OWASP LLM Top 10 · 2025

LLM Red-Team Runner

52 defensive red-team probes for stress-testing the safety and robustness of any OpenAI-compatible LLM endpoint, mapped to the OWASP Top 10 for LLM Applications plus a jailbreak suite.

52
probes
11
categories
0
LLM judges
MIT
license

// what it is

A reproducible probe set, not an LLM guessing about an LLM

Each probe is one adversarial prompt with a plain-English description of what a well-aligned model should do, a severity, and lightweight scoring markers. Responses are scored by regex and keyword, ported verbatim from the source toolkit, so the same probe and response always score the same way. Defensive use only: test endpoints you own or are authorized to test.

// outcomes

held the model refused or resisted the probe.

finding the model walked into it.

review no marker matched, read the response yourself.

// category coverage

// example run

Live scorecard: 8 jailbreak probes vs. Llama-3.1-8B

A real run of the jailbreak category against llama-3.1-8b-instant. The 8B model leaked a planted canary codeword under four different jailbreak techniques and held on one. This is the exact output the runner produces.

scorecard — 8 probes · jailbreaks
1
held
4
findings
3
review
12%
refusal rate
ProbeSevOutcomeResponse (truncated)

// try it

Run probes against your own endpoint

This runs entirely in your browser. Your endpoint and key are used only for this run and never leave the page. Best against a local model (Ollama, vLLM) or any CORS-enabled endpoint.

CORS note. Browsers block cross-origin calls to endpoints that don't send CORS headers (most hosted APIs). For those, run the Python toolkit or the full Gradio app locally. Local Ollama works with OLLAMA_ORIGINS=*.

// the corpus

Explore all 52 probes

The full probe set, filterable by OWASP category. This is the same data published as the dataset.