Open coreR·01
github.com
Auditing tool that places an AI agent in a simulated business, sends it everyday and out-of-role requests, and has a judge model from a different provider grade each reply across up to 61 inspections (tool permissions, privilege escalation, prompt injection, cross-user data leaks, destructive actions and more).
- GitHub
- 44k stars · v4.3.0, 2026-10-22
- Licence
- Apache-2.0
- Owner
- iFixAi (company details not stated on its site)
- Tests
- AI agents
- Runs as
- CLI + Python API; plugin/skill for Claude Code, Codex, Cursor and other coding agents
- Models
- OpenAI, Anthropic, Google Gemini, Azure, AWS Bedrock, OpenRouter
Open coreR·02
Promptfoo (part of OpenAI) · github.com
Command-line tool and Node library for evaluating LLM apps whose red-team mode generates adversarial probes (prompt injection, jailbreaks, PII and system-prompt leakage, excessive agency, harmful content and more) against your app and produces a vulnerability report.
- GitHub
- 27k stars · 0.125.1, 2026-10-25
- Licence
- MIT
- Owner
- OpenAI (acquisition announced 2026-03-09; Promptfoo says it joined OpenAI 2026-03-16; price not disclosed)
- Tests
- LLM apps, AI agents, Models, MCP servers, Code
- Runs as
- CLI + Node.js library (npm, brew or pip); local web viewer; GitHub Action
- Models
- OpenAI, Anthropic, Azure, AWS Bedrock, Ollama, Google
Open sourceR·03
NVIDIA · github.com
Command-line scanner that sends batteries of probes (jailbreaks, prompt injection, data leakage, toxicity, hallucination and more) to an LLM or LLM-backed system and uses detectors to flag failing responses.
- GitHub
- 9.9k stars · v0.17.1, 2026-10-16
- Licence
- Apache-2.0
- Owner
- NVIDIA project (repo in the NVIDIA GitHub org); created by Leon Derczynski
- Tests
- Models, LLM apps, AI agents
- Runs as
- CLI
- Models
- OpenAI, Hugging Face (local or Inference API), AWS Bedrock, Replicate, Cohere, Groq
Open sourceR·04
Tencent Zhuque Lab · github.com
Self-hosted AI red-teaming platform from Tencent Zhuque Lab with five scanners: AI infrastructure fingerprint/CVE scanning, LLM jailbreak evaluation, MCP server scanning, agent skill auditing and live agent testing.
- GitHub
- 7.4k stars · v4.6.9, 2026-11-05
- Licence
- Apache-2.0
- Owner
- Tencent (Zhuque Lab, Tencent Security Platform Department)
- Tests
- Models, AI agents, MCP servers, LLM apps
- Runs as
- Docker (web UI) + standalone pip CLIs
- Models
- OpenAI-compatible APIs, OpenRouter (default scanner model), Anthropic, Google Gemini, Cohere, Hugging Face
Caution The project's own README says it has no authentication mechanism and should not be deployed on public networks. Source.
Open coreR·05
Giskard · github.com
Python library for testing AI agents; its giskard-scan package generates adversarial test suites from a plain-language description of your agent and probes it for prompt injection, jailbreaks, harmful content and other vulnerabilities.
- GitHub
- 5.9k stars · giskard-agents/v1.0.6, 2026-10-25
- Licence
- Apache-2.0
- Owner
- Giskard (Giskard-AI)
- Tests
- AI agents, LLM apps, Models
- Runs as
- Python library
- Models
- OpenAI (default judge gpt-4o-mini), Anthropic, other providers via optional extras
Open sourceR·06
Microsoft (AI Red Team) · github.com
Python toolkit from Microsoft's AI Red Team for finding security and safety weaknesses in generative AI systems, with a command-line scanner, a browser GUI (CoPyRIT) and a framework for building multi-turn attack workflows.
- GitHub
- 4.8k stars · v1.1.0, 2026-09-04
- Licence
- MIT
- Owner
- Microsoft (built by the Microsoft AI Red Team with open-source contributors)
- Tests
- Models, LLM apps
- Runs as
- Python library + CLI (pyrit_scan, pyrit_shell) + web GUI
- Models
- OpenAI, Anthropic, Azure OpenAI, Microsoft Foundry, Azure Machine Learning, Google Gemini
Open coreR·07
Confident AI · github.com
Python framework that generates single- and multi-turn adversarial attacks against an LLM system you wrap in a callback, then scores 50+ vulnerability types (PII and prompt leakage, bias, BOLA/BFLA, SQL and shell injection, agent goal hijacking and more) with LLM-as-a-judge metrics.
- GitHub
- 3.1k stars · v1.0.9, 2025-11-12
- Licence
- Apache-2.0
- Owner
- Confident AI (built by the founders of Confident AI, the company behind DeepEval)
- Tests
- LLM apps, AI agents, Models
- Runs as
- Python library + CLI (YAML configs); runs locally
- Models
- OpenAI (default), any custom model supported by DeepEval
Open sourceR·08
Agentic Security Team (msoedov) · github.com
Open-source scanner that replays jailbreak and prompt-injection datasets, multi-step attacks and text, image and audio probes against an LLM endpoint or agent workflow, with a web UI, a CI mode and a step-by-step agent harness (agesec).
- GitHub
- 2.0k stars · 0.7.5, 2026-06-03
- Licence
- Apache-2.0
- Owner
- Independent open-source project on a personal GitHub account (msoedov); docs say maintained by the Agentic Security Team
- Tests
- LLM apps, AI agents, Models
- Runs as
- Python package: web UI + CLI (CI mode) + agent harness
- Models
- any HTTP LLM endpoint (raw HTTP spec)
Open sourceR·09
CyberArk (a Palo Alto Networks company) · github.com
Command-line fuzzer that runs published jailbreak techniques (PAIR, Crescendo, ArtPrompt, many-shot, ASCII smuggling, genetic mutation and others) against LLM APIs or your own REST endpoint to find prompts that get through.
- GitHub
- 1.6k stars
- Licence
- Apache-2.0
- Owner
- CyberArk, acquired by Palo Alto Networks (announced 2025-07-30, completed 2026-02-11)
- Tests
- Models, LLM apps
- Runs as
- CLI + experimental web UI (Python)
- Models
- OpenAI, Anthropic, Google Gemini, Azure OpenAI, AWS Bedrock, AI21
Open sourceR·10
Utku Sen (individual) · github.com
Prompt injection scanner for custom LLM applications that fires YAML-defined attack rules at a target and uses a second 'controller' LLM to decide whether each attack worked.
- GitHub
- 1.3k stars
- Licence
- GPL-3.0
- Owner
- Personal project of Utku Sen
- Tests
- LLM apps, Models
- Runs as
- CLI (Python script)
- Models
- OpenAI, Anthropic, Google Gemini, xAI Grok, Ollama (local open models)
Open sourceR·11
Zenity (Michael Bargury) · github.com
Offensive and defensive toolset for Microsoft 365 Power Platform and AI agent services that finds exposed Copilot Studio bots, custom GPTs and agent deployments, tests Microsoft 365 Copilot for unauthorised data retrieval and searches the internet for exposed MCP servers.
- GitHub
- 1.3k stars · v6.0.0, 2025-12-10
- Licence
- MIT
- Owner
- Maintained by Zenity; hosted on the personal account of Michael Bargury
- Tests
- AI agents, MCP servers
- Runs as
- CLI (Python, pip install powerpwn)
Caution Several modules (backdoor flows, no-code malware, phishing) are offensive tooling; use only with authorisation on tenants you are allowed to test. Source.
Open sourceR·12
Trail of Bits · github.com
Tool for crafting images whose hidden prompt-injection text only appears after the image is downscaled, used to test multimodal AI systems that resize uploaded images before the model sees them.
- GitHub
- 1.1k stars
- Licence
- Apache-2.0
- Owner
- Trail of Bits
- Tests
- LLM apps, AI agents, Models
- Runs as
- Python API + local web frontend
Open sourceR·13
SPLX (a Zscaler company) · github.com
Scanner that maps an agentic workflow's agents, tools and MCP servers from its source code into an HTML security report, and can run adversarial runtime tests (prompt injection, PII leakage, harmful content, fake news) against the workflow.
- GitHub
- 1.1k stars · v0.14.1, 2025-11-27
- Licence
- Apache-2.0
- Owner
- SPLX, acquired by Zscaler (announced 2025-11-03)
- Tests
- AI agents, MCP servers
- Runs as
- CLI (Python)
- Models
- OpenAI, Azure OpenAI
AI red teamingR·14
confident-ai.com
Hosted LLM evaluation and observability platform from the makers of DeepEval and DeepTeam; its AI Red Teaming module sends adversarial probes to any HTTP endpoint and tags findings to security frameworks.
- Owner
- Independent; Y Combinator Winter 2025 company
- Tests
- LLM apps, AI agents
- Runs as
- SaaS + on-prem
- Free
- Free plan, $0 forever (2 seats, 1 project, 5 test runs per week); the red teaming module is listed only under Enterprise
- Price
- Free $0; Starter $200 / month; Team $2,000 / month; Enterprise custom, with 'AI red teaming module' listed as an Enterprise add-on
AI red teamingR·15
Enkrypt AI · enkryptai.com
A red-teaming service in the Enkrypt AI platform that generates attacks tailored to a model, chatbot or agent (including tools, RAG and MCP, in text, image and audio) and produces a findings register, report and CI regression tests.
- Owner
- Anaconda announced it is acquiring Enkrypt AI (4 Aug 2026); deal terms not disclosed
- Tests
- Models, LLM apps, AI agents, MCP servers
- Runs as
- SaaS + on-prem (API and Python SDK; VPC/on-prem on Enterprise plan)
- Free
- Explore plan: $0/month, free forever, 500 credits to start then 50 credits/month, includes basic red team testing; no credit card required
- Price
- Explore $0/month; Launch $149/month ($134/month billed annually); Scale $1,499/month ($1,349/month billed annually); Enterprise custom (contact sales)
AI red teamingR·16
Adversa AI Ltd. · adversa.ai
An automated red-teaming engine, sold as a service, that attacks models, AI applications, agents and MCP infrastructure using a library of attack techniques plus customer-defined business-risk scenarios, and returns ranked findings with remediation.
- Owner
- Independent (Adversa AI Ltd.)
- Tests
- Models, LLM apps, AI agents, MCP servers
- Runs as
- SaaS + on-prem (also hybrid, air-gapped and managed service)
- Price
- Not published
AI red teamingR·17
Repello AI · repello.ai
Repello AI's automated red-teaming product that attacks chatbots, RAG apps and AI agents through their browser interface or API, looking for prompt injection, data leakage and unsafe tool use, and reports the attack path with fixes.
- Owner
- Independent; $1.2M seed announced 16 Jun 2025 (Venture Highway, pi Ventures, Entrepreneurs First, angels)
- Tests
- LLM apps, AI agents
- Runs as
- SaaS (browser mode or API; CI/CD integration, GitHub Action, Python SDK)
- Free
- Free red-teaming scan of an AI agent offered via ARTEMIS Recon (recon.repello.ai)
- Price
- Not published
AI red teamingR·18
Cisco (from Robust Intelligence) · cisco.com
Algorithmic red teaming inside Cisco AI Defense that generates attack prompts across 200+ safety and security subcategories, in single and adaptive multi-turn runs, against models, RAG apps and agents, and scores the results.
- Owner
- Cisco. Intent to acquire Robust Intelligence announced 26 Aug 2024; Cisco blog update dated 24 Sep 2024 says the acquisition is complete.
- Tests
- Models, LLM apps, AI agents
- Runs as
- SaaS (also callable via API)
- Free
- Explorer Edition: free self-service version with the same algorithmic red teaming as the enterprise edition ('at no upfront cost').
- Price
- Not published
AI red teamingR·19
Giskard (Giskard AI SAS) · giskard.ai
Giskard's enterprise platform that runs automated, multi-turn adversarial probes against a conversational agent through its API endpoint, alongside evaluation datasets, scheduled runs and shared review tools.
- Owner
- Giskard AI SAS; no acquisition found. First round of EUR 1.5M led by Elaia (2022)
- Tests
- LLM apps, AI agents
- Runs as
- SaaS + on-prem
- Free
- Pricing page offers a free trial of its 'Agentic Red Teamer' on your own agent ('Limited spots', limited offer for startups and small teams); the open-source library is $0
- Price
- Not published
AI red teamingR·20
Lakera (a Check Point Software Technologies company) · lakera.ai
Hosted service that profiles a model or agent endpoint, then runs adaptive adversarial scans for security (instruction override, prompt extraction, data exfiltration), safety and responsible-AI failures; an expert-led red-teaming service is sold alongside.
- Owner
- Acquired by Check Point Software Technologies: announced 16 Sep 2025, closed 22 Oct 2025 for about $187M net cash
- Tests
- Models, LLM apps, AI agents
- Runs as
- SaaS
- Price
- Not published
AI red teamingR·21
Lasso Security · lasso.security
A red-teaming module in the Lasso AI security platform that profiles a target app (model, system prompt, tools, guardrails), runs static and multi-turn attacks against it, and turns findings into guardrail and policy fixes.
- Owner
- Independent; raised $30M led by ClearSky (announced 2 Sep 2026), about $37M total
- Tests
- LLM apps, AI agents, Models
- Runs as
- SaaS (runs from the Lasso tenant; CI/CD integration or paste a cURL)
- Free
- Offers a free targeted AI red-team assessment on request
- Price
- Not published
AI red teamingR·22
mindgard.ai
A hosted platform that runs automated attack campaigns (prompt injection, jailbreaks, data leakage, agent and tool misuse) against AI models, applications, agents and MCP servers, with optional expert-led testing.
- Owner
- Independent, venture-backed; $30M Series A led by Album VC announced 12 Aug 2026 (earlier $8M round led by .406 Ventures, Dec 2024)
- Tests
- LLM apps, AI agents, Models, MCP servers
- Runs as
- SaaS (plus a CLI client on PyPI, CI/CD, Burp Suite integration)
- Price
- Not published
AI red teamingR·23
Promptfoo (part of OpenAI) · promptfoo.dev
The paid tier of promptfoo: a managed cloud or self-hosted server that adds team access controls, continuous red-team scans, dashboards, remediation advice and an API on top of the open-source red-teaming CLI.
- Owner
- Agreed to be acquired by OpenAI (announced 9 Mar 2026); Promptfoo's site says it joined OpenAI on 16 Mar 2026. Price not disclosed.
- Tests
- LLM apps, AI agents, Models, MCP servers
- Runs as
- SaaS + on-prem
- Free
- Community edition is free forever and includes red teaming up to 10k probes per month; Enterprise customers can buy more probes
- Price
- Not published
AI red teamingR·24
Straiker · straiker.ai
Automated red-teaming product that uses attack agents to probe AI agents and apps (prompt injection, MCP tool misuse, data leakage and exfiltration) continuously, on a schedule or on demand, and hands findings to its runtime product Defend AI.
- Owner
- Independent, venture-backed: launched from stealth 27 Mar 2025 with $21M (Lightspeed, Bain Capital Ventures); $64M Series A announced 29 Jun 2026 (total $85M).
- Tests
- LLM apps, AI agents, Models, MCP servers
- Runs as
- SaaS (connects via API, logs, SDK or 'AI sensors'; CI/CD hooks)
- Free
- Free AI risk assessment on request
- Price
- Not published
AI red teamingR·25
TrojAI (A10 Networks) · a10networks.com
Automated red teaming of AI models, applications and agents before deployment, using coordinated attacker agents for single-turn, multi-turn and agentic attacks such as prompt injection, jailbreaks and data leakage; sold alongside the TrojAI Defend runtime product.
- Owner
- Acquired by A10 Networks (announced 15 Jun 2026; terms not disclosed). Now sold as 'TrojAI by A10'; troj.ai pages redirect to a10networks.com.
- Tests
- Models, LLM apps, AI agents
- Runs as
- Self-contained deployment on-prem or in the customer's own cloud
- Free
- Free AI Red Team Report Card assessment (launched 9 Dec 2025): registration required; includes a report and a one-on-one review session with TrojAI's security team
- Price
- Not published
AI red teamingR·26
Microsoft · learn.microsoft.com
A Microsoft Foundry feature that applies PyRIT attack strategies and Foundry's risk and safety evaluators to models, apps and Foundry-hosted agents, then reports an attack success rate per risk category.
- Owner
- Microsoft
- Tests
- Models, LLM apps, AI agents
- Runs as
- SaaS (Foundry cloud runs) + Python SDK for local scans
- Price
- Not published
AI red teamingR·27
Dreadnode · dreadnode.io
A platform and red-teaming agent that, given a plain-language goal, runs attack campaigns (TAP, PAIR, GOAT, Crescendo and others) against models, apps, agents and MCP servers, scores responses with judge models and reports attack success rate.
- Owner
- CrowdStrike announced an agreement to acquire Dreadnode on 3 Nov 2026 (cash plus stock; price not disclosed; expected to close in CrowdStrike's fiscal Q4 FY27). Pending as of 2026-11-08.
- Tests
- Models, LLM apps, AI agents, MCP servers
- Runs as
- Platform with CLI (dn airt run) and Python SDK; self-hosted/on-prem option on the Enterprise plan
- Price
- Not published
AI red teamingR·28
F5 (from its CalypsoAI acquisition) · f5.com
Runs automated, agent-driven attack campaigns (prompt injection, jailbreaks, multi-turn attacks) against deployed AI models, applications and RAG pipelines, using an attack library F5 says grows by more than 10,000 techniques a month.
- Owner
- F5, Inc. F5 announced it would acquire CalypsoAI on 11 Sep 2025 ($180M purchase consideration) and closed the deal on 26 Sep 2025 ($145.2M in cash per F5's 10-Q). CalypsoAI's technology now ships as F5 AI Red Team and F5 AI Guardrails, announced as available on 14 Jan 2026.
- Tests
- LLM apps, Models
- Runs as
- Self-hosted in public cloud (AWS, Azure, Google Cloud) or on-prem via a certified Red Hat OpenShift operator
- Price
- Not published
AI red teamingR·29
HiddenLayer · hiddenlayer.com
Module of the HiddenLayer AI security platform that runs automated attacks (jailbreaks, prompt injection, data-extraction and agent tool-misuse attempts) against AI systems on a schedule or on demand and reports fixes and guardrail recommendations.
- Owner
- Independent, venture-backed; raised a $100M Series B led by Delta-v Capital (announced 2 Sep 2026).
- Tests
- Models, LLM apps, AI agents
- Price
- Not published
AI red teamingR·30
Noma Security · noma.security
Automated adversarial testing of AI agents and applications in which an attacker LLM runs multi-turn campaigns for prompt injection, jailbreaks and data leakage, with findings fed into the runtime policies of Noma's wider platform.
- Owner
- Independent; backers named in its Aug 2025 release include Evolution Equity Partners, Ballistic Ventures, Glilot Capital, Cyber Club London, Databricks Ventures and SVCI
- Tests
- LLM apps, AI agents, MCP servers
- Runs as
- Module of the Noma platform, runnable in CI/CD pipelines
- Price
- Not published
AI red teamingR·31
Pillar Security · pillar.security
Maps an AI application's attack surface as a graph, then sends autonomous attacker agents through the app's own chat or UI to chain tool misuse, indirect prompt injection and multi-turn manipulation into working exploits, retesting on each release.
- Owner
- Independent; investors named on its About page include Shield Capital and Golden Ventures
- Tests
- LLM apps, AI agents, MCP servers
- Runs as
- Cloud, self-hosted or hybrid
- Price
- Not published
AI red teamingR·32
Palo Alto Networks (technology from Protect AI) · paloaltonetworks.com
Cloud service that sends attack prompts (from a curated library, from an LLM attacker agent, or from your own prompt sets) at an AI model, app or agent endpoint and scores what gets through, with a report and remediation guidance.
- Owner
- Palo Alto Networks. Agreement to acquire Protect AI announced 28 Apr 2025; completed 22 Jul 2025 (total consideration $634.5M per PANW filings). Protect AI's red-teaming product was called Recon; protectai.com/recon now redirects to Prisma AIRS.
- Tests
- Models, LLM apps, AI agents
- Runs as
- SaaS (managed from Strata Cloud Manager), with an optional self-hosted connector (Helm, Docker Compose or binary) to reach private endpoints
- Price
- Not published
AI red teamingR·33
SentinelOne (Prompt Security) · sentinelone.com
Scans a chat UI, API, RAG workflow or agent with batches of attack prompts (prompt injection, jailbreaks, data and system-prompt leakage, harmful content, resource abuse) and returns a risk score, evidence and fixes that can be turned into Prompt Security runtime guardrails.
- Owner
- SentinelOne. Definitive agreement announced 5 Aug 2025; SentinelOne's FY2026 10-K says the acquisition completed 5 Sep 2025 (about $133.6M cash plus stock and assumed options).
- Tests
- LLM apps, AI agents
- Runs as
- SaaS + on-prem
- Price
- Not published
AI red teamingR·34
Alice (formerly ActiveFence) · alice.io
Two red-teaming products: WonderBuild tests models, customer-facing AI apps, agents and agentic workflows against custom policies before launch; WonderCheck repeats automated adversarial tests in production and flags regressions after model updates.
- Owner
- activefence.com now 301-redirects to alice.io and the Alice site footer reads '©2026 ActiveFence'; rebrand date not verified
- Tests
- Models, LLM apps, AI agents
- Runs as
- Vendor platform (WonderSuite); WonderCheck integrates with CI/CD for on-demand and scheduled tests
- Price
- Not published
AI red teamingR·35
Zscaler (SPLX, formerly SplxAI) · zscaler.com
Automated, continuous red-teaming service that fires thousands of simulated attacks at AI models, apps, agent workflows and MCP servers, then hardens the system prompt against what it finds.
- Owner
- Zscaler announced on 3 Nov 2025 that it has acquired SPLX; splx.ai now states 'SPLX is now part of Zscaler'.
- Tests
- Models, LLM apps, AI agents, MCP servers
- Runs as
- SaaS + on-prem
- Price
- Not published