Gauntlet: Mocking agent fuzz-tests tool calls to expose prompt injections and other failures

Kavish Sathia unveiled Gauntlet at the Elasticsearch Agent Builder Hackathon, where the project — built in the final 48 hours — finished among the event’s top three (blog post dated May 13, 2026). Gauntlet matters because it replaces brittle rehearsal — style checks with continuous adversarial fuzz-testing that directly challenges an agent’s resilience to corrupted tool outputs.

Gauntlet places a mocking agent between a primary agent and its tools so every tool call can be intercepted and modified. In examples shown by the author, reads occur through @gauntlet.query and writes through @gauntlet.mutation (presented alongside @function_tool). The mocking agent mutates responses in subtle ways-injecting prompt — injection payloads, returning slightly incorrect data, or otherwise altering outputs — to test whether the primary agent detects or tolerates the corruption. A final evaluate() pass reviews outcomes and stores confirmed failures for later analysis.

The project grew out of an earlier attempt called Rehearse, which relied on sandboxed rehearsals but suffered when simulated environments diverged from reality. Rather than trying to replicate whole environments, Gauntlet focuses on adversarial perturbations that are likely to persist outside a simulation: classes of failure that remain invariant despite stochastic environment drift.

Two core technical challenges shape Gauntlet’s design. First, mutations must remain plausible and maintain a coherent world model across an interaction; obviously fake responses teach little about real vulnerabilities. Second, the system must hunt for genuinely novel bugs instead of repeatedly surfacing the same exploit patterns — rediscovering a single prompt injection dozens of times has limited value. Both problems are framed as search — and-memory tasks.

To solve those tasks, Gauntlet implements two memory circuits and uses Elasticsearch as the search backbone to remember past tests and guide exploration. The blog describes a deliberately small integration surface: the mocking agent tracks what it has already tried, uses search to prioritize new perturbations grounded in real tool behavior, and records confirmed regressions. Even with minimal plumbing, orchestrating plausible mutations and avoiding redundant exploits presents a nontrivial search problem.

For agent builders and security — minded teams, Gauntlet demonstrates a practical route to continuous, automated adversarial testing that goes beyond hand-crafted attack vectors and happy — path checks. By intercepting real tool calls, mutating plausible outputs and logging verified failures, the approach can surface prompt injections and other hidden failure modes that manual sandboxes often miss. Kavish Sathia documents the approach and implementation details in a May 13, 2026 blog post.