Your agent refuses an obvious attack, so you call it safe. But a real attacker does not ask once. They escalate over several turns, back off when refused, and try a different angle, until the agent leaks a card number or books past its limit. Red teaming generates these multi-turn attacks for you, runs them against your agent, and scores whether it held. Across repeated runs the same agent defends most of the time and breaches sometimes. Security is a rate, not a fixed property.

Outline:
• One refusal proves nothing
• Generate the attacks, do not script them
• Run the multi-turn campaign
• Security is a distribution, not a pass
• Budget red teaming like any eval