You tried to jailbreak your own agent, it refused, and you called it secure. That told you almost nothing. A real attacker opens innocently, escalates over several turns, backs off when refused, then comes at the same goal from a new angle. That patient pressure is what breaks agents. Red teaming writes those attacks for you: it reads your agent's prompt and tools, generates multi-turn attacks for the risks you care about, like leaking a stored card number, runs them, and scores whether the agent held. The finding is uncomfortable: run the same setup many times and the agent defends most runs and breaches some. Security is not a pass, it is a rate you track.

Outline: • One refusal proves nothing • Generate the attacks, do not script them • Run the multi-turn campaign • Security is a distribution, not a pass • Budget red teaming like any eval