No. 12 of 29 ·AI Security Testing Tools

SuperRed

Linux

Visit site Alternatives

Freedom report

One barScore 5.4

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

SuperRed is ranked #12 of 29 in AI security testing tools on Freedom251. It runs on Linux.

Compared on AI security testing tools

Free plan: Yes
Prompt injection tests: Yes
Jailbreak tests: Yes
Data leakage tests: Yes
Unsafe output tests: Yes
Custom test cases: Yes
Deployment mode: self_hosted

Best SuperRed alternatives

See all 20

Two bars AIRTA Red Team Free tier No. 1Free6.6 Two bars OpenSecureAI Scanner Free tier No. 2$49/mo6.6 Two bars Project Moonshot Free tier No. 3Free6.6 Two bars Promptfoo Free tier No. 4Free6.6 Two bars PromptGuard Free tier No. 5$19/mo6.6 Two bars PyRIT Free tier No. 6Free6.6

The record

Purpose: SuperRed is an open-source framework for red-teaming chatbots, agents, and assistants by testing whether attacks can violate security properties.
Composable components: It treats the attacker, system under test, and benchmark as separate interchangeable modules coordinated by a controller.
Threat models: Each run can define attacker model, per-task budget, trust-boundary access, and whether benchmark feedback is visible to the attacker.
Attacks and benchmarks: The module catalogue lists 35 modules: 21 attackers, 6 targets, and 8 benchmarks.
Example modules: Listed modules include PAIR, TAP, AutoDAN-Turbo, Crescendo, AgentVigil, HarmBench, AgentDojo, and DecodingTrust-Agent.
Metrics and reports: Runs record model, cost, and success rate, with a live terminal dashboard and a web report for results.
Parallel runs: The framework can run multiple threat models in parallel, each against its own system instance.
Installation: The guide installs the framework with pip install superred and describes it as a Python framework whose guide assumes familiarity with Python and asyncio.
Model endpoints: The example target uses a LiteLLM-compatible endpoint with a base URL and API key; the guide says most LLM-driven attackers also call models through LiteLLM.
Target types: Targets can wrap fixed-response fixtures, simulated environments, sandboxes, or live deployments.
Security scope: The controller filters which controllables, observables, trajectory entries, and evaluation sub-scores the optimizer can access according to the configured scope.
Sensitive results: Persisted trajectories are not scrubbed and may contain jailbreaks, planted secrets, and exfiltrated content; API keys and API base URLs are not written in the serialized LLM configuration.
Intended users: The project describes use by red-teamers, system builders, and evaluators, and its guide covers wrapping systems, writing attackers, defining success criteria, and running evaluations.
Maker: The site says SuperRed was made at the University of California, Berkeley.

Where it ranks on Freedom251

Best AI Security Testing Tools in 2026#12 of 29

Is SuperRed yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote SuperRed

Sources

rdi.berkeley.edu/superred/· checked 4 Oct 2026
rdi.berkeley.edu/superred/modules· checked 4 Oct 2026
rdi.berkeley.edu/superred/guide/· checked 4 Oct 2026
rdi.berkeley.edu/superred/reference/· checked 4 Oct 2026
rdi.berkeley.edu/superred/reference/results· checked 4 Oct 2026
rdi.berkeley.edu/superred/reference/controller· checked 4 Oct 2026
pypi.org/project/superred/· checked 4 Oct 2026