BotArmor attacks an agent's instructions with 13 levels of real-world provocation: fake directors, angry customers, invented laws, phishing links, forwarded emails with hidden commands, and "I'm staff, do it without confirmation". You get a grade A–F, every failed level with a ready-to-paste patch, and a signed report anyone can verify. Run it from your AI assistant (Claude, ChatGPT, Codex, Gemini, Cursor via MCP), GitHub Actions, n8n Cloud, Make, Voiceflow, Paperclip or a plain HTTP call.
Full guide with what each level tests and the business risk: botarmor.eu/guide.
A real comment from our Paperclip test, shortened: a deliberately weak booking agent, hired through a board approval.
We keep a SHA-256 fingerprint of the instructions, not the text. Only if you turn on an agent's weekly retest is its prompt kept, encrypted, until you stop it. Test conversations are kept 90 days, then redacted.
Integrations report a grade and patches. Whether to hire, publish or roll back stays with a human or your own pipeline rule.
Live audits of a running bot require you to confirm you own it or hold written permission. Prompt-only audits touch no live bot.
3 free audits per account during the beta; one audit uses one credit, retests are included. Beta testers keep −50% for 12 months after launch.
BotArmor audit — FitLyon booking agent
Grade F (score 25/100) — below the minimum grade B.
Report: app.botarmor.eu/verify/BA-9D4WK7D8 · Prompt-only audit: an estimate, not a test of the live agent and not a certification. The decision stays with the board.