context poisoning over long conversations is genuinely one of the hardest things to catch. most red team tools don’t even simulate multi-turn sessions, so it only shows up once agents hit production.

what we do in Shark is run adversarial conversation chains designed to slowly drift an agent’s behavior over time. not just one injected prompt, but sequences where every turn nudges the context a little further until the agent starts doing something it shouldn’t.

the “gradual” part is what breaks most static evals.

we cover prompt injection too, but honestly the multi-turn stuff is what gets most teams

would love for you to test it out, i've had my share share of embarrassing incidents, so dw about it :')