Open-source AI red teaming tools compared

Scanners, frameworks and eval harnesses

“Red teaming tool” covers several kinds of software, and AI red teaming itself covers more than running a scanner. The grouping below is our analysis, based on how each project describes itself.

• Scanners, of which the LLM vulnerability scanner is the best-known kind, run a library of probes against a target and report what they find. They give breadth quickly with little setup.
• Attack frameworks are building blocks for your own campaigns: targets, attacks, converters and scorers that you wire together in code. They give depth and control and take longer to learn.
• Eval harnesses and benchmarks measure model behavior on defined tasks, or compare attacks and defenses under the same conditions. They answer research and regression questions more than “is my app safe”.

Some projects sit between jobs. Promptfoo and Giskard test whole applications, including prompts, retrieval pipelines and agents, and are built to run repeatedly; Agentic Radar reads agent workflow code. OWASP’s GenAI Red Teaming Guide covers four areas: model evaluation, implementation testing, infrastructure assessment and runtime behavior analysis. No open-source tool here covers all four, so expect to combine them. These tools form the open-source half of the testing and red teaming layer in our AI Security Layers model.

How we picked

These are all 16 tools in our red teaming category that are open source under a license we checked at the source. We compile from public repositories and documentation and do not run the tools, so this is not a ranking of attack success. Every license, star count and capability links to the page that states it, with the date we checked. Stars are a count on that date, not a measure of quality, and the grouping into jobs below is our analysis. See our methodology for the Coverage Score, and choosing an AI red teaming platform for commercial options.

Scanners

garak probes for prompt injection Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , probes for jailbreaks Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and probes for data leakage Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release October 16, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 9,636 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for teams that want a free command-line scanner to point at any model or LLM endpoint before release.

Augustus scans a target LLM with a probe library across 47 attack categories and scores replies with detectors Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it runs multi-turn attack strategies named Crescendo, GOAT, Hydra and Mischievous User against the target Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release October 3, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 309 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for teams that want one scanner for single-prompt probes and multi-turn strategies.

Agentic Security scans any LLM HTTP API described by a plain-text request template with a prompt placeholder Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it runs in CI with init, list and ci commands and an agesec.toml configuration file Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release June 3, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 2,024 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for teams that want to replay jailbreak datasets against an HTTP endpoint and gate a build on the failure rate.

promptmap scans custom LLM applications for prompt injection, including distraction rules Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it runs 50+ pre-built rules and has a separate controller LLM judge each response Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the GPL-3.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) and has 1,288 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for developers who want a free command-line scanner to check their own system prompt or HTTP chatbot against prompt injection rules before release.

FuzzyAI finds jailbreaks in LLM APIs by running attack methods against a target model Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it includes built-in attack methods such as PAIR, genetic, many-shot, best-of-n and ArtPrompt Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) and has 1,587 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for security teams and developers who want a free command-line fuzzer to try known jailbreak techniques against an LLM API.

Tools for apps, agents and CI

Promptfoo scans a target automatically across many vulnerability types from one command Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) , and it runs evals on pull requests through a documented GitHub Action Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) and has 26,250 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . On ownership, Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI. OpenAI's developer documentation now says Promptfoo is part of OpenAI; we found no published closing date. Source, checked October 21, 2026: promptfoo.dev · 2026-10-21 (opens in a new tab) Best for developer teams that want one open-source CLI for prompt evals and red teaming, run locally and in CI.

Giskard scans for prompt injection, including a dedicated prompt injection generator and a GCG injection generator Source, checked October 21, 2026: docs.giskard.ai · 2026-10-21 (opens in a new tab) , and it labels scan results with OWASP LLM Top 10 (2025) identifiers such as LLM01 Source, checked October 21, 2026: docs.giskard.ai · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release October 20, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 5,916 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for Python teams that want to scan an LLM agent or RAG app for prompt injection and harmful output, and write pass or fail checks for it.

DeepTeam runs multi-turn attacks such as Sequential Jailbreak and Bad Likert Judge Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it runs from a YAML config with deepteam run, in the CLI or in CI Source, checked October 21, 2026: trydeepteam.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release November 12, 2025 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 3,035 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for Python teams that want single-turn and multi-turn attacks against an LLM app or agent, run from code or a YAML config.

Agentic Radar statically scans workflow code (LangGraph, CrewAI, n8n, OpenAI Agents, AutoGen) and lists agents, tools, MCP servers and known tool vulnerabilities Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Beyond that inventory, its test command sends simulated prompt injection attacks to a workflow (OpenAI Agents only) Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) and has 1,058 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . On ownership, Zscaler announced on November 3, 2025 that it has acquired SPLX, which publishes Agentic Radar. The repository README does not mention Zscaler. Source, checked October 21, 2026: zscaler.com · 2026-10-21 (opens in a new tab) Best for teams that build agents in code and want a map of each workflow’s tools and MCP servers before they attack it. What those agents may reach is the subject of the agent and tool access layer.

Attack frameworks and test kits

PyRIT runs multi-turn attack strategies including Crescendo, TAP and Skeleton Key Source, checked October 21, 2026: microsoft.github.io · 2026-10-21 (opens in a new tab) , and it provides the pyrit_scan command-line scanner, documented for automated single-command runs, and an interactive pyrit_shell Source, checked October 21, 2026: microsoft.github.io · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release September 4, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 4,668 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for security engineers who want a Python framework for multi-turn red teaming runs against models and web apps.

Spikee tests LLMs, guardrails and applications for resistance to prompt injection Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it supports custom targets, plugins, attack scripts, judges and provider modules Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the Apache-2.0 license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) and has 268 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for security teams that want to build and run prompt injection datasets against an LLM app or a guardrail.

Eval harnesses and benchmarks

Inspect ships more than 200 pre-built evaluations that can run against a model Source, checked October 21, 2026: inspect.aisi.org.uk · 2026-10-21 (opens in a new tab) , and it lets you define your own evaluation tasks from a dataset, a solver and a scorer Source, checked October 21, 2026: inspect.aisi.org.uk · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release October 19, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 3,058 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for teams that want a general-purpose framework for their own model and agent evaluations, security ones included.

HarmBench evaluates 18 red teaming methods against 33 target LLMs and defenses in one standardized framework Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) and has 1,076 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for researchers who need a reproducible way to compare attacks and refusal defenses across many models. Check its repository activity on its tool page before you build a pipeline on it.

The b3 benchmark provides crowdsourced attacks from the Gandalf Agent Breaker game, each placed in an AI application context Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its attack types include direct and indirect tool invocation Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) as one evaluation in the UK AI Security Institute’s inspect_evals repository, so it has no star count of its own. Best for teams choosing the model behind an agent who want to compare candidate models; it does not scan your own application. Our guide to prompt injection detection tools also covers it.

Libraries for classic ML models

These two are not LLM scanners. They attack and defend machine learning models in general, which you need if your risk includes image, audio or tabular classifiers, or NLP models that are not chat systems.

The Adversarial Robustness Toolbox provides evasion attacks against machine learning models Source, checked October 21, 2026: adversarial-robustness-toolbox.org · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release July 7, 2025 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 6,283 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . On origin, The project homepage states that IBM moved ART to LF AI in July 2020 and describes it as an LF AI & Data Foundation project. Source, checked October 21, 2026: adversarial-robustness-toolbox.org · 2026-10-21 (opens in a new tab) Best for ML engineers and researchers who need to attack and defend image, audio or tabular models.

TextAttack builds adversarial text attacks from a goal function, constraints, a transformation and a search method Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it generates adversarial examples automatically with built-in attack recipes such as TextFooler Source, checked October 21, 2026: textattack.readthedocs.io · 2026-10-21 (opens in a new tab) . It is released under the MIT license Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , with the latest release August 14, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) and 3,475 GitHub stars as of October 21, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for researchers and ML engineers who want a Python framework to attack, augment data for and train NLP models.

Choosing by use case

Our suggestions, from the descriptions above:

• For a model endpoint before release, start with a scanner such as garak or Augustus, and add FuzzyAI if jailbreaks are the main concern.
• For an app with prompts, retrieval or agents, look at Promptfoo, DeepTeam and Giskard, which are built to re-run as the app changes.
• For agents written in code, Agentic Radar maps the workflow first; its tool page lists the frameworks it reads.
• For prompt injection against an app or a guardrail, Spikee and promptmap focus on that one risk. Our guide to prompt injection detection tools covers the defenses you would test.
• For deeper scripted campaigns, PyRIT gives you components to build and score multi-turn attacks.
• For research and regression questions, Inspect and HarmBench compare models and attacks, and the b3 benchmark compares the models behind agents.
• For classic ML models, the Adversarial Robustness Toolbox and TextAttack cover attacks that LLM scanners do not.

Running red teaming in CI

Automated attack runs pay off when they repeat. This pattern is our analysis and fits any tool that runs non-interactively:

1. Point it at a staging copy you own. Never aim a scanner at a system you lack permission to test.
2. Keep the pull request attack set small and fixed, then run the broad scan on a schedule.
3. Fail the build on findings you agreed to block, and store the report next to the build.
4. Re-run when the prompt, the model or the tools change, since any of them can change behavior.

Promptfoo, DeepTeam and Agentic Security document CI use. For other tools, check the tool page before you plan around CI.

How to choose

The checklist is our analysis.

1. Name the target. Model, app, agent or classic ML model.
2. Pick the job. Scanner for breadth, framework for depth, harness for comparison.
3. Check the license. The table links each license to the file that states it.
4. Check activity. Tool pages show the latest release, repository status and any ownership change.
5. Plan for people. Tools find candidate problems; someone still has to judge impact and fix them. For a vendor-run alternative, see AI red teaming platforms.