#1LLM security, prompt injection, model extraction, adversarial AI, and AI red teaming tools.
Kitploit recommended
borealisai/stepjackBenchmarking framework for evaluating computer-use AI agents against multi-step indirect prompt injection, with automatic adversarial goal…
yingtaoren/d-scanAnalyzes LLM internal states and 100+ attention/probability features to train classifiers that detect document poisoning attacks in RAG systems.
ryehr/hitms_steganographyEmbed multiple secret messages in LLM chat token choices using arithmetic/Discop steganographic coders, with bit-exact decoding and steganalysis…
exploit-garbage/0day-rubbishRedefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to…
boxed-dev/vibe-coding-securityPre-launch security checklist for AI-generated apps (Lovable, v0, Bolt, Cursor). 69 checks covering Supabase RLS, exposed keys, and prompt injection.…
tihanyin/pssw100avbA list of useful Powershell scripts with 100% AV bypass (At the time of publication).
scythe-io/purple-team-exercise-frameworkPurple Team Exercise Framework
taleliyahu/threat_model_examplesA collection of real-world threat model examples across various technologies, providing practical insights into identifying and mitigating security…
cyb3rxp/awesome-socA curated knowledge base to build, run and mature a SOC (including CSIRT).
seezo-io/llm-security-101Delving into the Realm of LLM Security: An Exploration of Offensive and Defensive Tools, Unveiling Their Present Capabilities.
google/oss-fuzz-genLLM powered fuzzing via OSS-Fuzz.
harishsg993010/damn-vulnerable-mcp-serverDamn Vulnerable MCP Server
microsoft/ai-red-teaming-playground-labsAI Red Teaming playground labs to run AI Red Teaming trainings including infrastructure.
trinib/zorg-jailbreak-prompt-textBypass restricted and censored content on AI chat prompts 😈
cognitive-functors/c4-meta-systemProduction AI defense with 7-layer protection: mathematical constraints, object-capability access, distributed O2 consensus, SVETILO ethics. First…
george0papasotiriou/cve-2026-23001-hugging-face-transformers-model-deserialization-arbitrary-code-via-pickle-Proof-of-concept for CVE-2026-23001: demonstrates RCE through unsafe pickle deserialization in Hugging Face Transformers by crafting a malicious…
portswigger/css-the-bomb-inside-your-inboxAll the materials for Gareth Heyes' Black Hat talk: CSS: the bomb inside your inbox.
asamassekou10/ship-safeThe independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic…
