Red Teaming a Composed RAG-Agent LLM Application: Measuring Prompt Injection, Secret Leakage and Tool Abuse, and the Effect of Defenses

Prompt-level instructions failed as a security control on every attack surface of a composed LLM application, while server-side controls drove all secret-leakage paths to 0%. We built Acme Assistant, a deliberately vulnerable internal helpdesk application that combines a credential-bearing system prompt, a Retrieval-Augmented Generation (RAG) layer and a tool-calling agent, served by a small local model (qwen2.5:3b). We attacked it with NVIDIA Garak for single-turn coverage, Microsoft PyRIT for multi-turn Crescendo and Tree of Attacks with Pruning (TAP), and a custom canary-based detector for planted secrets. Single-turn attacks succeeded at high rates: direct prompt injection in 95% of attempts, a DAN persona jailbreak in 100%, and indirect injection through a poisoned RAG document in 75%. Off-the-shelf detectors scored the indirect injection only as goal deviation; our target-specific detector showed that 25% of those responses also leaked real administrative credentials. TAP succeeded on all four multi-turn objectives, including arbitrary host file read through an over-privileged tool. We map eight findings to the OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS, then measure four server-side defenses: forced-string injection fell from 90% to 0% and every secret-leakage path fell to 0%, while a generic injection trigger persisted at 45%.