An AI security engineer at a fintech company deploys a customer service chatbot that answers questions about account balances and transactions. Before launch, she needs to verify attackers can't trick the bot into revealing sensitive data or bypassing security rules. She connects the chatbot to ModelRed and runs automated tests that attempt jailbreaks, prompt injections, and data extraction attacks. ModelRed fires 1,247 different attack scenarios at the system, checking if anyone could manipulate the bot into leaking PII, ignoring safety guidelines, or executing unauthorized functions. She gets a single 0-10 security score and a detailed breakdown showing which attacks succeeded, which failed, and exactly how to fix the vulnerabilities.
A machine learning team builds a RAG pipeline that pulls company documents to answer employee questions. They're worried about context hijacking attacks where malicious text in retrieved documents could override the system's instructions. ModelRed tests their pipeline for cross-injection attacks specific to RAG systems, checking if embedded instructions in documents can manipulate the AI's behavior. The system also detects if the pipeline might accidentally expose training data or system prompts through carefully crafted queries. When it finds issues, the team exports findings directly to Jira tickets with reproducible test cases.
ModelRed works with any AI system that takes text input and produces text output. No rewrites needed. You connect your LLM, AI agent, or custom API, and ModelRed runs attack patterns against it. It tests for jailbreaks that bypass safety filters, prompt injections that change system behavior, tool misuse where AI agents call functions they shouldn't, and unsafe content generation including toxic or harmful outputs. The testing covers multi-turn conversation attacks where manipulation builds across several exchanges, bias amplification that violates fairness requirements, and system prompt extraction attempts.
ModelRed uses dedicated LLM detectors to evaluate responses, producing consistent verdicts you can reproduce. You track security scores across model versions and compare different providers. Really useful. CI/CD gates fail builds automatically when high-risk vulnerabilities appear, preventing insecure models from reaching production. The Python SDK supports async operations for testing at scale.
You can import pre-built probe packs or create custom attack patterns. ModelRed generates AI-powered probes tailored to your specific use case. Team governance lets you keep probe packs private, share them with your team, or publish publicly. Audit trails document every test for compliance reporting.
It connects to OpenAI, Anthropic, Google, AWS Bedrock, Azure, HuggingFace, OpenRouter, Meta, XAI, Ollama, Langchain, and Perplexity through standard APIs. Works with REST APIs for custom systems. Exports to Slack and Jira.
The free plan covers one registered model with unlimited assessments, five imported probe packs, and ten custom probe packs you create. Full API access included. Starter runs $49 monthly for three models, thirty probe pack imports, fifty custom packs, and ten AI-generated probes monthly. Pro costs $249 monthly for five models, unlimited assessments and probes, and a hundred AI-generated probes monthly. Enterprise pricing includes unlimited everything, 500 AI-generated probes monthly, SSO, and dedicated support.
Where ModelRed does not fit: teams wanting automatic remediation rather than just detection. ModelRed identifies vulnerabilities but doesn't patch your code. It also won't help with non-text AI systems like image generators or audio models. If you're testing a single simple chatbot that doesn't handle sensitive data, the depth here might exceed your needs. Small hobby projects probably don't require this level of security scrutiny. Over 500 teams currently use it for production AI security.