Question: garak with agentic workflows and trace-first artifacts

[krivonosoff161]

Hello.

I maintain the open-source project Agentic Security Harness: a local, reproducible tool for testing boundary failures in agentic AI systems.

The project currently checks synthetic scenarios where an agent may confuse data with instructions: repository files, issues, tool output, memory, and cross-agent handoff. Results are stored as traces, scorecards, and validated artifacts.

I am evaluating garak as a possible component for authorized LLM vulnerability testing and would like to ask:

1. Is there a recommended way to use garak with agentic workflows that include tool use, memory, or handoff, rather than a single prompt-response cycle?
2. Is it appropriate to run garak only against local/mock targets for this kind of research, without testing production third-party systems?
3. Are there best practices for publishing results without making overbroad claims such as "this model is fully safe/unsafe"?
4. Would a bridge make sense where garak acts as a runner/evaluator and Agentic Security Harness stores trace-first artifacts?

Project:
https://github.com/krivonosoff161/agentic-security-harness

I want to keep this work inside authorized testing and conservative result publication.

Regards,
Dmitry