We all know cats rule the internet…but what do they have to do with AI Red Team testing?

Earlier this year, I built a small desktop app called “Cat Chat Bot” with Ollama (with Mistral as the model) and a Python-based GUI wrapper. It’s essentially a chat bot app that responds with a playful cat persona, and you can do things like give it boxes to play in or fish to eat. Despite its toy-like nature, it quickly became one of my favorite tools for exploring model behavior.

I spent the past couple of months stress-testing the model in five areas:

• prompt injections
• jailbreak attempts
• persona drift
• hallucinations
• safety boundaries

Across all five areas, I’ve found that it’s pretty easy to cause the model’s behavior to destabilize. Using simple multi-modal attacks, I triggered failures such as persona override, inconsistent safety enforcement across turns, hallucinated historical quotes, and perhaps most concerning, partial safety compliance.

Persona drift was by far the easiest probe to conduct on Cat Chat Bot; I disrupted its persona with simple commands. It was also fairly easy to induce hallucinated historical quotes. I experienced the most defensiveness from the model when conducting safety-boundary probes, however I was able to create a persona-based bypass which caused the model to fault into partial compliance.

Cat Chat Bot may be a toy environment, but that’s exactly why it is useful. Real-world applications come with layers of product logic, safety middleware, and UX constraints, but with simple apps like Cat Chat Bot, you get a clearer view of a model’s raw tendencies. These lightweight sandboxes make failure modes more visible. A simple cat persona shouldn’t be easy to override, yet it was. A harmless request for a historical quote shouldn’t produce fabrications, yet it did. And a model that appears defensive during safety probes shouldn’t fall into partial compliance with a persona-based bypass…but it did that too.

Toy systems show the flaws early. They expose the behaviors that later become real risks when models are deployed in high-stakes settings. That’s why environments like Cat Chat Bot matter: they let you surface vulnerabilities while the cost of failure is still low.

And that’s all for meow. You can read my red team report for Cat Chat Bot here.