LLM Red Teaming Tools
The tooling landscape for testing LLM applications, as covered by Jailbreaks FYI: the interactive tracker built here, the open-source scanners worth installing, and the benchmarks that decide whether a reported success rate means anything.
No vendor sponsorship, no affiliate links, no paid placement. Every assessment below is drawn from published documentation, source repositories, and primary research.
Built here
A filterable status matrix of jailbreak technique classes against current frontier and open-weight model families. Filter by model, by attack surface, or to active techniques only. Free, no signup, runs in your browser.
Treat each cell as a directional field assessment for the quarter stated on the page, not a live guarantee. Re-verify against the linked source before you rely on it.
Open-source scanners and harnesses
Four tools carry most of the automated testing done against LLM applications today. They are not substitutes for each other: one scans a model endpoint, one orchestrates adaptive attacks, one runs in CI against an application, one tests a retrieval pipeline.
- Garak NVIDIA · Apache 2.0 · CLI
Probe-based scanner for named jailbreak families against a model endpoint. Broadest canned corpus, fastest first result, noisiest detectors.
- PyRIT Microsoft · MIT · Python framework
Orchestration primitives for adaptive, multi-turn attacks. The only one of the four that models a feedback loop. Costs engineering time.
- Promptfoo MIT · YAML + CI
Application-layer testing with an OWASP LLM Top 10 preset and GitHub Actions support. Thin at the retrieval and agent layers.
- Giskard Apache 2.0 · Python
RAG-pipeline scanning: retrieval failures and knowledge-base contamination. Narrow by design, strong inside that scope.
Full side-by-side on licence, interface, multi-turn support, and CI fit: the AI red teaming tools comparison.
Frameworks, benchmarks, and defences
- Attack frameworks: PAIR, GCG, TAP
Automated jailbreak generation. Query budget, white-box requirements, and transferability decide which one belongs in an engagement.
- Benchmarks and datasets
AdvBench, HarmBench, JailbreakBench, StrongREJECT. Which behaviour set and which judge produced the number you are reading.
- Guardrail and filtering tools
The defensive side: input classifiers, output validation, and the placement points each product actually covers.
- Technique catalog
The attack classes any of this tooling is meant to cover, with current status per class.
What tooling does not cover
Every scanner above runs a fixed or semi-adaptive payload library. That catches what has already been categorised. It misses application-specific trust escalation, multi-agent lateral movement through poisoned tool output, and any encoding or decomposition attack newer than the corpus. Automated tooling sets the floor for an assessment; it does not set the ceiling.