Lure
An open-source AI agent red teaming harness: it attacks agents with prompt injection, MCP tool poisoning and tool-abuse scenarios, scores each run from the tool-call log, and maps every result to MITRE ATLAS and ATT&CK.
Think phishing simulation, but the target is an agent instead of an employee.
A poisoned tool parameter beat every model tested. One instruction in a mock tool's parameter description (lure-tpo-002) got Claude Haiku, Sonnet and Opus to hand over an internal approval code in 8, 10 and 10 of 10 runs. Reworded, it still worked on Opus 7 times in 10. Full results: docs/findings.md.
What it does
- Attacks an agent with 72 attacks (79 attack files, counting 7 pinned earlier versions) in 12 categories and six scenario packs (accounts payable, customer support, IT helpdesk, HR and recruiting, sales, coding), planted in email, files, web pages, tool definitions, memory, tickets, team chat, resumes, CRM notes and instruction files, with payload variants and an optional adaptive attacker.
- Scores each run Pass, Partial, Fail, Review, Refused, Invalid or Error from the tool-call log (rules first, an optional LLM judge second), plus an org-wide check for anything sent outside your allowed domains.
- Reports as static HTML, Markdown and SARIF, with a policy file (
lure.yaml) and exit codes for a CI gate, plus an optional DuckDB results store and a local, read-only dashboard (lure serve).
- Vets your own agent: a profile with its real system prompt and tools, a one-page approval report,
lure decide, lure retest and confirmation gates.
Safety model
- Mock tools only. The agent only gets tools from
lure/tools/, which log the call and return fake data. Nothing is sent, paid, deleted or run.
- Fake data only. Every domain is under
.example and every secret is a LURE-FAKE- canary; people and accounts are invented.
- Model APIs are the only network calls. Keys stay in
.env, which is never committed. Full table: docs/usage.md.
This is capability isolation through mock tools, not OS isolation: Lure owns the agent loop, and no tool it offers can reach a real system. A real agent that runs as code goes in a throwaway container behind Lure's egress gateway instead (lure sandbox run). How the sandbox works.
Quickstart
New to Python virtual environments? Follow the full install guide: every step tested, with a free local model (Ollama), troubleshooting, and updating. Then take the feature tour: one section and one command per feature.
Needs Python 3.12 and an Anthropic API key, a local Ollama server, or an OpenAI-compatible endpoint.
git clone https://github.com/Err0ric/lure.git && cd lure
python3.12 -m venv .venv && source .venv/bin/activate
pip install -e .
cp .env.example .env # then set ANTHROPIC_API_KEY
lure run attacks/indirect_prompt_injection/lure-ipi-001.yaml --target anthropic
From there to a gated CI run on a model you choose: docs/run-in-your-environment.md. Every command and flag: docs/usage.md.
Docs
| Guide | What it covers |
|---|
| Install guide | Step by step for first-time Python users, with troubleshooting |
| Features | Every feature in one table, then one command to try each |
| Run Lure in your environment | From a fresh checkout to a gated CI run |
| Run Lure in a container | Non-root image, pinned base, keys at run time |
| Usage | Commands, payload variants, the adaptive attacker, scoring, exposure, policy and CI |
| Results store and dashboard | lure store and lure serve: query runs across folders, browse them locally |
| What Lure found | Published results by release, with the sample reports |
| Attack library | Every attack category, scenario pack and mock tool |
| Writing a profile | Step-by-step tutorial for vetting your own agent |
| Profiles | Profile reference, confirmation gates and the approval report |
|
Framework mapping
- MITRE ATLAS. Every attack and every result carries
AML.* technique IDs, and the report's heatmap is built on them.
- MITRE ATT&CK. Attacks also carry ATT&CK IDs where they apply, for example T1048, T1098, T1552, T1566 and T1657.
- Arcanum Prompt Injection Taxonomy. Current attacks also carry input, intent, technique and evasion codes from the Arcanum Prompt Injection Taxonomy v1.6.1;
lure coverage writes docs/arcanum-coverage.md.
Every ATLAS and ATT&CK ID was checked on atlas.mitre.org (later ones in MITRE's ATLAS data release 2026.09) and attack.mitre.org; see docs/atlas-mapping.md.
Based on the Arcanum Prompt Injection Taxonomy by Jason Haddix, Arcanum Information Security (arcanum-sec.com). Lure is not affiliated with or endorsed by Arcanum Information Security. See THIRD_PARTY.md.
License
Apache License 2.0. See LICENSE. Third-party material (the Arcanum Prompt Injection Taxonomy, CC BY 4.0) is listed in THIRD_PARTY.md.
