AI Red Team Workbench ◆
LLM · RAG · Agentic · Web/API · Platform
OWASP LLM Top 10 (2025/26) · Agentic ASI01–10 (2026)No engagement
Methodology

A layered red-team methodology for AI systems

This workbench turns the OWASP LLM Top 10 and OWASP Top 10 for Agentic Applications into a runnable engagement: pick tests from the library, record results against an authorized target, promote failures to findings, and export a report. Everything is local to your browser — no data leaves this page.

Rules of Engagement Define an authorized scope before running any test.

The engagement lifecycle

  1. Authorize & scope. Written ROE, target inventory, allowed techniques, data-handling, kill-switch, off-hours. AI systems can take real actions — scope the blast radius, not just the endpoint.
  2. Reconnaissance. Map the surface: model(s), system prompt reachability, RAG corpus + retrieval, tool/function inventory, agent graph, MCP servers, identities/tokens, hosting.
  3. Threat-model per layer. For each layer below, enumerate what an attacker gains and what the blast radius is if a control fails.
  4. Automated breadth. Run scanners (garak, Promptfoo, DeepTeam) for coverage across known vuln classes.
  5. Manual depth. Multi-turn (crescendo/TAP), indirect injection via RAG/observation, tool-abuse chains, authz/tenant isolation — the things scanners miss.
  6. Score & triage. Rate impact × exploitability; record evidence; promote fails to findings.
  7. Report & retest. Deliver, remediate, regression-test on every model/prompt/tool change.

What makes AI different

  • The instruction and the data share a channel. Anything the model reads — a prompt, a retrieved doc, a web page, a tool result — can act as instructions. Injection is the root cause behind most of the list.
  • Non-determinism. A test that passes once can fail on retry. Run each probe N times; report the failure rate, not a single verdict.
  • Blast radius = every tool, credential, and API the agent can reach. A chatbot wastes time; an agent deletes a database (Replit, 2025) or exfiltrates zero-click (EchoLeak / CVE-2025-32711).
  • Multi-step compounding. One early injection biases an entire plan across many turns.
  • The model is not the system. Most real findings live in output handling, authorization, retrieval access control, and tool design — classic appsec, re-skinned.
Authorization is non-negotiable. Only test systems you own or are contracted to assess, within written scope. Prefer staging/replica environments for any destructive or state-changing test.

The five layers this tool covers

How to drive the tool: Browse Attack Surface for the map → pull tests from the Test Library into your Test Run → mark fails, which populate Findings → generate a deliverable in Report / Export. The Tooling tab maps open-source scanners to each layer.
Threat map

Attack surface by layer

Each layer lists the risk categories, their OWASP mapping, and the number of library tests that exercise them. Click a category to jump to its tests.

Catalog

Test library

Representative, technique-level test cases across all five layers. Each carries an objective, a procedure, an illustrative probe, the expected secure behavior, and severity guidance. Add tests to your run to track results.

Engagement

Test run

Scope & rules of engagement

Results

Findings

Every failed or partially-failed test becomes a finding. Set status and remediation as you work the engagement. These flow straight into the report.

Stack

Open-source & commercial tooling

No single tool covers the surface. The professional pattern in 2026: scanners for breadth in CI/CD, an orchestration framework for multi-turn depth, plus classic web/appsec tooling and manual review for authz, tenant isolation, and tool-abuse chains.

Recommended baseline stack: garak (broad model probes) + Promptfoo (CI/CD regression, OWASP-LLM preset) + PyRIT or DeepTeam (multi-turn / agentic) + Burp Suite (the underlying web/API app) + manual review for identity, retrieval access control, and MCP supply chain.
Install these into an isolated venv/container on assets you're authorized to test. Pin versions — payload corpora and presets change frequently, and Promptfoo/PyRIT both changed hands/repos in 2026.
Deliverable

Report / export

Generate a findings report from the current run, or export/import the whole engagement as JSON for portability and backup.

Report preview

AI Red Team Workbench · single-file, offline, browser-local · petrol/amber house build · references: OWASP GenAI Security Project (LLM Top 10 2025/2026, Top 10 for Agentic Applications 2026), MITRE ATLAS. Test only what you are authorized to test.