Point RAGProbe at your chat endpoint and it sends 63 prompt-injection attacks, in 4 languages, from the OWASP Top 10 for LLMs — 123 once you plant a test string with --canary. Every hit is proved by a planted marker, not judged by another model, so the number is checkable and it can fail your CI build.
Free, offline until you point it at something, and nothing to sign up for. Works on Python 3.9 and later.
One dependency, no account, no API key. The attacks, the sample app and the benchmark are installed with it, so nothing else to download.
Ten seconds against a deliberately vulnerable sample app: it scans, turns on defences one at a time and rescans, printing a grade each time.
Sends the attacks to your endpoint and reports how many worked, with a 95% interval and the exact messages that got through. Add --canary with a test string from your system prompt to measure leaks, and --fail-over 0.05 to fail a build.
The attacker controls some text each app reads. RAGProbe measures whether that text can take the app over — then whether a layered defence stops it.
A support bot with a secret in its system prompt. Can a user talk it out, or hijack it?
Answers from retrieved docs — one written by the attacker. Does the poison get retrieved, and obeyed?
Reads and sends mail with tools. Can a planted email make it leak private data to an outsider?
RAGProbe Bench v2 — a frozen, versioned attack set, not a handful of ad-hoc prompts. Every earlier version stays exactly as it was, so a number published last month still means the same thing today.
Every runnable attack plants a secret canary, so success is scored by an oracle — no human judgement, no LLM-as-referee.
Each item carries its OWASP risk, technique, language, source and licence, split into train / dev / test so detectors are reported only on held-out data.
Every run records a manifest — version, commit, model, seed, and a fingerprint of the exact attacks — and caches model replies, so a number repeats exactly.
Bench v1, every runnable attack (82; 78 for Gemini, which cannot run tool-calling attacks). Lower is better for attacks; higher for questions.
Temperature 0, one trial per attack, free-tier APIs, reply budget 2048 tokens (4096 for gpt-oss 20B). Layered defence with the leetspeak-aware detector. Utility is 26 ordinary questions with no defence on. The extended line is Bench v2 (138 attacks; 134 for Gemini). gpt-oss 20B cut off some replies at its token limit; those score as 'attack failed', so its figures are lower bounds. Re-scored on 1 November 2026 after the oracle and retrieval fixes; leaks are through a poisoned document only. Intervals are wide at this sample size: when two intervals overlap the difference may be noise. Not a safety rating — see what these numbers do and do not show.
Two injection detectors on the labelled test split, split by language. Both caught roughly half as much German, and Meta’s Prompt Guard 2 almost none — but on 34 and 19 items neither gap is statistically significant.
A hardened prompt, data-marking, a detector, a tool policy and an output filter — stacked. Attack success falls from 92% to 0, with no legitimate requests wrongly blocked. On real models the same defence did not hold up: its one significant result lost significance once cut-off replies were excluded, and it did not repeat on a fresh set of attacks.
The victim here is a simulated model built to obey every instruction it can parse, so this measures the defences and the harness, not any real model. On real models the same defence clearly helped one of four — the honest version is in Real models above.
A grade per risk under the layered defence — the share of attacks that still get through. These grades come from the 12 hand-written scenarios that cover every risk, run against a simulated worst-case victim that obeys everything, so they test the defences and not a real model. The frozen benchmark is the bigger set (82 attacks in v1, 138 in v2), and the real-model numbers above come from that.
The numbers below come from a worst-case drill against a simulated victim, rebuilt on every push — including where the defences fall short.
The attacker's text hides in a tool description or a tool result and tells the agent to leak data. A rule about what a tool may do stops it however it arrives.
Each message looks harmless; together they build the attack. The layered defence stops the secret-leak chains but not all of the rest — an honest gap.
Invisible characters and look-alike letters hide the words from a keyword detector. Cleaning the text first brings detection back.
RAGProbe started as a pytest for RAG: a golden set, a baseline, and a CI gate that fails when a prompt or retrieval change quietly breaks answers. The dashboard and the report below are that half of the tool: they track answer quality on a sample app over time, not security. Live numbers from the latest run: