EC-Council, the organisation that certified me as an ethical hacker, published an adversarial-testing curriculum for AI this week. They are not alone. Agent-governance platforms are launching in preview, and analysts have the AI trust-and-security market compounding at 30.3% a year on the back of agentic adoption. Here is the uncomfortable observation from the shop floor. In every plant where I have run quality, tensile coupons snapped at a recorded load because we asked them to. Salt-spray cabinets ate coatings toward their 720-hour readings. Fatigue rigs cycled fasteners toward the millionth swing. We break parts deliberately, on schedule, with a test plan and a sign-off. Then we extend unlimited trust to the newest system on the line: the software agent that decides which parts pass.

Nobody has ever deliberately broken the agent.

quality invented red teaming — we called it destructive testing

Destructive testing is the oldest honest discipline in manufacturing. We kill samples to buy truth about populations. A weld coupon fails so ten thousand welds do not. We do not test because we expect failure; we test to learn the failure mode and the margin before the field learns it for us.

The mindset transferred when I took the Certified Ethical Hacker path. I recognised the craft on day one: think like the attacker, find the breaking point before someone with worse intentions and better timing does. Years later I went hunting in a live consumer portal, found a clickjacking flaw, disclosed it responsibly and ended up on T-Mobile's public bug-bounty Hall of Fame. Not a trophy hunt — a confirmation of the same lesson the tensile rig teaches. Systems fail where nobody is deliberately looking, and the honourable move is to break your own things before outsiders do it for you.

So when EC-Council starts teaching AI red teaming and Info-Tech advises treating agents as persistent digital actors, the vocabulary is new; the discipline is not. Under IATF 16949 and AS9100 we have run it for decades — validation, destructive testing, re-qualification after every engineering change. We simply never called it red teaming.

Destructive testing spends one part to buy the truth about ten thousand. Red teaming spends one assumption to buy the same.

how an agent actually fails on a real line

Agents do not fail the way the marketing suggests, with a dramatic collapse. They fail the way processes fail: quietly, at the margins, through drift.

Drift comes first. A new plating supplier changes surface reflectivity, and the vision model trained on the old finish starts rejecting good parts by the bin — or, worse, passing marginal ones. Then fail-open. The link to the vision server drops for 40 minutes; the agent defaults to last-known-good and accepts everything — no alarm, no record, no memory of the event. Override fatigue is slower. Operators overrule the agent thirty times a shift because it is over-sensitive; the overrides become logged data, the model learns that disagreement is normal, and the flagging quietly decays. And agents trust documents the way a fresh inspector trusts a stamp. An OCR'd PDF with a confident line in the footer is enough to steer the decision.

I design and deploy these systems myself. My platform MultiPS runs 63 models in parallel and synthesises consensus between them for one reason: a single model fails silently, and consensus makes the failure observable. When sixty-one models agree and two drift, the drift has a shape and a timestamp. That is engineered failure visibility — the software equivalent of a proof-load hole in a fixture. Any decision-maker that can fail invisibly will. You will meet the failure at the customer.

Run the cost asymmetry. Call a false reject €6 in re-inspection. Call a false accept into an aerospace sub-assembly a containment team, a chargeback and your standing on the next programme. That ratio, not the licence fee, is what justifies a protocol.

a red-team protocol your plant can run next month

Key takeaways

  • An agent with authority to accept or reject parts is production equipment — qualify it, attack it, and re-qualify it after every change to the model or the prompt.
  • Every red-team finding is a non-conformance: owner, containment, deadline, QRQC inside 48 hours. The IT queue is where findings go to be re-prioritised forever.
  • Engineer failure visibility. A single model fails silently; consensus, challenge sets and drift monitors make the failure observable before a customer's auditor makes it famous.
  • Budget on the asymmetry: a false reject costs euros of re-inspection; a false accept costs containment, chargebacks and programme standing.

Treat the agent like a part with a specification. One month, six moves:

  • Scope one decision. The accept/reject call on one line. Not the digital strategy — one decision with real authority.
  • Write a decision PFMEA. False accept, false reject, silent pass-through, trusted-document failure — severity, occurrence, detection, exactly like the PFMEAs your auditors already understand.
  • Build the attack plan like a lab test plan. Drift the inputs with lighting changes and a new supplier. Starve it by pulling the network. Deceive it with a certificate containing a plausible lie. Fatigue it with ten thousand consecutive decisions and count the edge cases.
  • Route every finding through the NCR system, not the IT queue. An NCR gets an owner, a containment action and a deadline. A ticket gets a priority and a sigh.
  • Run QRQC within 48 hours; go to A3 when the cause is