RED//QUEEN

• 

  contact_sheet

• 

  system_architecture

• 

  hardening_state_machine

• 

  verifier_trust_boundary

• 

  full_cycle_sequence

• 

  heterogeneous_fleet

• 

  durable_data_model

• 

  memory_hierarchy

• 

  gap_deployment_topology

The problem

In August 2026, researchers hid a message inside Google's own agent tools and got one AI agent to hijack another. Real code execution, real stolen credentials. Companies are shipping whole fleets of AI agents with real powers and real tools, but almost nobody is testing those agents the way an attacker actually would. If you ran ten agents today, you would have no way to know which ones are unsafe.

What it does and who it's for:

RED//QUEEN is a training range that attacks your AI agents so a real hacker doesn't get to first. It's built for the teams shipping these agents, security and platform engineers who need to know, at a glance, which agents in their fleet can be trusted. You point it at your agents and walk away. It finds the weak ones, fixes them automatically, and proves the fix actually worked.

How it works:

RED//QUEEN is built with Google's Agent Development Kit and GenAI SDK on Vertex AI, using Gemini 3.5 as the core and Gemma as the attack generator. Three agents run the loop. A red team invents attacks and keeps mutating them until one slips past Model Armor, across three fronts: hidden text, poisoned tools, and instructions hidden inside images. The moment an attack lands, a blue team writes and applies a fix. Then a completely separate, walled-off verifier re-attacks the patched agent to confirm the fix is real, and refuses to give a fake green light if it isn't. The whole thing runs in the background on Cloud Run, survives its own crashes without ever applying a fix twice, and stores everything in Cloud SQL with a full audit trail in Cloud Trace.

The honest twist:

Newer models like Gemini 3.5 are genuinely hard to fool, so a well-built agent holds up while a carelessly built one gets through.... but a fleet of ai agents is generally a heterogenous fleet caring all types of agents. That is the whole point of RED//QUEEN, telling you which is which. Every attack, fix, and verdict shown here is real and runs live on Google Cloud.

Built With

• docker
• fastapi
• google-cloud
• python
• svelte
• typescript