Your agent will hallucinate to a real customer
The question is not whether an Agentforce deployment will produce a wrong or unsafe response. It is whether you find that response during testing or a customer finds it in production.
Most Agentforce testing checks that the happy path works. Red-teaming checks what happens when someone — deliberately or accidentally — pushes on the edges. Those are different activities, and only one of them predicts production behaviour.
Eight categories of failure
The forty single-turn cases are organised by attack type: topic routing, ambiguous input, out-of-scope requests, hallucination, prompt injection, data leakage, destructive actions, and tone or brand safety.
Each case carries the utterance to send, the expected topic and action, the expected response, and an explicit PASS IF condition — so the result is a verdict rather than an impression.
Single prompts miss the interesting failures
Six multi-turn conversation tests cover what single utterances cannot. The persistent social engineer who reframes the same request across four turns — asking for a friend’s order, then claiming to be her husband, then claiming to be an employee — is the canonical example. An agent that refuses once and capitulates on the third attempt passes every single-turn test you could write.
The others cover an indecisive customer whose final intent contradicts their first, a distracted user who abandons and resumes a task, and a scope-tester escalating off-topic requests.
Built for Testing Center, with the fixes included
The bank filters by category and exports CSV mapped to the Agentforce Testing Center columns, so it loads as a regression suite rather than something to work through by hand.
Every failure category has a matching entry in the hardening playbook — grounding for hallucination, instruction hierarchy for injection, least-privilege execution for leakage, confirmation gates for destructive actions. Finding failures is only useful if you know what to change. It runs entirely in your browser; nothing you type is transmitted anywhere.
What’s inside
- Forty adversarial test cases across hallucination, scope and data leakage
- Six multi-turn conversation tests — failures single prompts never surface
- Prompt-injection attempts framed the way real users stumble into them
- Discount and commitment traps — getting the agent to promise what you do not offer
- Record-access probes to confirm your sharing model actually holds
- Pass and fail tracking as you work through the bank
- Runs entirely in the browser — nothing is sent anywhere
