ZeroLeaks/zeroleaks

What it solves

ZeroLeaks is a red-teaming tool designed to test the security of LLM system prompts and agent instructions. It helps developers identify if their prompts are vulnerable to extraction (leaking the prompt itself) or injection (tricking the model into ignoring instructions or misusing tools).

How it works

The tool loads a system prompt into a chosen model and simulates adversarial attacks using a multi-agent orchestration system. Six specialized agents (strategist, attacker, evaluator, mutator, inspector, and orchestrator) collaborate to plan attacks, analyze the target's responses, and adapt tactics in real-time. It uses a comprehensive corpus of behavioral probes and techniques like the Tree of Attacks with Pruning (TAP) to find vulnerabilities.

Who it’s for

It is intended for developers and security researchers who want to scan their system prompts for vulnerabilities from the command line or via a TypeScript library before deploying them to production.

Highlights

• Multi-agent attacks: Uses a team of six agents to dynamically adjust attack strategies.
• Injection corpus: Includes 78 behavioral probes covering tool hijacking, indirect injection, and authority abuse.
• Compliance judging: Employs an LLM judge to determine if a target actually complied with an attack, rather than relying on simple keyword checks.
• Flexible model selection: Allows users to specify different models for the attacker, target, evaluator, and judge roles.
• Broad provider support: Works with OpenRouter, OpenAI, and any OpenAI-compatible endpoint (e.g., Ollama, vLLM).
• Multi-turn grooming: Simulates complex attacks that build rapport over several turns before delivering a payload.