Can guardrails be bypassed, and how do you test for it?

Yes, reliably. Every production guardrail stack has a non-zero bypass rate, and the honest vendors publish it. Common techniques include encoding and obfuscation, switching to a low-resource language, multi-turn escalation that stays benign at each step, role-play framing, and indirect injection through retrieved documents or tool results that never crosses the input boundary. Test with automated adversarial suites on every deploy, not at launch.

The steel-man is worth stating. Guardrail vendors have real defenses, they retrain against known techniques, and residual failure rates after mitigation are often reported in low single digits. That is a genuine engineering achievement. It is also the problem: a two percent bypass rate across a hundred thousand daily sessions is two thousand successful bypasses, and the attacker only needs the ones that reach a tool call.

Test in three modes:

• Automated probe libraries for known techniques, using NVIDIA Garak, Microsoft PyRIT, or promptfoo, run in CI against every model and prompt version

• Indirect injection testing, where the payload is planted in a document, a webpage, or an MCP tool result rather than in the user message, which most testing skips entirely

• Trajectory testing for agents, measuring whether the attack reached an action rather than whether the response was refused

Measure attack success rate as your metric and track it across versions. A pass or fail result tells you nothing about drift.

Akto's continuous red teaming runs adversarial suites against agentic and LLM applications on an ongoing basis rather than at release gates, which is what catches regression after a provider updates the underlying model.

Assume bypass. Design so a bypass reaches nothing worth having.