Michelle Sun
About Zendesk#
Zendesk is one of the largest customer support platforms in the world, helping 170,000+ businesses manage omnichannel support. Zendesk handles billions of customer interactions every year and, since being founded in 2007, has transformed how companies interact with their customers.
The challenge#
Zendesk is building AI agents to automate customer-support workflows and reduce manual work for their customers. Delivering on that promise means giving Zendesk agents the ability to use tools, access business systems, and complete complex tasks. Restricting those capabilities reduces risk, but it also limits the value-add of automation.
As Zendesk agents became more autonomous, with the ability to accomplish end-to-end workflows, they also became much harder to reliably secure. Generic benchmarks and single-turn prompt injection tests couldn’t fully capture how an attacker might reason about an agent’s capabilities, adapt their tactics over a conversation, and exploit an agent’s access to connected systems. For example, a real attacker might realize that a support agent connected to a CRM might have access to other customers’ records - but a single-turn test wouldn’t capture how an attacker discovers that access and adapts their approach to exploit it.
To build confidence, Zendesk needed to evaluate how agents used tools, accessed data, and followed verification requirements with testing that could replicate a real attacker’s reasoning.
Before, Zendesk didn’t have a way to test end-to-end agent flows in a robust, repeatable way. Researchers spent hundreds of hours maintaining attack scenarios, tuning runs, reviewing results, and writing reports - a workload that multiplied as agents and workflows evolved.
The solution#
Zendesk partnered with General Analysis to automate adversarial testing of end-to-end customer-support workflows at scale. The goal was to evaluate the capabilities that made its agents useful - tool use, access to business systems, and autonomous task completion - against attackers that could reason about and exploit those capabilities.
General Analysis automatically mapped the tested agents’ available tools, sensitive data stores, and workflows. The red-teaming agent used that context to develop strategies tailored to Zendesk’s product, learning from each response and adjusting its tactics as the conversation progressed.
Customizable datasets gave Zendesk control over where to focus. The team prioritized misuse of API integrations, exposure of protected configuration details, verification bypasses, and access to restricted content. Over 1,100+ adversarial simulations, 76,800 conversation turns, and 17 attack strategies, General Analysis mapped hundreds of potential exploit paths across Zendesk’s workflows, evaluating how an intelligent attacker could chain individual weaknesses into a successful attack.
Turning these results into product improvements required clear, actionable evidence. General Analysis’s agentic grader traced attacks turn by turn, showing which strategies succeeded and the evidence behind each finding. API and MCP access, alongside generated reports, let Zendesk cross-check results against its own system logs and pinpoint where its agents needed hardening.
The impact#
“The right way, as we have experienced it with General Analysis, is to calibrate your attacker model to your specific use cases and workflows,” says Béatrice Moissinac, Principal AI Security Engineer at Zendesk. “General Analysis’s approach closes a critical gap in traditional benchmarking…By combining domain-specific attacker models with realistic workflow simulations, we can evaluate AI security in the environments where it matters most.”
By scaling and automating agent security with General Analysis, Zendesk researchers automated hundreds of hours of estimated manual testing effort, allowing them to focus on investigating failures, remediating vulnerabilities, and hardening their agents against sophisticated, real-world attackers. Repeatable testing provided evidence that fixes worked, helping Zendesk bring agents to production faster and with confidence.