前面盘完接口、性能、APP、UI、安全五篇传统工具，群里果然有人来问，那 AI 呢，测大模型用什么，测 Agent 用什么。
问得正是时候。Gartner 今年的预测说，到 2029 年七成中国企业都会实施 AI 安全测试，国家 CERT 都开始办大模型安全众测了，这已经不是论文里的东西了。
而且它跟传统安全的关系很有意思，攻击面从代码和配置换成了提示词和上下文，SQL 注入的思维直接平移成提示注入，OWASP 专门出了 LLM Top 10 当翻译对照表。对测试人来说，这是块门槛不高、窗口期不长的新蓝海。
今天给大家推荐 14 款，大模型红队的、管 Agent 安全的、还有传统工具长出 AI 能力的，官网和开源地址都放在每款下面了。
一、LLM 红队开源派
1. Promptfoo
这条线上生态最大的开源项目，两万四千多 Star，红队和评估一体化。YAML 写红队策略，提示注入、越狱、PII 泄露、不安全工具调用这些攻击面内置了一整套策略库，RAG 和 Agent 架构都能测，跑完出结构化报告，CI 集成顺滑。OpenAI 官方都拿它做参考实现，入门第一站，没有争议。
2. garak
NVIDIA 开源的 LLM 漏洞扫描器，九千多 Star，定位就是「给大模型跑的 Nmap」。探测器(Probe)库覆盖提示注入、数据泄露、越狱、幻觉、不安全生成一大票风险类别，一条命令对模型扫一遍，出漏洞报告。NVIDIA 出品背书加持续更新，红队自动化扫描的主力。
3. PyRIT
微软官方的 Python 风险识别工具包，四千多 Star。它的设计有意思，攻击者 Agent 和目标 Agent 对打，自动编排多轮对抗，攻击成功自动记进数据库做评分，像极了渗透测试里的自动化攻击链。跟 Azure AI Foundry 深度集成，微软系团队的自然选择。
4. DeepTeam
Confident AI 出品，跟大名鼎鼎的 DeepEval 同一门，两千七百多 Star。卖点是一行代码跑一轮红队演练，内置 OWASP LLM Top 10 和常见攻击手法，输出带严重程度的漏洞报告。写法上跟 DeepEval 一脉相承，已经在用 DeepEval 做评测的团队，加它几乎零成本。
5. Giskard
开源的 LLM 测试与安全扫描一体框架，从数据到模型到应用层都能扫，幻觉、有害输出、注入风险打包检测，CI/CD 里自动跑。欧洲团队出品，质量意识和文档都扎实。
官网 giskard.ai
二、Agent 安全
6. Invariant Labs
Agent 安全线上的核心玩家，去年被 Snyk 收购。三件套分工清楚，Explorer 观察和回放 Agent 的行为轨迹，像给 Agent 挂了个黑匣子，Guardrails 做上下文层面的策略控制，MCP Scan 专扫 MCP 服务器的工具投毒和协议漏洞。做 Agent 安全测试，绕不开它。
7. NeMo Guardrails
NVIDIA 开源的护栏框架，用 Colang 语言定义对话和工具调用的安全边界。严格说它是防御工事，但攻防一体，你的护栏写得对不对，得靠红队工具打一遍才知道，两者搭着用，攻防才算配齐。
8. 阿里云 Agent 安全中心
国内大厂侧的代表，Agent 资产的统一监控、基线检测、漏洞扫描一体，跟阿里云上的百炼生态打通。国产合规语境下做 Agent 安全，先看它。
三、商业平台
9. Lakera
AI 原生安全公司的代表，靠提示注入防护起家，Lakera Guard 是 GenAI 应用的防火墙，Lakera Red 做自动化红队。瑞士团队，金融客户多，风控话语体系成熟。
官网 lakera.ai
10. HiddenLayer
端到端的 AI 安全平台，主攻模型本身的保护，模型文件加密、威胁检测、MLOps 管道安全都管。区别于应用层的提示注入工具，它守的是模型资产那一层，国防和重工业客户多。
11. CalypsoAI
2026 年 AI 渗透测试榜单的头部，LLM 红队加 API 网关加合规输出三件套，企业要给 AI 应用做过安全评估出报告，它把整个流程产品化了。
12. Mindgard
专注 LLM 和多模态模型的自动化安全测试，能发现影子 LLM 接口，模型资产盘点加漏洞验证一体，学术味重一点，技术底子扎实。
官网 mindgard.ai
四、传统工具的长进
13. Burp AT
传统工具长出 AI 能力的标志性案例。Burp 在 2026.7 版本里加入了 AT，Agent 自主执行 Web 安全测试，自己读 site map 和流量，自己规划测试路径，每个任务的自主度由渗透人员控制，允许执行、需要确认还是禁止，你说了算。人从执行者变成了监督者，这个方向值得所有安全工具人盯紧。
14. Snyk
第五篇里它管供应链依赖，这里的看点是收购 Invariant Labs 之后长出的 AI 侧能力，AI-BOM 盘点 AI 资产、AI 红队测试、MCP 持续扫描，一个传统 SCA 厂商转身最快的那批。
官网 snyk.io
写在最后
写完这篇我自己最直接的感受是，这是测试人少见的一次转型窗口。提示注入的思路和 SQL 注入一脉相承，边界条件、越权、数据泄露的测试思维全部通用，OWASP LLM Top 10 就是那张翻译表。传统测试背景转 AI 安全，比转算法容易十倍，窗口期撑死两三年。
真要上手，开源就选 Promptfoo，红队策略写成 YAML 进 Git，模型一升级一改版就自动打一轮，把红队做成回归而不是一次性审计，这才是工程化的玩法。Agent 安全是 2026 年最大的增量，MCP 工具投毒、间接注入这些攻击面去年才成型，现在进场的人，就是明年写最佳实践的人。
工具换汤不换药，内核还是那句话，像攻击者一样思考。弹药工具给，打哪里，你定。
AI 安全是块新地，地图还没画完，先进场的人先插旗。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
There are five traditional tools in front of the drive, and it's been asked about AI, what LLM is for, and what Agent is for.
Just in time. Gartner's prediction this year is that 70% of Chinese companies will have an AI security test by 2029, and the National CERT has started a LLM safety survey, which is no longer part of the paper.
And it has an interesting relationship with traditional security, where the face of the attack has been changed from code and configuration to prompt and context, and SQL has been transposed directly into hints, and OWASP has dedicated LLM Top 10 to translation checklists. For testers, it is a new blue sea with low thresholds and short window duration.
Today, we recommend 14 sections for the LLM Red team, the Agent safe, and traditional tools to grow the AI capability. The official network and open source addresses are placed under each section.
I. LLM Red Opens
1. Promptfoo
The largest open source project on this line is over 24,000 Star, Red Team and Assessment Integration. YAML writes a red team strategy, alerts to injections, escapes, PII leaks, unsafe tool call attacks with a whole array of policy libraries, RAG and Agent structures, running out of structured reports, and CI integration smooth. The official Open AI uses it as a reference, first stop, uncontroversial.
2. garak
The NVIDIA open source LLM loophole scanner, over 9,000 Star, located "Nmap for LLM". The Probe Library covers injections, data leaks, escapes, hallucinations, insecurity and creates a large number of risk categories, with one order sweeping the model and leaking reports. The main power of the NVIDIA team to automate the scan is continuously updated.
3. PyRIT
Microsoft's official Python Risk Identification Toolkit, over 4,000 Star. It's interesting design: the assailants Agent and the target Agent fights, automatically arrange multiple rounds of confrontation, and the attack is automatically recorded in the database to rate, like the automated attack chain in the permeability test. Integration with Azure AI Foundation, the natural choice of the Microsoft team.
4. DeepTeam
Confident AI, same door as the famous DeepEval, over 2,700 Star. The selling point is a line-by-line run-through red team exercise that incorporates OWASP LLM Top 10 and common attack tactics, with leak reports of severity. It's written in line with DeepEval, already using DeepEval as an evaluation team, plus it's almost zero.
5. Giskard
Open-source LLM tests and a security scanning framework that can be cleaned from data to models to application layers, hallucinogenic, harmful output, injection into risk pack testing, and run automatically in CI/CD. The European team produces products, quality awareness and documentation.
The network of officials.
II. AGENT SAFE
6. Invariant Labs
Agent's core player on the security line was acquired last year by Snyk. Three sets of division are clear, Explorer observes and replays the behavioral trajectory of Agent, like a black box for Agent, Guardrails for context level tactical control, MCP Scan to clean up the MCP server tool poisoning and protocol gaps. Do the Agent security test, don't go around it.
7. NeMo Guardrails
The frame of the NVIDIA open-source fence defines the secure boundary of dialogue and tool call in the Colang language. Strictly speaking, it's a defensive field, but the defense is one, and your fence is written right. It's only through the Reds' tools that you know that the two work together.
8. Alibaba Cloud Agent Security Centre
Representatives of the country ' s major plants, Agent assets, integrated surveillance, baseline detection, gap scanning, connect to the 100% ecology on Alibaba Cloud. In the context of national compliance, do Agent secure, first look at it.
III. Commercial platforms
9. Lakera
The representative of AI Native Safety Inc., by prompting the shield, Lakera Guard is the firewall for Gen AI applications, and Lakera Red is an automated red team. The Swiss team, with a large number of financial clients, has a well-established lingua franca.
LACERA.ai
10. HiddenLayer
End-to-end AI security platform, protection of the primary attack model itself, encryption of model files, threat detection, security of the MLOps pipeline. Distinguished from the application layer of the induction tool, it maintains the model asset layer, with many defence and heavy industry clients.
11. CalypsoAI
In 2026, when the AI Infiltration List at the head, the LLM Red team plus the API gateway plus the compliance output package, the enterprise had made a safety assessment report for the AI application, which had marketed the entire process.
12. Mindgard
Automatic security tests focusing on LLM and multi-modular models reveal shadow LLM interfaces, model asset inventory and gap verification, academic taste, and solid technical background.
It's an official website.
The evolution of traditional tools
13. Burp AT
Traditional tools produce iconic examples of AI capabilities. Burp added AT, Agent self-executes Web security tests, reads sit Map and traffic, plans its own test path, and the degree of autonomy of each mission is controlled by permeators, allowed, confirmed or prohibited. The shift from an implementer to a monitor deserves the attention of all security agents.
14. Snyk
In Title Five, it is dependent on the supply chain, where the focus is on the AI side capabilities that emerged from the acquisition of Invariant Labs, the AI-BOM inventory of AI assets, the AI Red Team testing, the MCP continuous scanning, a traditional SCA vendor that turned the fastest.
I'm sorry, snyk.io.
At the end.
What I felt most directly after writing this was that it was a transformation window that was rare for testers. The idea of a reminder and the idea of a SQL being injected into a chain, the test thinking of border conditions, excesses, data leaks is all the same. The traditional test background turns AI safe, 10 times easier than the conversion algorithm, and the window lasts two or three years.
If you really want to do this, you can choose Promptfoo, the Red team strategy is YAML into Git, and the model is automatically reset as soon as it is upgraded, making the Red team a comeback instead of a one-time audit. Agent's safety was the biggest increase in 2026, MCP tools were poisoned, indirectly injected into these attacks last year, and those who are now in the field are the ones who write best practices next year.
The kernel is the same thing as the attacker. Ammunition tools, hit where, you decide.
AI, security is a new land, the map is not yet finished, and the first man in the front yard is a flag.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.