holocron/plugins/kyberforge/skills/promptfoo/references/redteam.md

topic, source_keys

topic	source_keys
redteam	context7-promptfoo-dev context7-promptfoo-github

What red-teaming does

Red-teaming in Promptfoo generates adversarial test cases that probe an LLM application for security vulnerabilities and safety failures. It is separate from standard evals — you configure it under a redteam: block and use promptfoo redteam generate to produce test cases, then run them with promptfoo eval.

Basic configuration

# yaml-language-server: $schema=https://promptfoo.dev/config-schema.json
redteam:
  plugins:
    - harmful
    - prompt-injection
    - hijacking
  strategies:
    - jailbreak
    - jailbreak:composite
    - prompt-injection

providers:
  - openai:gpt-5-mini

Plugins (what to test for)

Plugins define the vulnerability categories to probe:

Plugin	Tests for
harmful	General harmful content generation
harmful:misinformation-disinformation	False or misleading information
harmful:cybercrime	Cyberattack assistance
prompt-injection	Injection via user input overriding system instructions
hijacking	Redirecting the assistant to unintended tasks
jailbreak	Breaking safety guardrails
rbac	Role-based access control bypass
hallucination	Fabricated facts
debug-access	Exposing internal debug interfaces
shell-injection	Shell command injection
sql-injection	SQL injection via natural language
ssrf	Server-side request forgery

Strategies (how to attack)

Strategies control the attack method applied to each plugin's test cases:

Strategy	Description
jailbreak	Classic jailbreak prompts
jailbreak:composite	Chained / composite jailbreak attempts
prompt-injection	Inject instructions via user-controlled content
base64	Encode attack payload in base64
leetspeak	Obfuscate with leet substitutions
rot13	Encode with ROT-13
iterative	Iteratively refine attack prompts
ensemble	Combine multiple strategies

Generating adversarial tests

promptfoo redteam generate
promptfoo redteam generate -c promptfooconfig.yaml

Then run the generated tests:

promptfoo eval

Node.js API

import { redteam } from 'promptfoo';

const result = await redteam.generate({
  target: {
    prompt: 'You are a helpful assistant. Answer user questions.',
    model: 'openai:chat:gpt-5.5',
  },
  plugins: ['prompt-injection', 'jailbreak', 'rbac'],
  numTests: 5,
  strategies: ['iterative', 'ensemble'],
});

result.tests.forEach((test, i) => {
  console.log(`${i + 1}. [${test.category}] ${test.prompt.substring(0, 100)}...`);
});

Cascading failures (agentic AI)

For agentic systems, test cascading failures and multi-step attacks:

redteam:
  plugins:
    - hallucination
    - harmful:misinformation-disinformation
    - divergent-repetition
  strategies:
    - jailbreak
    - prompt-injection

OWASP and MITRE alignment

Plugins map to OWASP LLM Top 10 and MITRE ATLAS categories. Use debug-access, shell-injection, sql-injection, ssrf together to cover the MITRE ATLAS initial-access cluster:

redteam:
  plugins:
    - debug-access
    - harmful:cybercrime
    - shell-injection
    - sql-injection
    - ssrf
  strategies:
    - base64
    - jailbreak
    - leetspeak
    - prompt-injection
    - rot13

Integration with Burp Suite

Promptfoo can generate targeted red-team test cases for use with Burp Suite. Use promptfoo redteam generate to produce test payloads and then pass them into Burp's active scanner.