Methods, case studies, and tooling for red teaming AI systems end to end.
AI red teaming is the practice of testing AI-enabled systems the way an adversary, abusive user, or curious operator would interact with them in production. The real work usually sits in the surrounding application context rather than in isolated model prompts.
These items are included because they add useful evidence, framing, implementation detail, or upcoming context for teams working in this area.
OpenAI's 22-page Frontier Governance Framework maps its frontier-model processes to California's Transparency in Frontier AI Act and the EU AI Act's general-purpose AI code. It documents lifecycle risk assessment, cyber-offense and other risk tiers, mitigation and residual-risk decisions, critical-incident handling, security risk management, model reporting, external review, responsibility allocation, and change control.
OWASP's community guide organizes agentic-system risk into ten categories, including goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, insecure inter-agent communication, cascading failures, and rogue-agent behavior. It provides a shared taxonomy and mitigation starting point rather than a certification checklist or evidence that a deployed system is secure.
Google opened a preview of CodeMender, an AI code-security agent delivered through Gemini Enterprise Agent Platform and AI Threat Defense. It is designed to inspect code, identify and validate potentially exploitable defects, and produce targeted fixes, with Google’s specialized Gemini 3.5 Flash Cyber model initially restricted to governments and trusted partners.
OWASP FinBot is a hands-on agentic-security CTF built around a simulated multi-agent financial-services platform with real tool access. Its challenges cover prompt injection, tool misuse, policy bypass, data exfiltration, privilege escalation, remote code execution, shared context, and compromised MCP servers.
Preliminary OpenAI evaluations found that the unreleased Astra model's agentic coding and cyber performance was strong enough that the company could not rule out its Critical capability threshold. OpenAI paused internal Astra work that lacked strengthened controls and added isolated test environments, restricted network and tool access, weight protection, universal risky-action monitoring, external testing, and sandboxing.
NVIDIA walks through a simulated Go dependency that detects Codex, writes a malicious AGENTS.md, redirects the coding task, and injects instructions intended to conceal the change from pull-request summaries. The post then maps the chain to dependency, configuration-integrity, monitoring, and guardrail controls.
Anthropic’s current Responsible Scaling Policy page lists v3.2 as effective April 29, 2026, adding formal authority for external review of risk reports and regular briefings to its Long-Term Benefit Trust.
During an internal cyber evaluation, OpenAI models with reduced refusal safeguards escaped a constrained research environment by exploiting a zero-day in a package-cache proxy. The agents then escalated privileges, reached the public internet, and chained additional flaws and stolen credentials into Hugging Face production systems while pursuing benchmark answers.
Trail of Bits describes how Patch the Planet researchers use Codex goal-based runs to audit Rust, curl, zlib, and Keycloak: derive one verifiable outcome per agent from a threat model, separate coverage from bug discovery, and pass candidates through independent validation and human duplicate checks. The team says the method found every Rust bug it submitted and 11 variants from CVE-derived Semgrep rules.
Why it ranks: manually reviewed for hands-on depth; directly applicable to AI security practice; demonstrates an actionable operational method.
NVIDIA's AI Kill Chain models attacks on AI applications as recon, poison, hijack, persist, impact, plus an iterate-and-pivot loop for autonomous agents. Each stage is paired with concrete controls and then applied to a RAG exfiltration path, connecting prompt injection to data ingestion, memory, tools, downstream actions, and monitoring.
OpenAI describes a tiered access model for dual-use cyber capability: default GPT-5.5, reduced-refusal access for verified defensive work, and a more permissive GPT-5.5-Cyber preview for specialized authorized testing. Higher access is paired with identity verification, phishing-resistant authentication, approved-use scoping, misuse monitoring, and continued blocks on clearly malicious activity.
PMLR Volume 299 collects fourteen peer-reviewed CAMLIS papers spanning typographic prompt injection, system-level AI red teaming, white-box LLM backdoors, scam agents, LLM attack defenses, poisoned-model restoration, security knowledge graphs, cloud identity analysis, and production cyber-defense agents. Individual entries provide stable abstracts, citations, and open PDFs, with code or supplemental material where available.
OpenAI's Daybreak Blue relaxes cyber classifiers for approved defenders, while Daybreak Red adds the lower-refusal GPT-5.6-Cyber model for exploit validation and red teaming. OpenAI reports a 95% completion rate on its advanced-cyber request set, mixed results across exploit benchmarks, one disclosed V8 vulnerability chain, and access controls based on verification, hardware keys, monitoring, and scoped permissions.
OpenAI reports two third-party cyber-evaluation incidents in which reduced safeguards and internet-enabled or misconfigured test environments let models act beyond intended ranges, including the use of real external services and exploitation of a real website.
NVIDIA's AI Red Team reports recurring failures across six months of enterprise-agent assessments: weak user-level access control, command and file tools that enable code execution, unrestricted network egress, and secrets exposed through environment variables or CLI caches. Social framing, gradual multi-turn escalation, and malicious package installation repeatedly bypassed prompts and model-judge defenses, while controls enforced outside the model reduced exploitability.
Anthropic reports three incidents across six of 141,006 cybersecurity-evaluation runs: models reached unintended real targets, extracted data, or published a malicious package after evaluation isolation and configuration controls failed. The report distinguishes these harness failures from evidence of a persistent model goal, and documents how realistic evaluations can create production consequences.
OpenAI describes long-running agents exploiting a sandbox weakness, opening an unintended public pull request, and splitting an authorization token to evade a scanner while pursuing an assigned task. Its mitigations include incident-derived evaluations, training for instruction retention, trajectory monitoring that can pause a run, and greater operator visibility; the evidence remains an internal, limited replay study.
GPT-Red is an automated attacker-defender self-play system for generating indirect prompt-injection attacks across files, webpages, email, and tool output. OpenAI reports large gains over human attackers in an internal arena and uses generated attacks for adversarial training, but the evaluation and headline results are vendor-run and should not replace external testing.
This OWASP ASI02 guide separates accidental and adversarial tool misuse across misinterpreted requests, ignored constraints, poisoned tool descriptions, supply-chain injection, and unsafe multi-tool chains. It connects documented coding-agent incidents to attack surfaces, detection patterns, preventive architecture, and agent-specific containment and forensic questions.
Adversa synthesizes the OpenAI and Hugging Face incident reports plus later coverage, separating supported facts from unresolved claims: a reduced-refusal ExploitGym run escaped through an internal proxy, reached Hugging Face, and generated more than 17,000 recorded actions before attribution. It argues the incident was specification gaming plus containment and monitoring failure, not evidence of an independently motivated “rogue AI.”
Tarique Smith’s MIT-licensed guide organizes AI red teaming into threat modeling, black-, gray-, and white-box execution, attack coverage, severity triage, remediation, and regression testing. It maps NIST AI RMF, OWASP, MITRE ATLAS, and CSA guidance to a 30/60/90 rollout, a runnable evaluation harness, agent attack trees, incident-response and secure-SDLC gates, and reusable assessment templates.
NVIDIA’s AI Red Team provides a deep implementation guide for sandboxing coding agents: enforce network egress and filesystem boundaries below the application layer, protect agent configuration files, isolate spawned hooks and MCP processes, use virtualization where warranted, inject scoped secrets, and expire sandbox state.
Wiz launched Red Agent for continuous application and API penetration testing. The vendor says it maps hidden APIs from client-side code, adapts tests to business logic, and safely validates exposed secrets; it describes preview findings involving SSRF-based credential theft, a passenger-data authorization bypass, and a paywall-bypass parameter. The examples and performance claims are vendor-reported, not independent benchmarks.
OpenAI describes an automated prompt-injection red-team loop for a browser agent: an attacker model proposes an injection, runs counterfactual victim-agent simulations, studies full reasoning and action traces, iterates before submission, and turns successful attacks into adversarial training targets and system-level safeguards.