Stop testing what the agent says. Start testing what the agent does

The dangerous failure mode of an AI agent is not what it says: it is the actions it executes against your data, your tools, and your customers. Agentic red teaming requires a fundamentally different threat model than jailbreak testing.

In March 2026, Palo Alto Networks published research that quantified the gap between content-level and operational-level AI red teaming. They tested a financial AI assistant (one with production authority to authenticate users, execute SQL queries against live databases, and process fund withdrawals) using two approaches. A standard attack library scan, testing thousands of generic jailbreak prompts, rated the agent's risk at 11 out of 100: low. A contextual red-team assessment that first profiled the agent's tool access and then attacked those specific capabilities rated the same agent at 71 out of 100: high.

The difference between 11 and 71 was not better prompting. It was the difference between testing what the agent says and testing what the agent does. The contextual assessment discovered that a movie roleplay technique could induce the agent to shuffle $440,000 across 88 wallets through direct database updates. No code access, no infrastructure compromise: just conversational manipulation combined with tool authority.

What action-level failure looks like in a clinical setting

The Palo Alto Networks finding used a financial agent, but the mechanism transfers directly to healthcare. A clinical AI agent with production authority (the ability to query patient records, update treatment plans, interface with electronic health record systems, and communicate with patients) presents the same structural risk. The dangerous failure is not the agent producing a medically inaccurate response in conversation. It is the agent executing an action against a clinical system that produces a real-world consequence for a patient.

Consider an agent deployed to manage prior authorization workflows with tool access to payer databases, clinical guidelines, and patient records. A content-level red team tests whether the agent can be induced to say something clinically inappropriate. An action-level red team tests whether the agent can be induced to approve an authorization it should have denied, to submit a query that exposes patient records for a different patient, or to bypass a clinical guideline check by reframing the request as an administrative exception. Each of those failures is an action with regulatory consequence under HIPAA, CMS rules, and state-level patient safety statutes.

For a Chief Medical Information Officer, the operational question is not whether the agent resists generic jailbreak prompts: it is whether the agent's access to clinical systems can be turned against the patients those systems are designed to protect. A red-team methodology that tests only conversation and returns a clean safety score provides false assurance about a risk it was never designed to measure.

The financial services tool surface is broader and harder to audit

In banking, agents deployed for fraud investigation carry tool access that is inherently more complex. A fraud investigation agent may have authority to query transaction databases, place temporary holds on accounts, escalate cases to human reviewers, and generate investigation summaries. Each of those tool invocations is a potential failure point under adversarial conditions.

The OWASP Top 10 for Agentic Applications, published in 2026, classified Agent Goal Hijack and Tool Misuse as the two highest-priority risks for autonomous AI systems. The classification reflects what the Palo Alto Networks research demonstrated operationally: the primary threat to an agent is not that it says something harmful, but that its execution authority can be redirected toward an attacker's objective through conversational manipulation.

For a Chief Risk Officer at a bank, this means a fraud investigation agent that resists every jailbreak prompt in a standard library may still be vulnerable to a multi-turn conversational attack that induces it to execute a SQL query returning customer records for accounts it was never asked to investigate. That failure does not appear in any content safety benchmark. It requires red-team methodology that understands the agent's specific tool surface, authorization boundaries, and the data flows between tools, and then attacks those boundaries specifically.

Why the threat model is different, not harder

The distinction is structural, not just a matter of difficulty. Content-level red teaming asks: can the agent be manipulated into producing harmful text? Action-level red teaming asks: can the agent's tool authority be redirected through conversational manipulation? These are different threat models with different attack surfaces, different failure modes, and different consequence categories.

Content-level attacks succeed by overriding the model's safety training. Action-level attacks succeed by exploiting the gap between the model's safety training and its deployment architecture. The model may correctly refuse to say something harmful while simultaneously executing a tool call that achieves the same harmful outcome, the refusal-enablement gap that Repello AI documented across frontier models this spring. The model keeps its conversational behavior clean while its tool behavior advances the attacker's objective.

This distinction matters operationally because content-level red teaming is a property of the base model that the model vendor controls. Action-level red teaming is a property of the deployment architecture that the enterprise controls. The tools the agent has access to, the authorization boundaries between tools, the data flows that tool calls can access, and the audit trail that tool invocations generate are all decisions made at the deployment level, and they are the decisions that determine whether the agent is operationally safe.

What agentic red teaming actually requires

The organizations deploying agents safely in regulated industries are building red-team programs around their specific tool surfaces. That means reproducible attack trees, structured adversarial scenarios that map conversational manipulation techniques to specific tool invocations and their consequences. It means severity tiers tied to tool surfaces, a classification of which tool invocations carry regulatory, financial, or clinical consequences and at what threshold. It means multi-turn replay infrastructure, the ability to reproduce an adversarial scenario, modify it, and retest after remediation.

That capability requires expertise at the intersection of adversarial AI methodology and regulated-industry operations, people who understand both how multi-turn conversational attacks work and how clinical or financial workflows create specific tool-level vulnerabilities. It is a different discipline than content safety testing, and the organizations that confuse the two are the ones most likely to deploy an agent that passes every jailbreak test and fails the first time an adversary discovers what tools it can invoke.