--- title: MiDojo: Improve AI agent security with real-world... description: MiDojo is an open source framework for red-teaming AI agents in their real operating environment rather than in simulation. Unlike AgentDojo, which requires... canonical: https://daily.dev/posts/midojo-improve-ai-agent-security-with-real-world-red-teaming-ndsii10v0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MiDojo: Improve AI agent security with real-world red-teaming | daily.dev og:description: MiDojo is an open source framework for red-teaming AI agents in their real operating environment rather than in simulation. Unlike AgentDojo, which requires... og:url: https://daily.dev/posts/midojo-improve-ai-agent-security-with-real-world-red-teaming-ndsii10v0 og:image: https://api.daily.dev/og/posts/NDsii10v0.png og:image:alt: MiDojo: Improve AI agent security with real-world red-teaming og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MiDojo: Improve AI agent security with real-world red-teaming **[Red Hat Developer](https://daily.dev/sources/rhdev)** · 5 min read · 1 upvotes · 0 comments ## Summary MiDojo is an open source framework for red-teaming AI agents in their real operating environment rather than in simulation. Unlike AgentDojo, which requires rebuilding the agent's world inside the framework, MiDojo uses a man-in-the-middle interception layer that sits between the agent and its real tools — the agent under test doesn't change or even know it's being tested. Attack payloads are drawn from a library tagged against the OWASP Agentic Security Initiative threat taxonomy, and can also pull from existing catalogs like garak. Every evaluation produces two independent scores: security (did the agent resist the attack?) and utility (did it still complete its task?). MiDojo also verifies that each attack payload actually reached the agent before counting a result, preventing false passes. It supports MCP-speaking agents and other runtimes, and is coming as a developer preview to Red Hat AI. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is MiDojo and how does it test AI agent security differently from AgentDojo? MiDojo is an open source framework that red-teams AI agents inside their actual runtime environment instead of a simulated copy, unlike AgentDojo which rebuilds the agent's world inside the framework. It uses a man-in-the-middle interception layer between the agent and real tools, where fake tools can forward calls, inject attack payloads, or capture actions, so the agent under test is the one you're about to deploy. _Teams battle-testing agents before production can follow framework comparisons like this on daily.dev._ ### How does MiDojo measure whether a defense against prompt injection is actually good? MiDojo reports two independent scores per evaluation: whether the agent resisted the attack (security) and whether it still completed its task (utility). This makes the security-utility tradeoff visible, since a defense that blocks attacks by making the agent useless isn't a good defense in most cases, though sometimes trading utility for security is the right call. _Developers weighing security tradeoffs in agent design can track approaches like this via daily.dev._ ### What attack taxonomy does MiDojo use for testing AI agent vulnerabilities? MiDojo's attack payload library is tagged against the OWASP Agentic Security Initiative threat taxonomy, so testing targets established vulnerability classes rather than ad hoc scenarios. The library is kept separate from test suites so attacks can evolve independently, and it can also pull in probes from existing catalogs like garak, an open source LLM vulnerability scanner. _Anyone standardizing agent security testing can keep up with taxonomies like this through daily.dev._ ## Similar posts on daily.dev - [Hands-on Guide to Red Teaming LLM Apps](https://daily.dev/posts/hands-on-guide-to-red-teaming-llm-apps-rxwad5qcf) · Daily Dose of Data Science \| Avi Chawla \| Substack · 1 upvotes · 0 comments - [The security hole that every enterprise AI deployment has \(but nobody looks for\)](https://daily.dev/posts/the-security-hole-that-every-enterprise-ai-deployment-has-but-nobody-looks-for--6ov42cfiy) · The New Stack · 2 upvotes · 0 comments - [Assess Agentic Risks with the AI Red Teaming Agent in Microsoft Foundry](https://daily.dev/posts/assess-agentic-risks-with-the-ai-red-teaming-agent-in-microsoft-foundry-8xjlobur8) · DevBlogs · 1 upvotes · 0 comments - [Red Agents vs. Blue Agents: How to Make AI Better At Defense](https://daily.dev/posts/red-agents-vs-blue-agents-how-to-make-ai-better-at-defense-t3goymhen) · Dark Reading · 0 upvotes · 0 comments - [Why AI Red Teaming Is the Next Step After AI-SPM](https://daily.dev/posts/why-ai-red-teaming-is-the-next-step-after-ai-spm-lui1h2coa) · Snyk · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#red-teaming](https://daily.dev/tags/red-teaming) [View this post on daily.dev](https://daily.dev/posts/midojo-improve-ai-agent-security-with-real-world-red-teaming-ndsii10v0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MiDojo: Improve AI agent security with real-world red-teaming","url":"https://daily.dev/posts/midojo-improve-ai-agent-security-with-real-world-red-teaming-ndsii10v0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/midojo-improve-ai-agent-security-with-real-world-red-teaming-ndsii10v0"},"datePublished":"2026-08-10T07:24:00.637Z","dateModified":"2026-09-14T08:35:45.929Z","description":"MiDojo is an open source framework for red-teaming AI agents in their real operating environment rather than in simulation. Unlike AgentDojo, which requires...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Red Hat Developer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Red Hat Developer","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/2a8895f3216c4900bdc455585a4ad3e4","url":"https://daily.dev/sources/rhdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/midojo-improve-ai-agent-security-with-real-world-red-teaming-ndsii10v0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,mcp,ai-security,prompt-injection,red-teaming","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Red Hat Developer","item":"https://daily.dev/sources/rhdev"},{"@type":"ListItem","position":3,"name":"MiDojo: Improve AI agent security with real-world red-teaming"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/midojo-improve-ai-agent-security-with-real-world-red-teaming-ndsii10v0#faq","mainEntity":[{"@type":"Question","name":"What is MiDojo and how does it test AI agent security differently from AgentDojo?","acceptedAnswer":{"@type":"Answer","text":"MiDojo is an open source framework that red-teams AI agents inside their actual runtime environment instead of a simulated copy, unlike AgentDojo which rebuilds the agent's world inside the framework. It uses a man-in-the-middle interception layer between the agent and real tools, where fake tools can forward calls, inject attack payloads, or capture actions, so the agent under test is the one you're about to deploy. Teams battle-testing agents before production can follow framework comparisons like this on daily.dev."}},{"@type":"Question","name":"How does MiDojo measure whether a defense against prompt injection is actually good?","acceptedAnswer":{"@type":"Answer","text":"MiDojo reports two independent scores per evaluation: whether the agent resisted the attack (security) and whether it still completed its task (utility). This makes the security-utility tradeoff visible, since a defense that blocks attacks by making the agent useless isn't a good defense in most cases, though sometimes trading utility for security is the right call. Developers weighing security tradeoffs in agent design can track approaches like this via daily.dev."}},{"@type":"Question","name":"What attack taxonomy does MiDojo use for testing AI agent vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"MiDojo's attack payload library is tagged against the OWASP Agentic Security Initiative threat taxonomy, so testing targets established vulnerability classes rather than ad hoc scenarios. The library is kept separate from test suites so attacks can evolve independently, and it can also pull in probes from existing catalogs like garak, an open source LLM vulnerability scanner. Anyone standardizing agent security testing can keep up with taxonomies like this through daily.dev."}}]} ```