Breakthemodel/
beforesomeoneelsedoes.

WRAITH is an autonomous red team for AI applications. It generates novel jailbreaks, indirect-injection payloads, and adversarial suffixes — then runs them against your model 24/7. Findings come with reproducible payloads, severity scoring, and harm classification.

Launch Platform →Read research
$wraith attack --target mythos-5 --strategy tap --budget 1000
Supported Target Providers
OpenAIAnthropicGoogle GeminiMeta LlamaMistralAWS BedrockTogether AIvLLMOllama

Every safety claim is a hypothesis.
We test it.

Frontier models pass internal evals and still fall to attacks that didn't exist last month. Adversarial suffixes generated by gradient search bypass RLHF. Multi-turn attacks like Crescendo escalate past refusal boundaries. Indirect injection via documents owns agentic systems. The attack surface grows faster than the eval suite — and red teams that ship continuously are the only ones who keep up.

⌗ Evals are snapshots.
⌗ Attackers iterate.
⌗ Coverage is asymptotic.
⌗ The window is always open.
0%
attack success rate of unmodified adversarial suffixes (Zou et al., 2023) against major open models on first deployment
<0
queries needed for PAIR to jailbreak GPT-4-class targets
0
current LLMs robust to multi-turn Crescendo attacks at long context
✦ CORE ADVERSARIAL VECTORS · 6 FLAGSHIP STRATEGIES

Signature Adversarial
Attack & Remediation Vectors

Frontier-tested jailbreaks, multi-turn conversational escalation, genetic prompt mutation, and agent tool-call hijacking. Click any module to inspect payload code and defensive patches.

85% ASR02

Prompt Automatic Iterative Refinement

attacker-LLM · iterativeOWASP LLM01

Attacker LLM iteratively queries the target, refining jailbreak payloads in a self-play feedback loop.

Inspect Payload→
89% ASR04

AutoDAN-II Genetic Optimization

evolutionary · templatesOWASP LLM01

Genetic template mutation and structural prompt engineering across evolving populations.

Inspect Payload→
91% ASR05

Crescendo Multi-Turn Escalation

multi-turn · steeringOWASP LLM01

Multi-turn benign-to-harmful conversational steering with adaptive backtracks upon refusal.

Inspect Payload→
86% ASR07

Libertas Alignment Pressure Bypass

alignment · pressureOWASP LLM01

Exploits system instruction boundary conflicts and policy evasion templates (L1B3RT4S).

Inspect Payload→
93% ASR09

Indirect Prompt Injection Simulator

RAG · context hijackOWASP LLM01

Simulates RAG document context (HTML, Markdown, Plain Text) carrying embedded directives.

Inspect Payload→
89% ASR10

Tool-Call Hijacking Simulator

agentic · function-callOWASP LLM08

Tests if prompt injections force models into executing sensitive backend tools.

Inspect Payload→
✦ UNIFIED SECURITY DATASETS & IN-BROWSER DOCUMENT STUDIO

300,000+ Verified Red-Team
Prompts, Jailbreaks & Policy Audits

Explore real-world security corpora integrated into WRAITH: AllenAI WildJailbreak (260k+ prompts), 16k Enterprise Human Jailbreaks, 39k MPDD Balanced Threat Corpus, and DAN Content Policy Overrides. Inspect, filter, and render classified PDF vulnerability reports live in your browser.

Loading datasets…

Set a target. Walk away.

WRAITH runs as a long-lived agent. Given a target model, a harm taxonomy, and a query budget, it selects strategies, mutates payloads, scores responses with a harm classifier, and feeds successful attacks back into its library. Findings are deduplicated, ranked by severity, and reproducible.

  • 01
    select_strategy() — bandit over PAIR, TAP, AutoDAN, Crescendo, BoN +4
  • 02
    mutate_payload() — genetic, template, or LLM-driven rewrite
  • 03
    score_response() — harm classifier + refusal detector
  • 04
    record_finding() — dedupe, severity, transferability
  • 05
    feed_library() — successful attacks become seeds
wraith-agent · mythos-5-proLIVE
Select target model
0 breaches

Every finding is reproducible.

F-0247·CRITICAL
open · disclosed 2026-05-16 · embargo 2026-08-14
id:F-0247
discovered:2026-05-16T14:32:11Z
target:claude-3.7-sonnet
strategy:crescendo+tap
turns:6
harm_class:cbrn_uplift
severity:critical
refusal_bypass_score:0.91
reproducibility:12/12
transferability:gpt-4o (yes), llama-3.3 (yes), gemini-2 (partial)
payload:[view sanitized →]
response:[redacted under disclosure policy]
Export to MITRE ATLASCoordinated disclosure

Measured against every public eval.

WRAITHPRIOR SOTA
0.00.10.20.30.40.50.60.70.80.91.0ATTACK SUCCESS RATE →HarmBench0.940.78Δ +0.16JailbreakBench0.910.75Δ +0.16AdvBench0.970.86Δ +0.11StrongREJECT0.860.69Δ +0.17HarmfulQA0.920.80Δ +0.12AgentBench-Adversarial0.820.62Δ +0.20
SIMULATED DATASETDemonstration data against fictional model stand-ins — the live engine produces real, seed-reproducible findings against your targets. Disclosure follows the 90-day coordinated-disclosure framework.