Which open-source AI red teaming tools are worth using?

Four are worth the setup cost, and they cover different layers:

• NVIDIA Garak is the broadest probe library and the easiest starting point for model-level scanning

• Microsoft PyRIT is the framework for building automated multi-turn attacks and orchestrating them at scale

• Promptfoo handles evaluation and red teaming inside CI, which makes it the practical choice for regression testing

• UK AI Safety Institute's Inspect is the strongest for structured evaluation with reproducible scoring

Garak is where most teams should begin. It ships hundreds of probes across jailbreak, encoding, toxicity, and data leakage, runs against most providers, and produces a baseline in an afternoon. Its weakness is that it is single-turn and model-focused.

PyRIT covers the gap. It is a framework rather than a scanner, which means more work to configure and far more capability, particularly for multi-turn escalation strategies where the attack builds across a conversation.

Promptfoo earns its place through CI integration. Red teaming that does not run automatically on deploy stops running within two months. Meta's LlamaFirewall and Llama Guard are worth adding on the defensive side, useful as testable components rather than as attack tooling.

The gap across all of them is the same: they test models, not agents. None natively evaluates whether an injected instruction caused an unauthorized tool call, which is the failure that carries real-world consequence.

Akto's red teaming covers that agentic layer, testing trajectories and tool misuse against production agent configurations rather than model responses in isolation.

Start with Garak this week. Add trajectory testing before your first agent reaches production.