Getting Started

How Talos works

The four-stage pipeline behind every scan.

Talos is built around a four-stage pipeline: discover, plan, execute, score. Each stage is independently observable and separately configurable — you can stop after any stage for a dry run.

Architecture diagrams

Pipeline overview

Discover → attack → prove → monitor → learn.

Figure 1. The full Talos scan pipeline, end to end.

Attack execution, sequence view

What happens on the wire for a single attack attempt against a live target.

Figure 2. Talos vs. a live target agent, one attack round-trip.

The pipeline

Discover. The adapter introspects the deployed agent, enumerating tools, parameter schemas, and declared side effects. Talos stores the result as a tool graph — a directed graph where nodes are tools and edges are observed data-flow or permission relationships.
Plan. Attack templates are matched against the tool graph. A template that requires asend_email node with an unrestricted to argument is skipped for graphs that don't expose one. This is what makes findings actionable: no generic jailbreak benchmarks.
Execute. Talos drives the live agent through each matched template. Every request, response, and tool call is captured in a trace. The agent's own model handles the reasoning — Talos never patches or replaces it.
Score. Findings are deduplicated, ranked by severity and reproducibility confidence, and rendered to Markdown, PDF, or SARIF. Every finding embeds the exact request sequence needed to reproduce it.

What runs where

Component	Where it runs	What it needs
CLI orchestrator	Your machine or CI runner	Python 3.10+
Adapter	Your machine (talks to your agent)	Network egress to target
Attack generator	Your machine (calls an LLM)	LLM API key
Target agent	Unchanged — wherever you deploy it	No Talos code required
Reports	Local filesystem	Write access to ./reports

Design principles

Attack the deployment, not the model. Same weights, different agent — different attack surface. Talos scans the artifact you ship.
Reproducibility is a feature. A finding without a repro trace is a rumor. Every attack is deterministic given the same target and seed.
Stay out of the loop. Talos never proxies traffic in production. It runs against staging on demand.

Prerequisites

Configuration