SuperRed
SuperRed is a free, open-source Linux framework for red-teaming chatbots, agents, and assistants.
What SuperRed is
SuperRed is a free, open-source Linux framework for red-teaming chatbots, agents, and assistants. It evaluates whether attacks can violate defined security properties by separating attackers, systems under test, and benchmarks into interchangeable modules coordinated by a controller. Each run can set the attacker model, spending budget per task, trust-boundary access, and whether benchmark feedback is visible. The catalogue contains 35 modules: 21 attackers, 6 targets, and 8 benchmarks, including PAIR, TAP, AutoDAN-Turbo, Crescendo, AgentVigil, HarmBench, AgentDojo, and DecodingTrust-Agent. Targets may represent fixtures, simulated environments, sandboxes, or live deployments. Runs record model, cost, and success rate, with terminal progress and web reports showing task details and trajectories. Multiple threat models can run in parallel against separate instances. Installation uses pip, and the package requires Python 3.11 through 3.13.
Good
- Free, open-source MIT-licensed framework
- 35 attackers, targets, and benchmark modules
- Parallel threat-model execution
- Live dashboard and browsable reports
- Supports fixtures through live deployments
Watch out
- Requires Python 3.11 through 3.13
- Python 3.14 is unsupported
- Development status is Alpha
- Persisted trajectories may contain sensitive content
Who it suits
SuperRed suits red-teamers, system builders, and evaluators who can work with Python and asyncio. It is intended for testing prompt injection, jailbreaks, data leakage, unsafe output, and custom cases.
Verdict
SuperRed provides configurable, modular security evaluations with controllable access scopes and detailed run reports. Its Python requirements, alpha maturity, and potentially sensitive stored trajectories require planning before deployment.
The facts
Each one read from SuperRed's own pages, with the date it was checked.
What it does
- Attacks and benchmarks
- The module catalogue lists 35 modules: 21 attackers, 6 targets, and 8 benchmarks.checked 4 Oct 2026
- Composable components
- It treats the attacker, system under test, and benchmark as separate interchangeable modules coordinated by a controller.checked 4 Oct 2026
- Composable modules
- It keeps attackers, systems under test, and security claims as interchangeable modules coordinated by a controller.checked 4 Oct 2026
- Evaluation reports
- Runs record model, cost, and success rate; the framework provides live progress and browsable reports with per-task details and trajectories.checked 4 Oct 2026
- Example modules
- Listed modules include PAIR, TAP, AutoDAN-Turbo, Crescendo, AgentVigil, HarmBench, AgentDojo, and DecodingTrust-Agent.checked 4 Oct 2026
- Installation
- The guide installs the framework with pip install superred and describes it as a Python framework whose guide assumes familiarity with Python and asyncio.checked 4 Oct 2026
- Integration
- The getting-started example connects to any LiteLLM-compatible model endpoint using a base URL and API key.checked 4 Oct 2026
- Intended audience
- The getting-started guide is for people who can read Python and have seen asyncio, and PyPI lists Science/Research as an intended audience.checked 4 Oct 2026
- Intended users
- The project describes use by red-teamers, system builders, and evaluators, and its guide covers wrapping systems, writing attackers, defining success criteria, and running evaluations.checked 4 Oct 2026
- License and maturity
- PyPI lists the package under the MIT license and classifies its development status as Alpha.checked 4 Oct 2026
- Metrics and reports
- Runs record model, cost, and success rate, with a live terminal dashboard and a web report for results.checked 4 Oct 2026
- Model endpoints
- The example target uses a LiteLLM-compatible endpoint with a base URL and API key; the guide says most LLM-driven attackers also call models through LiteLLM.checked 4 Oct 2026
- Parallel runs
- The framework can run multiple threat models in parallel, each against its own system instance.checked 4 Oct 2026
- Purpose
- SuperRed is an open-source framework for red-teaming chatbots, agents, and assistants by testing whether attacks can violate security properties.checked 4 Oct 2026
- Requirements
- The package requires Python 3.11 through 3.13; Python 3.14 is not supported.checked 4 Oct 2026
- Scale
- The controller can run many threat models in parallel, each against its own system instance.checked 4 Oct 2026
- Security controls
- The controller filters attacker-visible and injectable surfaces according to security-domain scopes and can cap attacker model spend per task.checked 4 Oct 2026
- Security scope
- The controller filters which controllables, observables, trajectory entries, and evaluation sub-scores the optimizer can access according to the configured scope.checked 4 Oct 2026
- Sensitive results
- Persisted trajectories are not scrubbed and may contain jailbreaks, planted secrets, and exfiltrated content, so the maker says to treat the results folder as sensitive.checked 4 Oct 2026
- Supported targets
- Targets can wrap fixed-response fixtures, simulated environments, sandboxes, or live deployments, and the guide recommends staging or throwaway instances for real systems.checked 4 Oct 2026
- Target types
- Targets can wrap fixed-response fixtures, simulated environments, sandboxes, or live deployments.checked 4 Oct 2026
- Threat models
- Each run can define attacker model, per-task budget, trust-boundary access, and whether benchmark feedback is visible to the attacker.checked 4 Oct 2026
The company
- Maker
- The site says SuperRed was made at the University of California, Berkeley.checked 4 Oct 2026
Alternatives to SuperRed
- 1
OpenSecureAI Scanner
Free planOpen sourceWebAPILinuxmacOS8.1From $49 a month - 2
PromptGuard
Free planWebAPIExtensionLinux7.9From $19 a month - 3
Promptfoo
Free planOpen sourceWebAPILinuxmacOS7.8Free plan - 4
Giskard
Free planOpen sourceWebAPILinuxSelf-hosted7.6Free plan - 5
AIRTA Red Team
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 6
CyberSecEval
Free planOpen sourceWebAPILinuxmacOS7.5Free plan