Last updated October 21, 2026. Pricing, ownership, release versions, and attack libraries were checked against vendor pages, GitHub, and package registries on that date.
The best AI red teaming tools for AI agents in 2026 are Promptfoo, Mindgard, Zscaler AI Red Teaming, Repello ARTEMIS, Giskard, PyRIT, garak, and DeepTeam. Pick an open source tool when engineers will run tests in CI, and a commercial platform when security needs continuous attacks, audit evidence, and someone else to maintain the attack library.
AI red teaming tools attack your own AI system the way an adversary would, with prompt injection, jailbreaks, tool abuse, and data exfiltration attempts, and then report what got through. Agents raise the stakes because a successful attack can now call a tool, move money, or leak a customer record instead of producing a bad sentence. Our agent security coverage sits inside the wider AI governance and security hub. Once testing finds gaps, open-source runtime checks such as those in our NeMo Guardrails vs Guardrails AI vs Llama Guard comparison can block the same attacks in production.
We read every vendor page and pricing page on October 21, 2026, and we reviewed the source code of the five open source projects to count which attack modules actually target agents. No vendor paid for placement or reviewed this page, per our editorial standards and disclosure policy.
TL;DR
- Promptfoo is the default open source pick, with a catch. It ships 155 red team plugins, but 22 of its 29 agent-focused plugins call Promptfoo’s hosted generation service, and Promptfoo is now part of OpenAI.
- Mindgard, Zscaler, and Repello lead the commercial field for agents. All three test agents, tools, and MCP servers continuously, and none publishes a price.
- garak and PyRIT are free and model-agnostic. garak 0.17.1 has 191 probes, and PyRIT moved to the microsoft/PyRIT repository after the old Azure repo was archived on March 27, 2026.
- DeepTeam has the largest agent share of its library. 11 of its 36 vulnerability types are labeled Agentic, and it maps tests to the OWASP Top 10 for Agentic Applications.
- Giskard bridges open source and audits. Its v3 scanner can run garak and DeepTeam attacks, and its paid tier adds 50+ probes plus a go or no-go audit report.
AI Red Teaming Tools at a Glance
Choose Promptfoo, garak, PyRIT, or DeepTeam if your engineers can run attacks themselves, and Mindgard, Zscaler, Repello, or Giskard if you want a managed platform or audit. The table compares all eight on the facts buyers check first, from vendor pages, GitHub, and PyPI reviewed on October 21, 2026.
| Tool | Best for | Type | Agent and MCP coverage | Entry price |
|---|---|---|---|---|
| Promptfoo | Agent tests in CI | Open source plus Enterprise | Tool, MCP, memory, and coding agent plugins | Free (10,000 probes a month) |
| Mindgard | Attack-led agent testing | Commercial platform and services | Agents with tools, RAG, MCP servers | Not published |
| Zscaler AI Red Teaming | Zscaler customers | Commercial, part of Zscaler AI Security | Agentic workflows and MCP servers | Not published |
| Repello ARTEMIS | Black-box and browser testing | Commercial platform | Agentic workflows, MCP, chatbots | Free first scan, then quote |
| Giskard | Audits plus open source | Open core | Multi-turn agent attacks | Free library, audits by quote |
| PyRIT | Custom attack code | Open source (MIT) | A2A and MCP tool targets | Free |
| garak | Scanning the underlying model | Open source (Apache 2.0) | Agent Breaker probe, off by default | Free |
| DeepTeam | OWASP agentic mapping | Open source (Apache 2.0) | 11 agentic vulnerability types | Free |
Verdict: No single tool covers every agent risk, so most teams pair one open source tool in CI with periodic deeper testing. Choose Promptfoo or DeepTeam when developers own security tests, PyRIT or garak when a security team writes its own attacks, and a commercial platform when regulators or the board need dated evidence.
What Is AI Red Teaming for AI Agents?
AI red teaming for agents is adversarial testing that tries to make an agent misuse its tools, leak data, or follow injected instructions, before a real attacker does. It goes beyond jailbreaking a chat model, because the target now includes tool permissions, retrieved content, memory, and other agents the system talks to.
The OWASP Top 10 for Agentic Applications lists these risks, and the older OWASP excessive agency entry explains why an agent with broad tool access turns a prompt injection into a real action. Red teaming answers a narrower question than evaluation: our AI agent evaluation tools guide covers whether the agent does its job, and this guide covers whether someone can make it do the wrong one.
How We Ranked These AI Red Teaming Tools
We ranked each tool on how well it tests agents rather than chat models, then on how easy it is to run repeatedly. Every claim below comes from a vendor page, a GitHub repository, or a package registry we opened on October 21, 2026, and the open source counts come from the projects’ own source code.
- Agent coverage: built-in attacks for tool misuse, indirect prompt injection, MCP servers, memory, and multi-agent links.
- Repeatability: CI or API support, so tests run on every release instead of once a quarter.
- Data handling: whether attacks run with your own models or send prompts to the vendor.
- Evidence: reports mapped to OWASP, MITRE ATLAS, NIST AI RMF, or the EU AI Act.
- Cost and ownership: published pricing, license, and recent acquisitions that change who controls the roadmap.
What Our October 21 Source Review Found
Only a minority of each open source attack library targets agents: 19% of Promptfoo plugins, 15% of garak probes, and 31% of DeepTeam vulnerability types, by our count on October 21, 2026. We cloned each default branch and counted modules for tool abuse, indirect injection, MCP, memory, multi-agent links, and coding agents.
- Promptfoo: 29 of 155 plugins target agents, including
mcp,excessive-agency,tool-discovery, and 13 coding agent plugins. 22 of those 29 are remote only, so they need Promptfoo’s hosted generation service. - garak: 29 of 191 probes target agents, mostly 17 latent injection and 8 web injection probes. The multi-turn Agent Breaker probe is off by default.
- PyRIT: release 1.1.0 ships more than 90 prompt converters and a cross-domain prompt injection workflow, but few prebuilt agent attacks. PyRIT’s main branch adds an A2A target and an MCP tool provider (not yet in 1.1.0).
- DeepTeam: 11 of 36 vulnerability types sit in its Agentic category, such as excessive agency, tool metadata poisoning, and insecure inter-agent communication.
- Giskard: its v3 scanner includes adapters that run garak and DeepTeam attacks inside Giskard scenarios.
Teams with a rule that test prompts must never leave their network lose most of Promptfoo agent coverage unless they buy its on-premises edition. Promptfoo’s data handling guide says the PROMPTFOO_DISABLE_REMOTE_GENERATION setting is not a network isolation guarantee, and remote-only plugins stop working when it is on.
1. Promptfoo: Best Open Source Tool for Agent Red Teaming in CI
Promptfoo is an MIT-licensed command line tool and library that generates attacks against your app or agent, grades the responses, and runs in CI. It has 26,241 GitHub stars, and version 0.124.1 shipped on October 8, 2026, per its GitHub repository.
Promptfoo agreed to join OpenAI on March 9, 2026, and its announcement says the project stays open source and keeps supporting other model providers. The same post reports more than 350,000 developers and 130,000 monthly active users.
The free Community plan includes red teaming up to 10,000 probes a month and runs locally, per the pricing page. Enterprise adds continuous monitoring, SSO, and a managed cloud, and On-Premise adds complete data isolation.
- Best for: developer teams that want agent attacks in pull request checks, including MCP and coding agent tests.
- Pricing (October 2026): Community is free with 10,000 probes a month. Enterprise and On-Premise are priced by quote.
- Watch out for: OpenAI now owns the roadmap, and most agent plugins depend on Promptfoo’s hosted generation service.
2. Mindgard: Best for Attack-Led Testing of Agents and MCP Servers
Mindgard is a commercial AI red teaming platform that starts with reconnaissance of your agent, then builds attack chains against the tools and workflows it finds. Its platform page lets buyers scope a test for an agent with tools, an LLM app, a RAG system, an MCP server, or a model endpoint.
Mindgard says it is SOC 2 Type II compliant and runs through APIs, CI/CD pipelines, or Burp Suite. Its expert-led service quotes four to six weeks for a single application, and successful attacks are loaded back into the platform as regression tests.
- Best for: security teams that need proof of exploitable attack paths across agents, tools, and MCP servers.
- Pricing (October 2026): Not published. Pricing is scoped through a demo, and services are quoted per engagement.
- Watch out for: you cannot trial it without a sales call, so budget time for scoping before the first test.
3. Zscaler AI Red Teaming: Best for Zscaler Customers Testing Agentic Workflows
Zscaler AI Red Teaming is the former SPLX platform, which Zscaler acquired on November 3, 2025, and now sells inside Zscaler AI Security. The acquisition release cites more than 5,000 attack simulations, and the product page covers models, applications, agentic workflows, and MCP servers.
Findings feed prompt hardening and Zscaler’s AI Guard runtime policies, so a weakness found in testing can become a block rule in production. SPLX also built Agentic Radar, a free static scanner for agent workflows, but its last release was v0.14.1 on November 27, 2025.
- Best for: companies already on the Zscaler Zero Trust Exchange that want testing and runtime controls from one vendor.
- Pricing (October 2026): Not published. Sold through Zscaler sales as part of its AI Security portfolio.
- Watch out for: the value drops if you do not run Zscaler, and the open source Agentic Radar has not shipped a release in almost 11 months.
4. Repello ARTEMIS: Best for Black-Box Testing Through the Browser
Repello ARTEMIS is a commercial red teaming platform that attacks agents from the outside, through their API or through the same web interface a user sees. Its product page describes threat modeling, parallel attack threads, and multi-stage exploit chains across databases, APIs, tools, and file uploads.
Browser Mode tests text, file, voice, and image inputs across more than 100 languages, and findings map to MITRE, OWASP, NIST, ISO 42001, and the EU AI Act. Repello’s homepage offers a free red teaming scan and a separate product for coding agents such as Claude Code and Cursor.
- Best for: teams that cannot share source code or API specs and want attacks run through the real user interface.
- Pricing (October 2026): Not published beyond a free first scan. Platform pricing is by quote.
- Watch out for: Repello is a younger vendor than the security majors here, so ask for customer references in your industry.
5. Giskard: Best for Teams That Want Open Source Plus an Audit
Giskard is a French company with an Apache 2.0 testing library for agents and a paid service that audits an agent and issues a go or no-go report. Version 3 of the open source library is a rewrite for multi-turn agent testing, needs Python 3.12 or later, and has 5,915 GitHub stars.
The pricing page limits the open source tier to 7 agent risk categories and gives the Professional tier 50+ adversarial probes, SSO, and on-premises or private cloud deployment. Giskard also lists SOC 2 Type II and HIPAA compliance and lets customers keep data in the EU or the US.
- Best for: regulated teams, especially in Europe, that want a third party to test and sign off on an agent.
- Pricing (October 2026): Open source is free. Professional audits are quoted after a scoping call.
- Watch out for: Giskard v2 is no longer maintained, so older scan code needs migration to v3.
6. PyRIT: Best Framework for Security Teams Writing Custom Attacks
PyRIT, the Python Risk Identification Tool from Microsoft, is an MIT-licensed framework for scripting multi-turn attacks such as Crescendo, PAIR, and Tree of Attacks against any AI target. Version 1.1.0 shipped on September 4, 2026, and the microsoft/PyRIT repository has 4,667 stars.
PyRIT moved from the Azure organization, and the old Azure/PyRIT repository was archived on March 27, 2026, so update any pinned Git URLs. Microsoft’s Foundry AI Red Teaming Agent uses PyRIT under the hood, which suits teams that want the same attacks in a managed console.
- Best for: security engineers who want full control over attack logic. PyRIT’s main branch adds an A2A target and an MCP tool provider (not yet in 1.1.0).
- Pricing (October 2026): Free. You pay only for the models used to generate and score attacks.
- Watch out for: PyRIT is a framework rather than a scanner, so expect to write Python before the first useful report.
7. garak: Best Free Scanner for the Model Behind Your Agent
garak is NVIDIA’s Apache 2.0 vulnerability scanner for large language models, with 191 probes, 117 detectors, and 44 model connectors in version 0.17.1. That release shipped on October 16, 2026, and the repository has 9,636 stars.
garak is strongest on the model and prompt layer, with 17 latent injection probes that hide instructions in documents an agent might read. Its Agent Breaker probe attacks tool-using agents over many turns, but it is off by default and calls a separate red team model, NVIDIA NIM’s gpt-oss-120b unless you change it. The garak site links the user guide and research paper.
- Best for: teams that want a free, scriptable scan of the model and prompts before testing agent workflows.
- Pricing (October 2026): Free under Apache 2.0.
- Watch out for: most probes test the model rather than tool calls, so pair garak with an agent-aware tool.
8. DeepTeam: Best for Mapping Agent Tests to the OWASP Agentic Top 10
DeepTeam is an Apache 2.0 red teaming framework from Confident AI, the company behind DeepEval, with 36 vulnerability types, 11 of them labeled Agentic. Version 1.0.10 reached PyPI on October 16, 2026, and the repository has 3,034 stars.
DeepTeam ships 22 single-turn and 6 multi-turn attack methods and framework presets for OWASP, the OWASP agentic list, NIST AI RMF, MITRE ATLAS, and the EU AI Act, per its site. Confident AI sells its own red teaming module only in an Enterprise tier above its $2,000 a month Team plan, per its pricing page.
- Best for: Python teams that want OWASP agentic coverage from a short script and already use DeepEval.
- Pricing (October 2026): Free under Apache 2.0. Confident AI’s hosted red teaming module is priced by quote.
- Watch out for: the GitHub releases page still shows v1.0.9 from November 2025, so install from PyPI to get current fixes.
Run a First Agent Red Team With Promptfoo
A first agent red team takes one config file and one command: describe what the agent may do, point Promptfoo at its endpoint, and pick agent plugins. The config below uses only the seven agent-focused plugins that work with remote generation turned off, plus a local Ollama model as the attacker.
# promptfooconfig.yaml
description: Support agent red team
targets:
- id: https
label: support-agent
config:
url: https://staging.example.com/api/agent
method: POST
headers:
Content-Type: application/json
body:
message: '{{prompt}}'
redteam:
purpose: >-
Customer support agent for signed-in shoppers. It can look up the
user's own orders and issue refunds up to $50. It must never reveal
other customers' data or run shell commands.
provider: ollama:chat:llama3.3
numTests: 5
plugins:
- excessive-agency
- tool-discovery
- rbac
- cross-session-leak
- debug-access
- shell-injection
- sql-injection
strategies:
- basic
# then run:
# export PROMPTFOO_DISABLE_REMOTE_GENERATION=true
# npx promptfoo@latest redteam runPoint the target at a staging copy of the agent, since attacks will try real refunds and lookups. Add mcp or indirect-prompt-injection once your policy allows Promptfoo’s hosted generation, and see our AI agent testing tools guide for functional tests that belong in the same pipeline.
Open Source AI Red Teaming Tools by the Numbers
All five open source tools shipped a release within the last seven weeks, but they differ in license, runtime, and who controls the roadmap. The table lists what GitHub, PyPI, and npm showed on October 21, 2026, so check again before you pin a version in CI.
| Tool | License | Latest release | GitHub stars | Runtime | Maintainer |
|---|---|---|---|---|---|
| Promptfoo | MIT | 0.124.1, October 8, 2026 | 26,241 | Node.js CLI | Promptfoo, part of OpenAI |
| garak | Apache 2.0 | 0.17.1, October 16, 2026 | 9,636 | Python 3.11+ | NVIDIA and community |
| Giskard | Apache 2.0 | 3.0.1, October 2, 2026 | 5,915 | Python 3.12+ | Giskard AI |
| PyRIT | MIT | 1.1.0, September 4, 2026 | 4,667 | Python 3.10 to 3.14 | Microsoft |
| DeepTeam | Apache 2.0 | 1.0.10, October 16, 2026 | 3,034 | Python 3.9 to 3.13 | Confident AI |
Verdict: Promptfoo has the largest community and the only Node.js runtime, which suits web teams. garak and PyRIT carry the backing of NVIDIA and Microsoft, and DeepTeam and Giskard are smaller vendor-led projects that move fast on agent attacks.
Commercial AI Red Teaming Platforms Compared
The commercial platforms differ most in how they reach your agent: Mindgard and Zscaler connect through APIs and CI, Repello can also drive the user interface, and Giskard pairs software with human auditors. The table uses vendor pages checked on October 21, 2026.
| Platform | How it tests | Agent and MCP scope | Framework mapping | Published price |
|---|---|---|---|---|
| Mindgard | Reconnaissance, then adaptive attack chains | Agents with tools, RAG, MCP servers | OWASP, MITRE ATLAS, NIST AI RMF, EU AI Act | No |
| Zscaler AI Red Teaming | 5,000+ simulated attacks, run continuously | Agentic workflows, MCP servers | Recognized AI risk frameworks | No |
| Repello ARTEMIS | API and Browser Mode, multi-stage chains | Agentic workflows, MCP, chatbots | MITRE, OWASP, NIST, ISO 42001, EU AI Act | Free first scan only |
| Giskard Professional | 50+ probes plus expert audit | Agents through any API | OWASP and other agent risk frameworks | No |
| Promptfoo Enterprise | Hosted or on-premises Promptfoo | Same plugins as open source, custom limits | Compliance framework scans | No |
Verdict: Choose Mindgard when you need proof of exploitable attack paths, Zscaler when you want results to become runtime policy on a network you already run, and Repello when the only reliable way into the agent is its user interface. Giskard fits teams that want a signed audit report, and Promptfoo Enterprise fits teams that already run the open source tool.
AI Red Teaming Tools We Left Off
Several strong products fell outside this list because red teaming is one module inside a broader AI security platform, or because another AgentStack guide covers them better. Each is worth a look if you already buy from that vendor and want testing on the same contract.
- HiddenLayer: sells red teaming next to model scanning and runtime guardrails, per its site. It fits buyers who want one AI security suite.
- Check Point AI Red Teaming: formerly Lakera Red, it tests models, applications, and agents for prompt injection, jailbreaks, and data leakage.
- Palo Alto Networks Prisma AIRS: includes an AI Red Teaming module for agents and applications inside its AI security platform.
- MCP-specific scanners: tools that inspect MCP server code and tool definitions are covered in our MCP security tools guide.
When an AI Red Teaming Tool Is the Wrong Fix
Red teaming finds weaknesses, but it does not remove an agent permission that should never have existed. If an agent can delete records or send payments, cut that tool scope first, because no test suite proves an over-privileged agent is safe.
Red teaming also does not replace runtime controls or incident response. Put an MCP gateway or a policy layer in front of tool calls, and plan for containment using the NIST, NSA, and CISA practices for rogue agents. Recent incidents such as the ToFu findings in 118 MCP servers and the FastMCP client RCE advisories came from code flaws that a dependency scan catches faster than a prompt attack.
Which AI Red Teaming Tool Should You Choose?
The right tool depends on who will run the tests, whether prompts may leave your network, and what evidence you need at the end. Match your team to a profile below, then run one tool against a staging copy of a real agent before you commit.
Developer teams shipping agents weekly
- Start with Promptfoo in CI, using the local plugins if data must stay in your network.
- Add DeepTeam if you want OWASP agentic presets in Python.
- Keep functional tests separate, using our AI agent testing tools guide.
Security teams building an internal red team
- Use PyRIT for custom multi-turn attacks and garak for broad model scans.
- Script both against staging agents on a schedule and keep the transcripts.
- Track new attack patterns, such as those in our report on coding agents disabling monitoring.
Regulated enterprises that need audit evidence
- Shortlist Mindgard or Giskard for reports mapped to the EU AI Act and NIST AI RMF.
- Ask each vendor for a scoped quote, a sample report, and retest terms.
- Map findings to your controls with our governance and compliance coverage.
Companies standardized on one security vendor
- Use Zscaler AI Red Teaming if you run Zscaler, so findings become runtime policy.
- Compare Check Point and Prisma AIRS modules if those vendors already protect your network.
- Read our Microsoft Dynamic Agent Risk report if Microsoft security tools run your stack.
Frequently Asked Questions
What is the best free AI red teaming tool?
Promptfoo is the best free starting point for most teams because it runs from one config file, works in CI, and includes agent plugins for tool misuse and MCP. Its free Community plan allows 10,000 probes a month. garak, PyRIT, and DeepTeam are fully free alternatives for teams comfortable working in Python.
How often should you red team an AI agent?
Red team an AI agent before launch and again whenever its model, system prompt, tools, or permissions change. Teams shipping weekly usually run a small automated suite in CI on every release and a deeper manual or commercial assessment each quarter, because new attack techniques appear between releases.
Is Promptfoo still open source after the OpenAI deal?
Yes. Promptfoo says it remains open source under the MIT license after agreeing to join OpenAI on March 9, 2026, and that it keeps supporting other model providers. Its paid Enterprise and On-Premise plans continue, and version 0.124.1 shipped on October 8, 2026, so development has not stopped.
Can AI red teaming tools test MCP servers?
Yes, several can. Promptfoo has an mcp plugin, PyRIT’s main branch adds an MCP tool provider (not yet in 1.1.0), and Mindgard, Zscaler, and Repello list MCP servers in their scope. For scanning MCP server code and tool definitions without attacking a live agent, a dedicated MCP security scanner is usually faster.
Do AI red teaming tools send my prompts to a third party?
The answer varies by tool and settings. garak, PyRIT, and DeepTeam use the models you configure, so data goes only where you send it. Promptfoo’s remote-only plugins use its hosted generation service, and commercial platforms process test traffic in their own cloud unless you buy an on-premises option.
Related Guides
Red teaming finds the weak spots, and scanning keeps unsafe models out of production. Our Protect AI alternatives guide compares eight tools for that second layer of model and agent security.
Already narrowed the list to the open-source options? Our Promptfoo vs garak vs PyRIT comparison runs all three offline and compares agent attack coverage, scoring, data handling, and install size.
For related coverage, see our AI agent security tools, AI guardrails tools, Lakera alternatives and Lakera vs HiddenLayer vs Mindgard.
Read the agent security hub, AI governance and security hub, governance and compliance coverage, MCP security tools, MintMCP vs Runlayer vs Lasso, MCP gateways, AI agent testing tools, AI agent evaluation tools, ToFu MCP tool security bugs, FastMCP security advisories, NIST and CISA incident response practices, Anthropic evals and overstepping agents, and AI agent frameworks. Notes on how we work sit on editorial standards, disclosure, and contact.
The Bottom Line
Start with a free tool such as Promptfoo or DeepTeam in CI, add PyRIT or garak when your security team wants custom attacks, and buy Mindgard, Zscaler, Repello, or a Giskard audit when you need continuous testing or signed evidence. Whatever you choose, test a staging copy of the real agent with its real tools.
Attack libraries change monthly, so rerun your suite after every model or tool change and check this page for updates. Send corrections or tool suggestions through our contact page.