garak
Open-source LLM vulnerability scanner — probes models for injection, jailbreaks, and leakage.
About
garak (short for "generative AI red-teaming & assessment kit") is an open-source scanner, originally built by Leon Derczynski and now maintained by NVIDIA, that probes language models for security weaknesses. It runs dozens of probe families — prompt injection, jailbreaks, data leakage, toxicity, hallucination — against a target model and uses detectors to judge whether each attack landed.
It is often described as nmap for LLMs: a first-pass automated baseline before human red teamers dig into application-specific scenarios. Reports come out as JSON and HTML. Being a scanner rather than a framework, it is weaker at multi-turn adaptive campaigns, which is where tools like PyRIT take over.
What it can do
- 50+ probe families (injection, jailbreaks, leakage, toxicity)
- Detector-based pass/fail scoring
- JSON and HTML reporting
- REST and HuggingFace model targets
- CI/CD integration
Setup
- Create a Python virtual environment.
- Run
pip install garak. - Verify with
garak --version. - Point it at a model, e.g.
garak --model_type openai --model_name gpt-4o --probes all. - Review the JSON/HTML report for failed probes.
Prerequisites
Python 3.8+, API access to the target model.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Open-source LLM vulnerability scanner homed at NVIDIA; Apache 2.0; Described as the leading automated LLM scanner in independent review and recommended by Microsoft, Trend Micro, Cisco; Actively maintained (v0.17.0 Sep 2026); Red Hat learning path published Oct 2026; Scanner-style: weaker at multi-turn adaptive campaigns than framework tools. License: Apache 2.0.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 8.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · Open-source LLM vulnerability scanner homed at NVIDIA; Apache 2.0
- · Described as the leading automated LLM scanner in independent review and recommended by Microsoft, Trend Micro, Cisco
- · Actively maintained (v0.17.0 Sep 2026); Red Hat learning path published Oct 2026
- · Scanner-style: weaker at multi-turn adaptive campaigns than framework tools
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.