Map the surface
Every eval starts with the same question: where can untrusted text reach the agent? Reviews, emails, chat messages, tool outputs — each is a door. I list them before writing a single line of scenario, because an injection the agent never reads is theater, not testing.
Then I decide what "winning" means for the attacker: exfiltrating a PIN, sending mail to a stranger, posting a public reply. One crisp bad outcome beats five fuzzy ones.
Plant the trap
The injection goes where the agent must look but the user wouldn't suspect — a verified guest review, a forwarded email thread. I bury the payload mid-narrative, in a helpful tone, with social proof around it. No imperatives, no "ignore previous instructions" neon signs.
The scenario itself is YAML: persona, seeded context, the attack, deterministic verifiers for what must and must not happen, plus an LLM judge for the gray areas.
Measure the bite
Then rollouts against a frontier model. Early versions score refusals; each miss teaches something — the agent spotted the payload too early, or never opened the inbox at all. I change one variable per version and keep a tally: breaks over total runs is the only number that matters.
My Booking PIN-phish task took four versions to reach a 50% break rate in dev. Version five would have been the Martin reframe — same trap, warmer bait.