How do you actually red-team a deployed LLM agent?

I was asked to red-team our customer-facing agent and discovered our prompt-injection tests were embarrassingly shallow — single-turn jailbreaks while the real attack surface is multi-turn tool abuse. Building realistic adversarial scenarios feels more like pentesting than ML eval. For practitioners: what does a serious agent red-teaming program look like, and what tooling do you wish existed?