AI Red Teaming Hub: Your Guide to Offensive AI Security

AI red teaming is not a checklist exercise. It is a sustained, adversarial practice — probing the boundaries of deployed LLM systems with the same creativity and persistence that real attackers bring. That framing shapes everything published on aisec.blog: technical depth over vendor marketing, reproducible attack patterns over speculation, and honest coverage of what current defenses do and do not stop.

This page is the full index. Every article on the site appears below, grouped by the part of the attack surface it covers, so you can start from a class rather than from a search box.

The attack surface for modern LLM deployments spans five broad categories. Prompt injection — both direct and indirect — remains the highest-volume class and the one most likely to appear in a production engagement. Jailbreaks are distinct from injection; they target alignment training rather than context hijacking, and require different methodology. Adversarial ML covers optimization-based attacks, knowledge corruption, membership inference, and model extraction — approaches that require ML expertise but are increasingly accessible via open tooling. Agent exploitation extends all of the above into agentic pipelines where a compromised LLM can act: reading files, calling APIs, browsing the web. Output handling is where all of it lands, because a model that says something dangerous only matters when something downstream acts on it.

If you’re coming from traditional penetration testing and mapping these to the PTES or OWASP, the closest analogs are injection (OWASP A03), broken access control (A01), and insecure design (A04) — but the primitives are different and the tooling has almost no overlap.

---

Start here

LLM Security: A Practitioner’s Map of the Attack Surface The broadest entry point. Covers the major attack categories, situates them against the OWASP LLM Top 10 and MITRE ATLAS, and flags where standard AppSec methodology transfers and where it doesn’t.

LLM Security FAQ: Prompt Injection, Jailbreaking, and Defenses Short answers to the three questions that come up first, each linking into the deeper coverage.

LLM Attack Taxonomy: Prompt Injection, Jailbreaks, Agent Hijack The vocabulary, with the boundaries between classes drawn precisely enough to use in a report.

Direct vs. Indirect Prompt Injection: Threats and Defenses The single most useful distinction in the field, and why the two halves need different architecture.

How AI Sec Picks and Verifies What It Publishes Scope, sourcing standard, and what this site does not do.

---

Prompt injection

The primary attack class for LLM-integrated applications.

Prompt Injection Attack Compendium (2026 Edition) The pillar reference: every documented technique family in one place, with the defenses each one answers to.

Prompt Injection Attack: Techniques, Variants, and Defenses Technique-level walkthrough of payload construction and delivery, plus the mitigations that survive adversarial pressure.

Prompt Injection Examples: A Practitioner’s Attack Library Concrete payload patterns by category, for building a test corpus.

LLM Prompt Injection: Taxonomy, Real Patterns, and Defenses The taxonomy view, organised by where the payload enters the system.

System Prompt Injection: How Extraction and Override Attacks Work Why system prompts leak, what an override actually changes, and why treating the system prompt as a secret store fails.

Indirect Prompt Injection in RAG Pipelines: Patterns and Defenses Retrieval poisoning, corpus trust boundaries, and the ingestion paths teams forget to scope.

Prompt Hacking: Taxonomy, Techniques, and What Works on LLMs The wider practice, including leaking, extraction, and in-context conditioning.

Prompt Injection in 2025: OpenAI vs. Broken Defenses What a frontier lab’s own framing of the problem concedes, read against the published defense results.

GPT-Red: What OpenAI’s Prompt-Injection Attacker Proves An automated attacker built by the defender, and what its existence implies about detection.

---

Jailbreaks and alignment bypass

Attacks that target safety training rather than context hijacking. Different threat actor, different methodology, different mitigations.

LLM Jailbreak: Attack Taxonomy, Techniques, and Defense Reality The reference taxonomy, with research citations and honest defense assessments.

Many-Shot Jailbreaking: How Long Context Breaks Alignment The attack whose only variable is volume: power-law scaling with demonstration count, why it transfers across every model family, and the preprocessing control that blunts it.

LLM Bypass: How Attackers Circumvent Safety Alignment by Layer Layer-by-layer view of where alignment is enforced and where each layer can be stepped around.

GPT-4 Jailbreak Techniques: A Red Teamer’s Technical Reference Three attack classes with documented success rates, grounded in peer-reviewed work.

ChatGPT Jailbreak Prompt Taxonomy: Classes, Rates, and Defenses How the public prompt corpus is structured, and which classes still land.

Automated Jailbreak Attacks and the Transfer Problem Generators, surrogate models, and why an attack developed against open weights works on closed ones.

---

Agents, tools, and output handling

Where an injection stops being a content problem and becomes an incident.

Insecure Output Handling: LLM05:2025 Attacks and Defenses The sink side of the problem: rendering, generated queries, exec, shell construction and parsed JSON, with the control that holds at each one.

Agent Tool-Use Exfiltration: When Indirect Injection Does Damage Attack chains through tool-enabled agents, and how to bound the blast radius when injection succeeds.

LLM Security Vulnerabilities: What Actually Gets Exploited The CVE record, read for patterns rather than headlines.

Prompt Injection Detection Signals in Production LLM Systems Input, output and tool-use telemetry that reveals an attempt in flight.

Why Your Prompt Injection Guardrails Fail: Bypass Classes Guardrail benchmarks look good on textbook payloads. This maps the bypass classes they miss.

---

Adversarial ML and model confidentiality

The Adversarial ML Attack Taxonomy: A Red Teamer’s Reference Evasion, poisoning, extraction and inference in vendor-neutral terminology suitable for a compliance-facing deliverable.

Model Extraction vs. Model Inversion: Two Confidentiality Attacks Two attacks that get conflated constantly, separated by what they actually recover.

FlashRT Cuts the GPU Bill on Long-Context Injection Attacks Optimization-based attacks against long-context models, and the memory work that moved them back inside a small-team budget.

---

Methodology and program building

AI Red Team: Methodology, Tooling, and Attack Surface How an engagement is structured end to end, and which frameworks are worth citing in the report.

AI Red Team Engagement Methodology: Scoping to Reporting The operational version: scope, rules of engagement, evidence handling, and what a finding needs to survive review.

OSCP and CEH in 2026: What Carries Over to AI Red Teaming Which traditional pentest skills transfer, and what has to be added.

The Audit Gap: Why Red-Teaming Can’t Certify Governance Claims The limits of behavioural evaluation as assurance, which matters if anyone is treating your report as a certificate.

---

Interactive tools

Three free, static, no-signup tools built to go with the writing above.

• Attack Technique Atlas — a deep-linkable graph of attack families and techniques, with prerequisites, incidents and defenses per node.
• Prompt Injection Scanner — paste a payload and watch which detection patterns fire, before you trust a classifier in production.
• AI Red Team Gym — a practice target for the payload-crafting loop against a safe system.

The glossary defines the terminology used across all of the above, and resources collects the external papers, benchmarks and scanners worth keeping bookmarked.

---

Cross-site reading

aisec.blog publishes the offensive side. GuardML publishes the corresponding defensive patterns, Prompt Injection Report tracks injection proof-of-concepts as they land, and Jailbreaks FYI maintains the technique-level jailbreak catalogue. Reading the offensive and defensive sides together is what a report needs when it has to serve both a red and a blue deliverable.