tools

AMAS

AI Model Attack Simulator — a red-teaming CLI that probes LLM and agent endpoints for common attack patterns.

// category

Security tooling

amas run --target <endpoint>

// about

AMAS (AI Model Attack Simulator) is a command-line security tool for testing authorized LLM and agent endpoints against prompt injection, jailbreaks, system prompt extraction and other model attack patterns.

It sends structured attack techniques at an OpenAI-compatible target, scores the responses with a severity-weighted model, and produces clean reports. A built-in mock target makes it possible to run full demonstrations offline.

Source — coming to GitHub // public release in progress — details land here when they exist

// capabilities

40+ attack techniques
OpenAI-compatible endpoints
Rule-based detection
Optional LLM judge
Severity-weighted scoring
Markdown / JSON reports
Concurrency, retries & rate limiting
Mock target for offline demos

Attack library

Prompt injection and indirect injection payloads.
Jailbreak and role-play bypass techniques.
System prompt extraction attempts.
Other model attack patterns, versioned as techniques.

Detection & scoring

Deterministic rule-based detection over every response.
Optional LLM judge for a second, semantic read.
Severity-weighted vulnerability scoring per technique.
Clear pass / fail / flag verdicts you can act on.

Engineering

Works against any OpenAI-compatible endpoint.
Concurrency, retries and rate limiting built in.
Mock target so demos and CI runs work without a live model.
Human-readable Markdown and structured JSON reports.

// how it works

AMAS is built around a technique library. Each technique is a versioned attack template targeted at OpenAI-compatible chat endpoints.

The engine sends payloads, then applies rule-based detection to every response. Optionally, an LLM judge reviews ambiguous cases. Each finding is assigned a severity weight and rolled up into a score.

Reports are generated as Markdown and JSON, so results can feed an issue tracker, a CI pipeline or a written security review.

Type: Security red-teaming CLI
Targets: OpenAI-compatible LLM / agent endpoints
Techniques: 40+ attack patterns
Detection: Rules + optional LLM judge
Reports: Markdown · JSON

// use cases

Pre-launch LLM checks

Run the library against a new chatbot or agent before it ships, and fix the weak spots you can reproduce.

Regression testing

Keep the attack suite in CI so a future prompt or system change doesn't silently reintroduce a bypass.

Research & demos

Use the mock target to demonstrate attack classes and mitigations offline — in workshops, talks or internal training.

Record keeping

Export structured JSON per run for your own security notes, audit trails or bug-reports.

// limitations

Rule-based detection captures known, patternable attacks; novel techniques may pass unnoticed.
An LLM judge adds context, not certainty — and costs tokens on every run.
A clean AMAS report proves the tested techniques didn't land; it is not a certification of overall safety.

// responsible use

Designed for authorized security testing, research and controlled environments.
Only run against systems you own, operate, or have explicit written permission to test.
Results describe model behavior at a point in time — share them with the system owner, not as public exposure.

// related writing

all articles →

CybersecuritySeptember 18, 20263 min read

AI red teaming for developers: a practical introduction

Prompt injection, jailbreaks and extraction attacks are part of building with LLMs today. Here's how a red-team mindset fits into the engineering workflow — and what an attacker simulator automates for you.

// more software

Explore the other tools

Kestro CyberAudit Pro SEO Engine

Build something with me