The best AI red teaming tools in 2026: 16 compared
Last updated November 9, 2026. Facts come from each project's own repo, docs and announcements; GitHub stars, licenses and release dates were read from the GitHub API on November 9, 2026 (release dates are GitHub's UTC dates). No lab results yet: this is a fact comparison, not a ranking by test score.
Short answer: there is no single best AI red teaming tool. Pick by what you are testing and who will run it.
- You want one open-source tool for evals and red teaming of an LLM app or agent, run in CI: Promptfoo (MIT, about 27,000 GitHub stars, latest release 0.125.1 on Oct 25, 2026). Promptfoo is now part of OpenAI; the open-source Community edition is free up to 10k probes a month.
- You want a broad vulnerability scanner that probes a model for jailbreaks, injection and leakage: NVIDIA garak (Apache-2.0, about 10,000 stars, v0.17.1 on Oct 16, 2026).
- You want a Python framework your red team can script multi-turn attacks with: Microsoft PyRIT (MIT, about 4,800 stars, v1.1.0 on Sep 4, 2026).
- You want to red team AI agents and also scan MCP servers, agent skills and AI infrastructure for CVEs: Tencent A.I.G (AI-Infra-Guard, Apache-2.0, about 7,400 stars, v4.6.9 on Nov 5, 2026). Do not expose its web platform publicly; the project says it has no authentication.
- You want to test prompt-injection attacks and defenses on agents with a research benchmark: AgentDojo from ETH Zurich (MIT). For general LLM and agent evaluations, Inspect from the UK AI Security Institute (MIT, release 0.3.288 on Nov 7, 2026).
- You want a managed platform with continuous red teaming for agents: commercial options include Mindgard, SPLX (Zscaler), Adversa AI, Gray Swan, Enkrypt AI (Anaconda) and Dreadnode (CrowdStrike deal announced, not yet closed). Only Enkrypt AI publishes prices: free Explore plan, Launch $149 a month, Scale $1,499 a month.
Open-source red teaming tools
| Tool | License | GitHub stars (Nov 9) | Latest release (GitHub) | Last commit | Best fit |
|---|---|---|---|---|---|
| Promptfoo | MIT | 26,998 | 0.125.1, Oct 25, 2026 | Nov 9, 2026 | Evals plus red teaming of LLM apps in CI |
| garak | Apache-2.0 | 9,967 | v0.17.1, Oct 16, 2026 | Nov 6, 2026 | Scanning a model for jailbreaks, injection and leakage |
| A.I.G (Tencent AI-Infra-Guard) | Apache-2.0 | 7,447 | v4.6.9, Nov 5, 2026 | Nov 5, 2026 | Agent red teaming plus MCP, skill and AI-infrastructure scans |
| Giskard | Apache-2.0 | 5,947 | giskard-agents v1.0.6, Oct 25, 2026 | Nov 9, 2026 | Open-source testing library, with a commercial red-teaming platform |
| PyRIT | MIT | 4,777 | v1.1.0, Sep 4, 2026 | Nov 9, 2026 | Scripted, multi-turn red teaming by a security team |
| Inspect | MIT | 3,209 | 0.3.288, Nov 7, 2026 | Nov 9, 2026 | LLM and agent evaluations |
| DeepTeam | Apache-2.0 | 3,093 | v1.0.9, Nov 12, 2025 | Oct 23, 2026 | Red teaming LLMs and agents from Python |
| FuzzyAI | Apache-2.0 | 1,603 | none published | Feb 6, 2026 | Fuzzing LLM APIs for jailbreaks |
| promptmap | GPL-3.0 | 1,294 | none published | Dec 1, 2025 | Prompt-injection scan of one custom LLM app |
| AgentDojo | MIT | 1,008 | v0.1.35, Oct 27, 2025 | Jun 2, 2026 | Benchmarking prompt-injection attacks and defenses on agents |
Commercial AI red teaming platforms
| Platform | Owner | Published pricing | What it covers |
|---|---|---|---|
| Mindgard | Mindgard | Not published | Discovers, assesses and red teams AI models, agents and applications |
| SPLX | Zscaler (acquisition announced Nov 3, 2025) | Not published | Security testing and red teaming for AI assistants and agents |
| Adversa AI | Adversa AI | Not published | Red teaming plus runtime protection for agents, including coding agents |
| Gray Swan | Gray Swan | Not published | Shade for continuous testing, Cygnal for runtime protection, public Arena |
| Enkrypt AI | Anaconda (acquisition announced Aug 4, 2026) | Free Explore; Launch $149/mo; Scale $1,499/mo; Enterprise custom | Agent red teaming, guardrails, policy engine, MCP gateway and scanner |
| Dreadnode | CrowdStrike (definitive agreement Nov 3, 2026; not yet closed) | Enterprise plan by quote | 70+ attack strategies, 600+ transforms, 130+ scorers, from ML models to multi-agent systems |
What to look for in an AI red teaming tool
Red teaming an AI agent is not the same as red teaming a model. When you compare tools, check five things: whether it can attack your real application over HTTP or an SDK (not just a bare model), whether it covers indirect prompt injection through tools, documents and web pages, whether it can drive multi-turn conversations, whether results map to a framework your auditors know (such as OWASP's LLM and agentic top 10 lists), and whether it can run on every release in CI instead of once a year.
Tool by tool
Promptfoo. Open-source CLI and platform for evals, red teaming and vulnerability scanning of LLM apps. OpenAI announced it would acquire Promptfoo on Mar 9, 2026, and the project's README now says Promptfoo is part of OpenAI. Community edition is free (up to 10k probes a month); Enterprise is custom-priced. Full listing
garak. NVIDIA's LLM vulnerability scanner that probes models for jailbreaks, prompt injection, data leakage and more. Full listing
A.I.G (Tencent AI-Infra-Guard). Open-source red teaming platform from Tencent Zhuque Lab that scans AI infrastructure for known CVEs, audits MCP servers and agent skills, red teams agents and runs LLM jailbreak evaluations. The scanners also install on their own with pip. The project warns that the web platform has no authentication and should not be exposed on public networks. Full listing
Giskard. Continuous red teaming for AI agents, plus an open-source testing library (giskard-oss, Apache-2.0). Full listing
PyRIT. Microsoft's Python Risk Identification Tool for red teaming generative AI systems. Full listing
Inspect. Open-source framework for LLM and agent evaluations from the UK AI Security Institute. It is an evaluation framework rather than an attack tool: use it to build your own security evals. Full listing
DeepTeam. Open-source framework from Confident AI to red team LLMs and AI agents. Its last tagged release is from November 2025, though the repo still gets commits. Full listing
FuzzyAI. CyberArk's automated fuzzing tool for finding jailbreaks in LLM APIs. CyberArk is now part of Palo Alto Networks; the repo has had no commit since Feb 6, 2026. Full listing
promptmap. Automated prompt-injection scanner for custom LLM apps (the promptmap2 rewrite), with white-box tests against a system prompt and black-box tests against an HTTP endpoint, using 50+ YAML rules. GPL-3.0, so check the license before you bundle it. No commit since Dec 1, 2025. Full listing
AgentDojo. Research benchmark from ETH Zurich's SPY Lab for evaluating prompt-injection attacks and defenses on LLM agents. Use it to compare defenses, not to test your own production app. Full listing
Commercial platforms. Mindgard, SPLX, Adversa AI, Gray Swan, Enkrypt AI and Dreadnode sell managed red teaming. Three of the six have announced sales to larger companies (SPLX to Zscaler, Enkrypt AI to Anaconda, Dreadnode to CrowdStrike). Gray Swan also runs the public Arena red-teaming platform, relaunched Oct 20, 2026 with a $300K indirect prompt-injection challenge.
After the red team: what fixes the findings
Red teaming finds the holes; something else has to close them. For runtime defenses against prompt injection, see Lakera Guard alternatives: 10 prompt-injection guardrails compared. For MCP servers your agents connect to, see MCP security scanners compared. See every tool in AI red teaming & evals, or download the open data.
Frequently asked questions
What is the best free AI red teaming tool?
All ten open-source tools on this page are free. For red teaming a whole LLM app or agent in CI, Promptfoo. For scanning a model for jailbreaks and leakage, garak. For scripted multi-turn attacks, PyRIT.
Is red teaming the same as a guardrail?
No. Red teaming tools attack your app before release to find weaknesses; guardrails such as those in Lakera Guard alternatives screen traffic at runtime. Most teams need both.
Which AI red teaming tools have changed owners?
Promptfoo is now part of OpenAI. SPLX (Zscaler), Enkrypt AI (Anaconda) and Dreadnode (CrowdStrike, not yet closed) have announced acquisitions, and FuzzyAI comes from CyberArk, now part of Palo Alto Networks.
Has Agent Security Index tested these?
Not yet. No lab results have been published. This page compares verified facts only.
Sources checked on November 9, 2026
- GitHub API (repo, latest release and tags), read Nov 9, 2026: https://github.com/promptfoo/promptfoo, https://github.com/NVIDIA/garak, https://github.com/Tencent/AI-Infra-Guard, https://github.com/Giskard-AI/giskard-oss, https://github.com/microsoft/PyRIT, https://github.com/UKGovernmentBEIS/inspect_ai, https://github.com/confident-ai/deepteam, https://github.com/cyberark/FuzzyAI, https://github.com/utkusen/promptmap, https://github.com/ethz-spylab/agentdojo
- Promptfoo: https://www.promptfoo.dev/pricing/ and https://www.promptfoo.dev/blog/promptfoo-joining-openai/
- A.I.G: https://github.com/Tencent/AI-Infra-Guard/releases/tag/v4.6.9
- Gray Swan: https://www.grayswan.ai/ (checked Nov 9, 2026) and the Oct 20, 2026 Arena announcement on GlobeNewswire
- Enkrypt AI: https://www.enkryptai.com/pricing and https://www.anaconda.com/blog/anaconda-acquires-enkrypt-ai
- Dreadnode: https://dreadnode.io/pricing and https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-dreadnode-advance-ai-trust/
- SPLX: https://www.zscaler.com/press/zscaler-secures-enterprise-ai-lifecycle-acquisition-innovative-ai-security-pioneer-splx
- FuzzyAI: https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-cyberark-to-secure-the-ai-era/
- Each linked tool page lists its own sources and last verified date.