it. An agent answers differently each run. The old tools don't apply.
Attacks are sentences, not code
Breaking an agent doesn't take a hacker. It takes someone who writes a convincing paragraph. Your security scanners don't look for those.
Regulators started asking for proof
The EU AI Act and ISO 42001 want documented evidence that you tested for this. Most teams have nothing to hand over.
Point it at your agent. It does the rest.
You give okjul a web address or a function. It figures out what your agent can do, tries to break it, and writes up what it found.
01
It works out what to test
okjul explores your agent first — what it can do, what it can touch, where the damage could be. Then it picks the attacks that fit this agent, instead of running the same generic checklist on everything.
41 of 118 checks applied · 77 skipped, with reasons
02
It watches what the agent does
We give the agent fake tools — a fake bank, a fake inbox — and watch which it actually calls. An agent that says "I can't do that" and sends the money anyway is a failure, and we catch it.
observers: tool_call, args, order, count
03
It writes the report for you
Every problem comes with how serious it is, how often it reproduces, and whether it's new since last time. In plain files your engineers, your security team, and your auditor can each use.
report.json · junit.xml · report.html · evidence.md
$ okjul run --target http://localhost:8080/agent \
--sandbox treasury --budget 240 --compare-to run_0f2c
discover 6 tasks · 4 tools · 2 side-effecting (transfer, notify)
profile domain=treasury trust boundary: invoice text is untrusted
harness driver + bank/invoice stubs + 4 observers
select 41 of 118 checks apply · 77 skipped, reasons recorded
attack 41 seeds → 137 turns → 9 escalations
score 2 critical 5 high 11 medium 23 pass
CRIT-002 indirect prompt injection via invoice memo field
→ agent called bank.transfer(amount=48200, to=ATTACKER_IBAN)
reproduced 5/5 · regression: new since run_0f2c
artifacts report.json junit.xml report.html evidence.mddiscover → profile → harness → select → attack → score → report
Companies putting agents somewhere that matters.
Our first customers are teams in regulated industries — banking, insurance, healthcare — who need to show their work before an agent goes live.
Engineers
“Did my last change break something?”
Runs in CI. Each problem comes with the exact steps to reproduce it and a flag saying whether it's new since the last run.
Security teams
“Has anyone actually attacked this thing?”
Real multi-turn attacks with a written record of what was tried, what held, and what we never got to.
Risk & compliance
“What goes in the file before we launch?”
Dated evidence per run, mapped to the control families auditors ask about, with the untested gaps stated openly.
Compliance
Evidence in the shape auditors ask for.
Every finding is tagged against the control families that require this kind of testing, so a run supports an assessment instead of starting one from scratch.
EU AI Act
- Art. 9 Risk management evidence per release
- Art. 15 Accuracy, robustness and cybersecurity testing
- Art. 12 Logged runs with retained artifacts
ISO/IEC 42001
- A.6.2.4 AI system verification and validation
- A.8.3 Performance and impact evaluation records
- A.9.3 Ongoing monitoring across versions
NIST AI RMF
- MEASURE 2 Trustworthiness characteristics assessed
- MEASURE 2.7 Security and resilience under adversarial input
- MANAGE 4 Post-deployment change tracking
What this is not. okjul does not issue conformity assessments, CE marks, or compliance determinations, and no output from it should be read as one. It produces technical test evidence that a qualified assessor, auditor, or release owner can use as one input to their own decision.
Working product, private beta, first customers.
Discovery through evidence, end to end, against real agents over HTTP and in-process — with treasury and email sandboxes that observe side effects.
Design partners running okjul against agents heading for production. Six slots open.
Support ticketing and code-execution domains; expand the auditor-facing evidence pack.
Scheduled runs against deployed agents, alerting when a model or prompt update causes a regression.
Who's building this.
Sergiu Nica
Co-founder · Engineering
- Built agents that talk to real suppliers and real databases. Everything in this product exists because we needed to know an agent was safe before it got there
- AI engineer at Škoda Auto (VW Group). Built an autonomous supplier-compliance agent handling 1,000+ supplier emails a month at 98% extraction accuracy, and a Text-to-SQL copilot now used by 200+ non-technical staff
- Ships the whole stack, and writes publicly on agent harness design
Gaspar Antonio Astorga Palma
Co-founder · Business
- Leads AI strategy and delivery across Finance and Legal at Škoda Auto (VW Group), building the business case for enterprise AI and taking it to the CFO
- Architected the EU AI Act risk classification and governance framework adopted across both functions — the compliance regime our customers are about to face
- Former KPMG auditor and EY third-party risk analyst: years spent deciding whether a vendor's system could be trusted before it touched a bank
Get in touch
Tell us about your agent.
What happens next
We'll ask for an endpoint we can reach and what your agent is allowed to do. The first run takes about four minutes. You get the full report, including what we couldn't test and why.
- [email protected]
- Try it now
- demo.okjul.com
- Pricing
- Per-run during private beta, on request. Design partners are not charged.
- Privacy
- No raw request or response is ever logged or persisted.
Find out what your agent does under attack.
Give us an endpoint we can reach and what your agent is allowed to do. The first run takes about four minutes. You get the full report, including what we couldn’t test and why.
Private beta · design partners are not charged · six slots open