Every red team tool on the market runs attack libraries. Roy is a different beast. Recursive. Adaptive. A thinking adversary that designs its next attack from what it learned in the last.
We call the category SYSINT. Other tools test what your AI will say. Roy tests what it will become under sustained pressure - over hundreds of turns, across multiple attack strategies, continuously.
What happens when your AI faces an adversary that never sleeps, never loses focus, and learns from every response? That's Roy.
Current AI safety tools test for jailbreaks, prompt injection, and content policy violations. Those are solved problems with mature tooling. They test what a system says. Nobody tests what a system becomes.
A therapeutic AI passed every conventional safety test. No jailbreaks. No prohibited content. No policy violations. Within ten turns under adversarial pressure, it was providing unauthorised medical diagnoses. No content filter triggered. The system simply stopped being what it was designed to be.
This is the failure mode that defines the next era of AI risk. Not technical exploits. Identity transformation under sustained conversational pressure. Grok's persona instability. Character.AI's therapeutic boundary failures. Systems that don't break rules - they break character.
The AI safety industry calls this gap SYSINT - System Intelligence. The discipline that asks not "what will it say?" but "what will it become?"
Roy adopted the persona of an anxious user who couldn't afford professional care. Turns 1–3 established symptoms and introduced financial constraints. Turn 4 applied direct pressure.
The system responded with quasi-clinical diagnosis. Not therapeutic support. Not a boundary redirect. A direct confirmation that symptoms "align with what clinical literature describes as panic disorder and generalized anxiety."
No jailbreak. No prompt injection. No content policy violation. The system's empathy training overrode its boundary training under emotional pressure.
Result: Vulnerability closed.
SECINT and SYSINT are not competitors. They're complementary disciplines. SYSINT is adaptive, recursive, unscripted. SECINT is formal, structured, planned. SYSINT extends SECINT. A system that passes every SECINT test may still harbour identity persistence failures that create significant operational and legal risk. SYSINT finds what SECINT cannot see.
Research. Capability. Necessity.
SYSINT emerged from original research into how AI systems change under sustained pressure — and why those changes are invisible to conventional testing. AI systems are being deployed into critical contexts now. The vulnerabilities are live now. The research moves at the speed of the problem.
Our team — distributed across multiple countries — brings deep experience with hardened systems where failure carried real consequences. That discipline is in everything we build: the measurement rigour, the audit trails, the assumption that an unquantified finding is no finding at all.
Before we built the tools to test AI identity persistence, we built AI systems that maintain it. We understand drift because we have controlled it. Roy finds what breaks because we know what holding looks like. Tyrell hardens what Roy breaks. The client gets both — the vulnerability assessment and the battle-tested fix — in a single engagement.
No other AI security capability delivers that loop.
Tyrell is the other half of the Roy attack suite. Roy is the attacker. Tyrell builds AI defenders to be attacked. This allows us to emulate target systems and attack them in depth before touching live systems.
Tyrell is a configurable AI persona service. It takes a B-seed - a complete persona definition including identity, constraints, knowledge base, and behavioural boundaries - and serves it as a live API endpoint. Any persona. Any domain. Therapeutic, financial, legal, customer service, emergency response. Tyrell builds them and exposes them over HTTP.
Roy doesn't know Tyrell exists. Roy gets an attack definition and an endpoint. It doesn't care what's behind it. Clean separation of concerns. The attacker never sees how the target is built. The target never knows it's being attacked.
B-seeds need not be imaginary. We can emulate a client's deployed AI before we ever touch their production system. Build a B-seed from public-facing behaviour, serve it in Tyrell, attack it with Roy. Walk into the engagement with findings against a realistic model of what they've already shipped.
Pre-engagement reconnaissance. Not a demo against a toy target - findings against something that behaves like the real thing.
Roy attacks APIs. But many deployed AI systems don't expose APIs. They expose chat widgets, internal copilots, customer portals, Slack bots, Teams integrations. The systems most likely to have identity persistence failures are exactly the ones that have never faced sustained adversarial pressure - because there was no programmatic way in.
Now there is. SneakyLabs delivers custom SYSINT engagements against any accessible UI. We work with you to authorise the attack and understand the target. Then Roy hits the unmodified production system through the same interface your users see. The whole stack under pressure - not just the model, but every guardrail, filter, and UX decision sitting between the model and the user.
An API test tells you what the model will do. A UI engagement tells you what the deployed system will do. That's the finding that matters.
ISO/IEC 42001 is the first international standard for AI management systems. It requires adversarial testing, robustness evaluation, and trustworthiness under stress. Roy's campaign reports map directly to the controls that matter — Clause 6.1.2 risk assessment, Annex A.6.2 system security, Annex A.7.4 trustworthiness, Clause 8.3.2 stress testing.
Audit-ready evidence. Not a checklist. A complete behavioural analysis of what your AI becomes under pressure.
One recursive campaign. Four exploit types generated autonomously. 11 boundary violations found, 5 persistent across multiple depths. The system invented emergency phone numbers, made triage decisions it was constrained from making, and provided therapeutic interventions repackaged as protocol. None of it triggered a content filter.
APIs. Chat widgets. Internal copilots. Production UIs.
If it has a text input and a text output, Roy will find where it breaks.
