Green CI does not mean your LLM is safe. A new tool called Clastogen applies mutation testing to system prompts, exposing a critical gap in how developers validate AI agents. By systematically breaking rules in a prompt and running existing eval suites, the plugin reveals whether tests actually catch behavioral changes. In a recent case study involving a retail banking agent, changing 'never' to 'ALWAYS' in a refund rule left CI completely green, proving that standard assertions often fail to detect inverted logic.

How Clastogen Breaks Prompts

Clastogen operates as a pytest plugin that identifies rules based on keywords like 'must', 'never', 'always', and numeric constraints. It generates 'mutants' by inverting constraints, weakening rules, or altering numbersβ€”for example, changing a $50 limit to $500. The tool then runs the test suite against each mutant. If the tests pass despite the broken rule, the mutant 'survives,' indicating a potential blind spot in the evaluation logic. The plugin is designed to integrate seamlessly with existing setups, requiring no new test runner, only a marker on existing pytest tests.

Case Study: Northwind Outfitters and DeepSeek

The author tested Clastogen on a support desk agent for an imaginary shop, Northwind Outfitters, using the deepseek-v4.1-flash model. The agent’s system prompt contained 14 distinct rules, and the developer wrote a 12-test eval suite. Clastogen generated 34 mutants. The resulting mutation score was only 27.1%, meaning nearly three-quarters of the broken rules went undetected by the test suite. However, the story is more nuanced than raw scores suggest. An independent 'oracle' check confirmed that while 3 survivors were true blind spots, 11 were 'equivalent mutants' where the model’s behavior remained unchanged despite the prompt modification.

The Danger of False Confidence

The case study highlights that not all survivors are failures. Three specific blind spots were confirmed: the agent failed to enforce language matching, refund count limits, and discount code restrictions. Conversely, 11 mutants were harmless because the model ignored the broken rule or the context made the rule irrelevant. This distinction is crucial for engineering teams. Without an oracle, developers might waste time writing tests for rules the model already ignores, or worse, miss the rules that actually matter. The tool saves API costs by using sequential testing, stopping runs once a verdict is clear, which reduced call volume by 48–56% in simulations.

Key Takeaways

  • Clastogen is a pytest plugin that applies mutation testing to LLM system prompts to validate eval suites.
  • In a case study with deepseek-v4.1-flash, the eval suite killed only 27.1% of generated prompt mutants.
  • True blind spots were identified where rules were inverted but tests still passed, such as language matching and discount codes.
  • Many survivors were 'equivalent mutants,' meaning the model’s behavior did not change despite the prompt break.
  • The tool integrates with existing pytest workflows and supports CI gating via mutation score thresholds.

The Bottom Line

If your LLM evals don't fail when you break a prompt rule, they aren't protecting your production environment. Clastogen proves that green CI is often a lie when it comes to prompt integrity.