As AI and Large Language Models (LLMs) become increasingly integrated into critical applications and complex agentic workflows, the need for robust security tools has never been greater. This comprehensive guide examines the current landscape of open-source AI security tools, organizing them by the level and aspect of the AI ecosystem they address.
Understanding the AI Security Ecosystem
The AI/LLM security landscape operates at different levels, from individual model testing to complete system architecture analysis. Understanding these levels is crucial for selecting appropriate tools for specific security needs and building comprehensive defense strategies.
1. Model-Level Testing
Testing core LLM capabilities, vulnerabilities, and behaviors
Individual Model Security
Garak (NVIDIA)
- Purpose: LLM vulnerability scanner focused on red-teaming individual models
- Key Features: Probes for hallucinations, data leakage, prompt injection, toxicity, jailbreaks
- Supports: Multiple LLM platforms (Hugging Face, OpenAI, Replicate)
- Links:
- GitHub: https://github.com/NVIDIA/garak
- Documentation: https://docs.nvidia.com/nemo/guardrails/evaluation/llm-vulnerability-scanning.html
PyRIT (Microsoft Azure)
- Purpose: Python Risk Identification Tool for generative AI
- Key Features: LLM-based evaluators with explainability, customizable attacks, multi-step jailbreaks
- Supports: Framework-agnostic approach for individual LLM testing
- Links: GitHub: https://github.com/Azure/PyRIT
Adversarial Robustness Toolbox (ART)
- Purpose: Comprehensive ML security framework for all model types
- Key Features: Four threat categories (Evasion, Poisoning, Extraction, Inference)
- Supports: All major ML frameworks (TensorFlow, PyTorch, scikit-learn, etc.)
- Links:
- GitHub: https://github.com/Trusted-AI/adversarial-robustness-toolbox
- Documentation: https://adversarial-robustness-toolbox.readthedocs.io/
- Official Site: https://adversarial-robustness-toolbox.org/
Purple Llama/CyberSecEval (Meta)
- Purpose: Cybersecurity evaluation benchmark for LLMs
- Key Features: Insecure code generation detection, malicious request compliance testing
- Focus: Cybersecurity framework alignment and comprehensive benchmarking
- Links: GitHub: https://github.com/meta-llama/PurpleLlama
2. Application-Level Security
How LLMs are integrated and used within applications
Application Integration Testing
promptfoo
- Purpose: LLM application testing and red teaming platform
- Key Features: Customized vulnerability probes, PII leak detection, jailbreak testing
- Interface: Both CLI and web interface available
- Links:
- Website: https://www.promptfoo.dev/
- LLM Scanner: https://www.promptfoo.dev/llm-vulnerability-scanner/
- Guardrails: https://www.promptfoo.dev/guardrails/
Giskard
- Purpose: ML model testing and validation platform
- Key Features: Multi-language support, structured attack customization, LLM guardrails interface
- Focus: Broader ML application focus with LLM capabilities
3. System-Level Analysis
Multi-agent systems, workflows, and architectural analysis
Agentic Workflow Analysis
Agentic Radar (SplxAI)
- Purpose: Complete agentic system architecture analysis and security scanning
- Key Features: Workflow visualization, tool identification, MCP server detection, vulnerability mapping
- Supports: LangGraph, CrewAI, n8n, OpenAI Agents SDK
- Unique: Only tool providing comprehensive workflow visualization and dependency mapping
- Links:
- GitHub: https://github.com/splx-ai/agentic-radar
- Company: https://splx.ai/
- Documentation: https://splx.ai/resources/agentic-radar
agentic_security
- Purpose: Vulnerability scanner specifically for Agent Workflows and LLMs
- Key Features: Multimodal attacks, multi-step jailbreaks, RL-based adaptive attacks
- Focus: API integration and stress testing for agentic systems
- Links: GitHub: https://github.com/msoedov/agentic_security
4. Runtime Protection & Monitoring
Real-time guardrails, monitoring, and operational security
Input/Output Guardrails
Guardrails AI
- Purpose: Comprehensive AI guardrails framework for runtime protection
- Key Features: Large library of community-driven validators, input/output guards
- Focus: Runtime protection and structured data generation from LLMs
- Links:
- Website: https://www.guardrailsai.com/
- GitHub: https://github.com/guardrails-ai/guardrails
LlamaFirewall (Meta)
- Purpose: Real-time guardrails for language model agents
- Key Features: PromptGuard 2, CodeShield, AlignmentCheck modules
- Focus: Production deployment guardrails and real-time protection
- Links: Analysis: https://threatmodel.co/blog/llamafirewall-ai
Invariant Guardrails
- Purpose: Contextual security layer for agentic AI systems
- Key Features: Flow-based rules, MCP-level transparent security, complex organizational rules
- Focus: System-level contextual rule enforcement for agentic workflows
- Links:
- Website: https://invariantlabs.ai/
- Blog Post: https://invariantlabs.ai/blog/guardrails
Tool Comparison Matrix
| Tool | Level | Focus | Approach | Agentic Support |
|---|---|---|---|---|
| Agentic Radar | System | Workflow Analysis | Static + Dynamic | Full |
| Garak | Model | Vulnerability Scanning | Dynamic | Limited |
| PyRIT | Model | Red Teaming | Dynamic | Limited |
| Guardrails AI | Runtime | Input/Output Protection | Runtime | Partial |
| ART | Model | Adversarial ML | Static + Dynamic | None |
| promptfoo | Application | Testing Platform | Dynamic | Partial |
| LlamaFirewall | Runtime | Real-time Protection | Runtime | Partial |
| agentic_security | System | Agent Vulnerabilities | Dynamic | Full |
Integration Recommendations
Complementary Tool Stacks
Development Stack
- Agentic Radar (static analysis)
- promptfoo (dynamic testing)
- Guardrails AI (runtime protection)
Research Stack
- Garak (model testing)
- PyRIT (advanced red teaming)
- ART (adversarial robustness)
Production Stack
- LlamaFirewall (runtime guardrails)
- Invariant Guardrails (system-level rules)
- Purple Llama (compliance)
Key Insights
- Agentic Radar is unique in providing comprehensive system-level analysis of agentic workflows with visualization capabilities.
- Most tools focus on individual LLM testing rather than complete system architecture analysis.
- Runtime protection tools (Guardrails AI, LlamaFirewall) complement static analysis tools for comprehensive security.
- The ecosystem is evolving rapidly with new tools emerging to address different aspects of AI security.
- No single tool addresses all security concerns – a layered approach using multiple tools is recommended for comprehensive coverage.
Conclusion
The AI/LLM security landscape is rapidly evolving, with tools addressing different layers of the technology stack. While most focus on individual model testing or runtime protection, there’s a growing recognition of the need for system-level analysis of complex agentic workflows.
Organizations building AI systems should adopt a layered security approach, combining tools from different levels to achieve comprehensive coverage. As agentic AI systems become more prevalent, tools like Agentic Radar that provide architectural transparency and workflow analysis will become increasingly critical for maintaining security and compliance.
The key is to understand where each tool fits in your security strategy and how they can work together to create a robust defense against the evolving landscape of AI security threats.
References
- Comparative Analysis Paper: https://arxiv.org/abs/2410.16527
- OWASP LLM Top 10: Referenced across multiple tools for vulnerability classification
- Various vendor documentation and blog posts provide additional context and usage examples
Academic Research Foundations
The tools and frameworks discussed above are grounded in extensive academic research. Here are the key papers that form the theoretical foundation of AI security tools and practices.
Foundational AI Security Frameworks
Core Security Framework Papers
- PyRIT: A Framework for Security Risk Identification and Red Teaming in Generative AI Systems (2024)
https://arxiv.org/abs/2410.02828
Microsoft’s comprehensive framework that forms the basis for modern AI red teaming practices. - garak: A Framework for Security Probing Large Language Models (2024)
https://arxiv.org/abs/2406.11036
NVIDIA’s academic foundation for systematic LLM vulnerability assessment. - Lessons From Red Teaming 100 Generative AI Products (2025)
https://arxiv.org/abs/2501.07238
Microsoft’s practical insights from extensive real-world AI red teaming operations. - Red-Teaming for Generative AI: Silver Bullet or Security Theater? (2024)
https://arxiv.org/abs/2401.15897
Critical academic analysis of AI red teaming practices and their limitations.
Agentic AI Security Research
The most relevant research for tools like Agentic Radar that focus on multi-agent and agentic system security.
Multi-Agent System Security
- Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework (2024)
https://arxiv.org/abs/2504.19956
Most comprehensive academic threat model specifically for agentic AI systems. - Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2024)
https://arxiv.org/abs/2505.02077
Academic analysis of security vulnerabilities in interacting multi-agent systems. - Security of AI Agents (2024)
https://arxiv.org/abs/2406.08689
Systematic analysis of AI agent vulnerabilities and defense mechanisms. - Position: Towards a Responsible LLM-empowered Multi-Agent Systems (2025)
https://arxiv.org/abs/2502.01714
Framework for responsible development of multi-agent LLM systems.
AI Security Evaluation Research
- Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysis (2024)
https://arxiv.org/abs/2410.16527
Direct academic comparison of Garak, Giskard, PyRIT, and CyberSecEval tools. - AI Benchmarks and Datasets for LLM Evaluation (2024)
https://arxiv.org/abs/2412.01020
Comprehensive framework for AI system evaluation including security aspects. - Adversarial Testing in LLMs: Insights into Decision-Making Vulnerabilities (2025)
https://arxiv.org/abs/2505.13195
Framework for stress-testing LLM decision-making processes under adversarial conditions.
Emerging Trends in AI Security
Based on current research and development patterns, several key trends are shaping the future of AI security tools and practices.
1. Agentic-Specific Security Focus
The field is rapidly recognizing that agentic AI systems require fundamentally different security approaches than traditional LLMs. We’re seeing the emergence of specialized frameworks like Agentic Radar and dedicated research initiatives such as the OWASP Agentic Security Initiative and CSA’s MAESTRO framework.
2. Industry Standardization Efforts
Major organizations are developing standardized approaches to AI security assessment. OWASP has expanded beyond their LLM Top 10 to address agentic systems specifically, while the Cloud Security Alliance (CSA) has introduced the MAESTRO threat modeling framework.
3. Automated Red Teaming Evolution
Tools like PyRIT and Garak are pioneering automated approaches to AI red teaming, but the field is evolving toward more sophisticated automation including AI-vs-AI testing scenarios and reinforcement learning-based attack generation.
4. Integration of Static and Dynamic Analysis
Modern AI security tools are moving beyond single-mode analysis. Tools like Agentic Radar combine static workflow analysis with dynamic runtime testing, providing comprehensive coverage of potential vulnerabilities.
5. Real-Time Monitoring and Guardrails
The field is shifting from purely testing-focused tools to integrated monitoring and protection systems that provide continuous runtime protection rather than just vulnerability assessment.
6. Multi-Modal Security Assessment
As AI systems increasingly work with text, images, audio, and video, security tools are expanding to cover multi-modal attack vectors and complex attacks that combine multiple input types.
7. Framework-Specific Security Tools
Rather than generic approaches, we’re seeing the development of tools tailored to specific AI development frameworks that can understand the specific architectural patterns and vulnerabilities of different development approaches.
8. Community-Driven Security Intelligence
Open-source security tools are increasingly leveraging community contributions for vulnerability signatures, attack patterns, and defense strategies.
9. Regulatory Compliance Integration
With the emergence of AI-specific regulations like the EU AI Act, security tools are being designed with compliance assessment built-in.
10. Cross-System Vulnerability Analysis
As AI systems become more interconnected, security tools are evolving to analyze vulnerabilities that span multiple systems, platforms, and organizations.