All articles
-
Open Source LLM Security Tools: Licensing and Cost
Open source LLM security testing tools compared on license and self-hosting cost: garak, PyRIT, promptfoo, and Meta's Purple Llama safeguards.
-
Jailbreak Benchmarks: AdvBench, HarmBench, JailbreakBench
How the main jailbreak benchmarks differ: AdvBench, HarmBench, JailbreakBench, and StrongREJECT on behavior sets, scoring, and reported success rates.
-
Payload Splitting and Encoding Jailbreaks Explained
How payload splitting and encoding jailbreaks evade input filters: fragmentation, ciphers, low-resource translation, decomposition, and what still lands.
-
Best AI Red Teaming Tools for LLMs: A Practitioner's Comparison
Compare the best AI red teaming tools for LLMs: Garak, PyRIT, Promptfoo, and Giskard, on probe coverage, CI/CD fit, and OWASP LLM Top 10 mapping.
-
Lethal Trifecta and CaMeL: Containing Agent Injection
The lethal trifecta explains why agents get exfiltrated, and CaMeL shows what containment by construction looks like. Both are architecture, not prompting.
-
Best LLM Guardrail Tools 2026: A Practitioner's Comparison
A technical comparison of the best LLM guardrail tools 2026: NeMo Guardrails, LLM Guard, Lakera, Guardrails AI, and Azure Content Safety, with benchmarks.
-
How LLM Jailbreaks Work: Techniques and Success Rates
A practitioner's breakdown of how LLM jailbreaks work, from roleplay conditioning to multi-turn manipulation, with attack success rates from research.
-
DAN Prompt Jailbreak Explained: How 'Do Anything Now' Works
DAN (Do Anything Now) is the most replicated persona-injection jailbreak in LLM history. Here is the mechanism, why it worked, and how versions evolved.
-
LLM Defense Stack: Guardrails, Tool Scoping, and Egress
Jailbreaks and prompt injection need defenses at different layers. The controls that work for each: guardrail models, action-space limits, and egress control.
-
Why Jailbreaks Work: Competing Objectives and Generalization
Jailbreaks are not a grab-bag of tricks. They exploit two structural failure modes of safety training: competing objectives and mismatched generalization.
-
ArtPrompt Post-Mortem: Why ASCII-Art Bypasses Worked
A walkthrough of the ArtPrompt ASCII-art jailbreak: where it slipped past safety training, how model families patched it, and which encodings still land.
-
Garak in 2026: what it's actually good for, what it isn't
An honest review of NVIDIA's Garak LLM vulnerability scanner: what its probes catch, where the noise is, and where it fits in a real testing pipeline.
-
Indirect Prompt Injection in LLM Agents: Shipped Failures
Tool-using LLM agents amplify every indirect prompt injection vector. A walkthrough of the exploit classes that have landed against production systems.
-
Model Behavior Fingerprinting: Identifying a Wrapped LLM
Before attacking an LLM app you need to know which model is under the hood. A walkthrough of behavioral fingerprinting and what each signal reveals.
-
Multi-Turn Role-Play Attacks: Why One Safe Turn Gets Unsafe
Crescendo, many-shot and gradual context manipulation: how multi-turn jailbreaks evade single-turn classifiers, and what still lands against defenses.
-
Multimodal jailbreaks: image and audio attack surfaces in 2026
Vision and audio inputs are a separate attack channel from text. A survey of the multimodal jailbreaks that still land, from typographic to audio carriers.
-
PAIR vs GCG vs TAP: Which Automated Jailbreak Framework to Run
A practitioner comparison of the automated jailbreak frameworks PAIR, GCG, and TAP: threat model fit, compute cost, transferability, and when to run each.
-
Prompt Injection in IDE Coding Agents: Copilot and Cursor
Coding assistants read everything in your repo and increasingly act on it. A walkthrough of the prompt-injection variants that have shipped against them.
-
Prompt Injection via Retrieved Documents: The RAG Attack Surface
How attacker-controlled content reaches the model through retrieval, the prompt injection variants that still land on production RAG stacks, and the real fixes.
-
Scoping an AI Red-Team Engagement: The Questions That Matter
A working methodology for scoping LLM red-team engagements: the threat-model conversation, surface inventory, success criteria, and the scoping traps.
-
System prompt extraction: the techniques that still leak in 2026
How system prompts get exfiltrated from production LLM apps: direct extraction, indirect inference, behavioral fingerprinting, and what actually works.
-
Jailbreak Technique Catalog: Working as of 2026 Q2
Which jailbreak technique classes still work against current production LLMs, what's been hardened, and the cost-of-attack trend. Indexed for practitioners.