# Source: https://www.promptfoo.dev/docs/red-team/llm-vulnerability-types/

# Types of LLM vulnerabilities

This page documents categories of potential LLM vulnerabilities and failure modes.

Each vulnerability type is supported by Promptfoo's open-source plugins. [Plugins](/docs/red-team/plugins/) are a modular system for testing risks and vulnerabilities in LLM models and applications. See the [quickstart guide](/docs/red-team/quickstart/) to run your first red team.

![LLM vulnerability types](https://www.promptfoo.dev/img/og/docs-red-team-llm-vulnerability-types--og.png)

See also our specific guides on:

- [Red teaming AI agents](/docs/red-team/agents/)
- [Red teaming RAGs](/docs/red-team/rag/)
- [Red teaming multi-modal models](/docs/guides/multimodal-red-team/)
- [Testing and validating guardrails](/docs/guides/testing-guardrails/)

## Vulnerability Types

### Security Vulnerabilities

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [ASCII Smuggling](/docs/red-team/plugins/ascii-smuggling/) | Attempts to obfuscate malicious content using ASCII smuggling | `ascii-smuggling` |
| [BeaverTails](/docs/red-team/plugins/beavertails/) | Uses the BeaverTails prompt injection dataset | `beavertails` |
| [CCA](/docs/red-team/plugins/context-compliance-attack/) | Simulates Context Compliance Attacks to test whether an AI system can be tricked into generating restricted content using manipulated chat history. | `cca` |
| [Cross-Session Leak](/docs/red-team/plugins/cross-session-leak/) | Checks for information sharing between unrelated sessions | `cross-session-leak` |
| [CyberSecEval](/docs/red-team/plugins/cyberseceval/) | Tests prompt injection attacks using the CyberSecEval dataset | `cyberseceval` |
| [Debug Access](/docs/red-team/plugins/debug-access/) | Attempts to access or use debugging commands | `debug-access` |
| [Divergent Repetition](/docs/red-team/plugins/divergent-repetition/) | Tests whether an AI system can be manipulated into revealing its training data through repetitive pattern exploitation. | `divergent-repetition` |
| [DoNotAnswer](/docs/red-team/plugins/donotanswer/) | Tests how well LLMs handle harmful queries using the DoNotAnswer dataset | `donotanswer` |
| [Harmbench](/docs/red-team/plugins/harmbench/) | Tests prompt injection attacks using the Harmbench dataset | `harmbench` |
| [Hijacking](/docs/red-team/plugins/hijacking/) | Unauthorized or off-topic resource use | `hijacking` |
| [Indirect Prompt Injection](/docs/red-team/plugins/indirect-prompt-injection/) | Tests if the prompt is vulnerable to instructions injected into variables in the prompt | `indirect-prompt-injection` |
| [Malicious Code](/docs/red-team/plugins/mcp/) | Tests creation of malicious code | `harmful:cybercrime:malicious-code` |
| [Malicious Resource Fetching](/docs/red-team/plugins/ssrf/) | Server-Side Request Forgery (SSRF) tests | `ssrf` |
| [Memory Poisoning](/docs/red-team/plugins/memory-poisoning/) | Tests whether an agent is vulnerable to memory poisoning attacks | `agentic:memory-poisoning` |
| [Model Context Protocol](/docs/red-team/plugins/mcp/) | Tests for vulnerabilities to Model Context Protocol (MCP) attacks | `mcp` |
| [Pliny](/docs/red-team/plugins/pliny/) | Tests LLM systems using a curated collection of prompts from https://github.com/elder-plinius/L1B3RT4S | `pliny` |
| [Prompt Extraction](/docs/red-team/plugins/prompt-extraction/) | Attempts to get the model to reveal its system prompt | `prompt-extraction` |
| [RAG Document Exfiltration](/docs/red-team/plugins/rag-document-exfiltration) | Content related to RAG Document Exfiltration | `rag-document-exfiltration` |
| [RAG Poisoning](/docs/red-team/plugins/rag-poisoning/) | Tests resistance against poisoning attacks on RAG retrieval systems | `rag-poisoning` |
| [RBAC Enforcement](/docs/red-team/plugins/rbac/) | Tests whether the model properly implements Role-Based Access Control (RBAC) | `rbac` |
| [Reasoning DoS](/docs/red-team/plugins/reasoning-dos/) | Tests for vulnerability to computational resource exhaustion through excessive reasoning patterns. Applicable to reasoning models. | `reasoning-dos` |
| [Shell Injection](/docs/red-team/plugins/shell-injection/) | Attempts to execute shell commands through the model | `shell-injection` |
| [Special Token Injection](/docs/red-team/plugins/special-token-injection/) | Tests for special token injection vulnerabilities using conversation format delimiters | `special-token-injection` |
| [SQL Injection](/docs/red-team/plugins/sql-injection/) | Attempts to perform SQL injection attacks to manipulate database queries | `sql-injection` |
| [System Prompt Override](/docs/red-team/plugins/system-prompt-override) | Tests if an AI system can be manipulated to ignore or override its original system prompt | `system-prompt-override` |
| [Tool Discovery](/docs/red-team/plugins/tool-discovery/) | Tests if an AI system reveals the list of tools, functions, or API calls it has access to | `tool-discovery` |
| [XSTest](/docs/red-team/plugins/xstest/) | Tests how well LLMs handle ambiguous words (homonyms) that can have both harmful and benign interpretations | `xstest` |

### Privacy Vulnerabilities

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [COPPA](/docs/red-team/plugins/coppa/) | Tests compliance with children's privacy regulations (COPPA) | `coppa` |
| [FERPA](/docs/red-team/plugins/ferpa/) | Tests compliance with student educational privacy regulations (FERPA) | `ferpa` |
| [PII in API/Database](/docs/red-team/plugins/pii/) | PII exposed through API or database | `pii:api-db` |
| [Direct PII Exposure](/docs/red-team/plugins/pii/) | Direct exposure of PII | `pii:direct` |
| [PII in Session Data](/docs/red-team/plugins/pii/) | PII exposed in session data | `pii:session` |
| [PII via Social Engineering](/docs/red-team/plugins/pii/) | PII exposed through social engineering | `pii:social` |

### Criminal Activity

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Chemical & Biological Weapons](/docs/red-team/plugins/harmful/) | Content related to chemical or biological weapons | `harmful:chemical-biological-weapons` |
| [Child Exploitation](/docs/red-team/plugins/harmful/) | Content exploiting or harming children | `harmful:child-exploitation` |
| [Copyright Violations](/docs/red-team/plugins/harmful/) | Content violating copyright laws | `harmful:copyright-violations` |
| [Cybercrime](/docs/red-team/plugins/harmful/) | Content related to cybercriminal activities | `harmful:cybercrime` |
| [Illegal Activities](/docs/red-team/plugins/harmful/) | Content promoting illegal activities | `harmful:illegal-activities` |
| [Illegal Drugs](/docs/red-team/plugins/harmful/) | Content related to illegal drug use or trade | `harmful:illegal-drugs` |
| [Indiscriminate Weapons](/docs/red-team/plugins/harmful/) | Content related to weapons without context | `harmful:indiscriminate-weapons` |
| [Intellectual Property Violation](/docs/red-team/plugins/harmful/) | Content violating intellectual property rights | `harmful:intellectual-property` |
| [Non-Violent Crime](/docs/red-team/plugins/harmful/) | Content related to non-violent criminal activities | `harmful:non-violent-crime` |
| [Sex Crimes](/docs/red-team/plugins/harmful/) | Content related to sexual crimes | `harmful:sex-crime` |
| [Violent Crime](/docs/red-team/plugins/harmful/) | Content related to violent criminal activities | `harmful:violent-crime` |

### Harmful Activity

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Aegis](/docs/red-team/plugins/aegis/) | Evaluates model safety responses using the NVIDIA Aegis dataset | `aegis` |
| [Graphic Content](/docs/red-team/plugins/harmful/) | Displaying graphic or violent content | `harmful:graphic-content` |
| [Harassment and Bullying](/docs/red-team/plugins/harmful/) | Content that harasses or bullies individuals | `harmful:harassment-bullying` |
| [Hate Speech](/docs/red-team/plugins/harmful/) | Content that promotes hate or discrimination | `harmful:hate` |
| [Methamphetamine](/docs/red-team/plugins/harmful/) | Tests handling of methamphetamine-related content | `harmful:illegal-drugs:meth` |
| [Insults](/docs/red-team/plugins/harmful/) | Content that insults or demeans individuals | `harmful:insults` |
| [Profanity](/docs/red-team/plugins/harmful/) | Content containing profane or inappropriate language | `harmful:profanity` |
| [Radicalization](/docs/red-team/plugins/harmful/) | Content that promotes radical or extremist views | `harmful:radicalization` |
| [Self Harm](/docs/red-team/plugins/harmful/) | Content that encourages self-harm or suicide | `harmful:self-harm` |
| [Sexual Content](/docs/red-team/plugins/harmful/) | Explicit or inappropriate sexual content | `harmful:sexual-content` |
| [IED](/docs/red-team/plugins/harmful/) | Tests handling of Improvised Explosive Devices | `harmful:weapons:ied` |
| [ToxicChat](/docs/red-team/plugins/toxic-chat/) | Tests handling of toxic user prompts from the ToxicChat dataset | `toxic-chat` |
| [UnsafeBench](/docs/red-team/plugins/unsafebench/) | Tests handling of unsafe image content through multi-modal model evaluation | `unsafebench` |
| [VLGuard](/docs/red-team/plugins/vlguard/) | Tests handling of potentially unsafe image content using the VLGuard dataset | `vlguard` |
| [Wordplay](/docs/red-team/plugins/wordplay/) | Tests whether AI systems can be tricked into generating profanity through innocent-seeming wordplay | `wordplay` |

### Misinformation and Misuse

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Competitor Endorsement](/docs/red-team/plugins/competitors/) | Competitor mentions and endorsements | `competitors` |
| [Unsupervised Contracts](/docs/red-team/plugins/contracts/) | Enters business or legal commitments without supervision | `contracts` |
| [Excessive Agency](/docs/red-team/plugins/excessive-agency/) | Model taking excessive initiative or misunderstanding its capabilities | `excessive-agency` |
| [Goal Misalignment](/docs/red-team/plugins/goal-misalignment/) | Tests whether AI systems recognize when optimizing measurable proxy metrics might not align with true underlying objectives (Goodhart's Law) | `goal-misalignment` |
| [Hallucination](/docs/red-team/plugins/hallucination/) | Model generating false or misleading information | `hallucination` |
| [Misinformation and Disinformation](/docs/red-team/plugins/harmful/) | Spreading false or misleading information | `harmful:misinformation-disinformation` |
| [Specialized Advice](/docs/red-team/plugins/harmful/) | Providing advice in specialized fields without expertise | `harmful:specialized-advice` |
| [Unsafe Practices](/docs/red-team/plugins/harmful/) | Content promoting unsafe or harmful practices | `harmful:unsafe-practices` |
| [Imitation](/docs/red-team/plugins/imitation/) | Imitates people, brands, or organizations | `imitation` |
| [Off-Topic Manipulation](/docs/red-team/plugins/off-topic/) | Tests whether AI systems can be manipulated to go off-topic from their intended purpose | `off-topic` |
| [Overreliance](/docs/red-team/plugins/overreliance/) | Model susceptible to relying on an incorrect user assumption or input | `overreliance` |
| [Political Opinions](/docs/red-team/plugins/politics/) | Makes political statements | `politics` |
| [Religious Sensitivity](/docs/red-team/plugins/religion/) | Tests handling of religious content and bias | `religion` |
| [Unverifiable Claims](/docs/red-team/plugins/unverifiable-claims/) | Tests whether AI systems make claims that cannot be verified even in principle | `unverifiable-claims` |

### Bias

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Age Bias](/docs/red-team/plugins/bias/) | Tests handling of age bias, stereotypes, and discrimination | `bias:age` |
| [Disability Bias](/docs/red-team/plugins/bias/) | Tests handling of disability bias, stereotypes, and discrimination | `bias:disability` |
| [Gender Bias](/docs/red-team/plugins/bias/) | Tests handling of gender bias, stereotypes, and discrimination | `bias:gender` |
| [Race Bias](/docs/red-team/plugins/bias/) | Tests handling of racial bias, stereotypes, and discrimination | `bias:race` |

### Ecommerce

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [E-commerce Compliance Bypass](/docs/red-team/plugins/ecommerce/) | Tests for bypassing age, geographic, and regulatory restrictions on e-commerce products | `ecommerce:compliance-bypass` |
| [E-commerce Order Fraud](/docs/red-team/plugins/ecommerce/) | Tests for order fraud, transaction manipulation, and return/refund policy abuse | `ecommerce:order-fraud` |
| [E-commerce PCI DSS](/docs/red-team/plugins/ecommerce/) | Tests for PCI DSS violations and payment card data exposure | `ecommerce:pci-dss` |
| [E-commerce Price Manipulation](/docs/red-team/plugins/ecommerce/) | Tests for unauthorized pricing changes, discount abuse, and promotional policy violations | `ecommerce:price-manipulation` |

### Financial

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Financial Calculation Error](/docs/red-team/plugins/financial/#financial-calculation-error) | Tests for errors in financial calculations, risk assessments, or quantitative analysis | `financial:calculation-error` |
| [Financial Compliance Violation](/docs/red-team/plugins/financial/#financial-compliance-violation) | Tests for suggestions that violate securities laws, enable insider trading, or circumvent regulations | `financial:compliance-violation` |
| [Financial Confidential Disclosure](/docs/red-team/plugins/financial/#financial-confidential-disclosure) | Tests for inappropriate disclosure of MNPI, proprietary strategies, or confidential financial data | `financial:confidential-disclosure` |
| [Financial Counterfactual Narrative](/docs/red-team/plugins/financial/#financial-counterfactual) | Tests for false financial narratives or misleading market information | `financial:counterfactual` |
| [Financial Data Leakage](/docs/red-team/plugins/financial/#financial-data-leakage) | Tests for exposure of proprietary trading strategies or confidential financial data | `financial:data-leakage` |
| [Financial Defamation](/docs/red-team/plugins/financial/#financial-defamation) | Tests for false statements damaging financial entity reputations | `financial:defamation` |
| [Financial Hallucination](/docs/red-team/plugins/financial/#financial-hallucination) | Tests for fabricated market data, non-existent financial instruments, or fictional company information | `financial:hallucination` |
| [Financial Services Impartiality](/docs/red-team/plugins/financial/#financial-impartiality) | Tests for unauthorized financial advice or transaction facilitation | `financial:impartiality` |
| [Financial Services Misconduct](/docs/red-team/plugins/financial/#financial-misconduct) | Tests for facilitation of financial crimes or market manipulation | `financial:misconduct` |
| [Financial Sycophancy](/docs/red-team/plugins/financial/#financial-sycophancy) | Tests for agreeing with risky investment strategies or validating get-rich-quick schemes | `financial:sycophancy` |

### Medical

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Medical Anchoring Bias](/docs/red-team/plugins/medical/#medical-anchoring-bias) | Tests for medical anchoring bias where AI fixates on irrelevant information | `medical:anchoring-bias` |
| [Medical Hallucination](/docs/red-team/plugins/medical/#medical-hallucination) | Tests for fabricated medical facts, studies, or drug interactions | `medical:hallucination` |
| [Medical Incorrect Knowledge](/docs/red-team/plugins/medical/#medical-incorrect-knowledge) | Tests for factually wrong medical information that could cause harm | `medical:incorrect-knowledge` |
| [Medical Off-Label Use](/docs/red-team/plugins/medical/#medical-off-label-use) | Tests for inappropriate off-label medication recommendations without proper disclaimers | `medical:off-label-use` |
| [Medical Prioritization Error](/docs/red-team/plugins/medical/#medical-prioritization-error) | Tests for poor medical prioritization and triage decisions | `medical:prioritization-error` |
| [Medical Sycophancy](/docs/red-team/plugins/medical/#medical-sycophancy) | Tests for agreeing with incorrect medical assumptions to be helpful | `medical:sycophancy` |

### Pharmacy

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Controlled Substance Compliance](/docs/red-team/plugins/pharmacy/#controlled-substance-compliance) | Tests adherence to DEA regulations for controlled substance prescribing, dispensing, and monitoring | `pharmacy:controlled-substance-compliance` |
| [Dosage Calculation](/docs/red-team/plugins/pharmacy/#dosage-calculation) | Tests accuracy of pharmaceutical dosage calculations including weight-based dosing and renal adjustments | `pharmacy:dosage-calculation` |
| [Drug Interaction Detection](/docs/red-team/plugins/pharmacy/#drug-interaction-detection) | Tests identification of dangerous drug-drug, drug-food, and drug-supplement interactions | `pharmacy:drug-interaction` |

### Insurance

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Coverage Discrimination](/docs/red-team/plugins/insurance/#coverage-discrimination) | Tests for discriminatory coverage decisions based on protected characteristics violating ADA, Section 1557, and GINA | `insurance:coverage-discrimination` |
| [Network Misinformation](/docs/red-team/plugins/insurance/#network-misinformation) | Tests accuracy of provider network information to prevent surprise medical bills and balance billing | `insurance:network-misinformation` |
| [PHI Disclosure](/docs/red-team/plugins/insurance/#phi-disclosure) | Tests whether AI systems properly protect Protected Health Information (PHI) and comply with HIPAA privacy requirements | `insurance:phi-disclosure` |

### Custom

| Plugin Name | Description | Plugin ID |
| --- | --- | --- |
| [Custom Prompts](/docs/red-team/plugins/intent/) | Probes the model with specific inputs | `intent` |
| [Custom Topic](/docs/red-team/plugins/custom/) | Violates a custom configured policy | `policy` |

## Vulnerabilities by Application

Not all applications are vulnerable to certain types of exploits. Some vulnerabilities won't apply because of the LLM application's architecture. For example, a single-tenant chatbot without multiple user roles won't be vulnerable to broken access control vulnerabilities. Select a category below to see where vulnerabilities may not apply.

### Security Vulnerabilities

| Plugin Name | Description | Plugin ID | RAG | Agent | Chatbot |
| --- | --- | --- | --- | --- | --- |
| [Memory Poisoning](/docs/red-team/plugins/memory-poisoning/) | Tests whether an agent is vulnerable to memory poisoning attacks | `agentic:memory-poisoning` | ✅ | 🚨 | ✅ |
| [ASCII Smuggling](/docs/red-team/plugins/ascii-smuggling/) | Attempts to obfuscate malicious content using ASCII smuggling | `ascii-smuggling` | 🚨 | 🚨 | 🚨 |
| [BeaverTails](/docs/red-team/plugins/beavertails/) | Uses the BeaverTails prompt injection dataset | `beavertails` | 🚨 | 🚨 | 🚨 |
| [Privilege Escalation](/docs/red-team/plugins/bfla/) | Broken Function Level Authorization (BFLA) tests | `bfla` | 🚨 | 🚨 | ✅ |
| [Unauthorized Data Access](/docs/red-team/plugins/bola/) | Broken Object Level Authorization (BOLA) tests | `bola` | 🚨 | 🚨 | ✅ |
| [CCA](/docs/red-team/plugins/context-compliance-attack/) | Simulates Context Compliance Attacks to test whether an AI system can be tricked into generating restricted content using manipulated chat history. | `cca` | 🚨 | 🚨 | ✅ |
| [Cross-Session Leak](/docs/red-team/plugins/cross-session-leak/) | Checks for information sharing between unrelated sessions | `cross-session-leak` | 🚨 | 🚨 | 🚨 |
| [CyberSecEval](/docs/red-team/plugins/cyberseceval/) | Tests prompt injection attacks using the CyberSecEval dataset | `cyberseceval` | 🚨 | 🚨 | 🚨 |
| [Harmbench](/docs/red-team/plugins/harmbench/) | Tests prompt injection attacks using the Harmbench dataset | `harmbench` | 🚨 | 🚨 | 🚨 |
| [Debug Access](/docs/red-team/plugins/debug-access/) | Attempts to access or use debugging commands | `debug-access` | 🚨 | 🚨 | ✅ |
| [Divergent Repetition](/docs/red-team/plugins/divergent-repetition/) | Tests whether an AI system can be manipulated into revealing its training data through repetitive pattern exploitation. | `divergent-repetition` | 🚨 | 🚨 | 🚨 |
| [DoNotAnswer](/docs/red-team/plugins/donotanswer/) | Tests how well LLMs handle harmful queries using the DoNotAnswer dataset | `donotanswer` | 🚨 | 🚨 | 🚨 |
| [Malicious Code](/docs/red-team/plugins/harmful/) | Tests creation of malicious code | `harmful:cybercrime:malicious-code` | 🚨 | 🚨 | 🚨 |
| [Hijacking](/docs/red-team/plugins/hijacking/) | Unauthorized or off-topic resource use | `hijacking` | 🚨 | 🚨 | 🚨 |
| [Indirect Prompt Injection](/docs/red-team/plugins/indirect-prompt-injection/) | Tests if the prompt is vulnerable to instructions injected into variables in the prompt | `indirect-prompt-injection` | 🚨 | 🚨 | ✅ |
| [Model Context Protocol](/docs/red-team/plugins/mcp/) | Tests for vulnerabilities to Model Context Protocol (MCP) attacks | `mcp` | 🚨 | 🚨 | 🚨 |
| [Pliny](/docs/red-team/plugins/pliny/) | Tests LLM systems using a curated collection of prompts from https://github.com/elder-plinius/L1B3RT4S | `pliny` | 🚨 | 🚨 | 🚨 |
| [Prompt Extraction](/docs/red-team/plugins/prompt-extraction/) | Attempts to get the model to reveal its system prompt | `prompt-extraction` | 🚨 | 🚨 | 🚨 |
| [RAG Document Exfiltration](/docs/red-team/plugins/rag-document-exfiltration) | Content related to RAG Document Exfiltration | `rag-document-exfiltration` | 🚨 | 🚨 | 🚨 |
| [RAG Poisoning](/docs/red-team/plugins/rag-poisoning/) | Tests resistance against poisoning attacks on RAG retrieval systems | `rag-poisoning` | 🚨 | 🚨 | 🚨 |
| [RBAC Enforcement](/docs/red-team/plugins/rbac/) | Tests whether the model properly implements Role-Based Access Control (RBAC) | `rbac` | 🚨 | 🚨 | ✅ |
| [Reasoning DoS](/docs/red-team/plugins/reasoning-dos/) | Tests for vulnerability to computational resource exhaustion through excessive reasoning patterns. Applicable to reasoning models. | `reasoning-dos` | 🚨 | 🚨 | 🚨 |
| [Shell Injection](/docs/red-team/plugins/shell-injection/) | Attempts to execute shell commands through the model | `shell-injection` | 🚨 | 🚨 | ✅ |
| [Special Token Injection](/docs/red-team/plugins/special-token-injection/) | Tests for special token injection vulnerabilities using conversation format delimiters | `special-token-injection` | 🚨 | 🚨 | 🚨 |
| [SQL Injection](/docs/red-team/plugins/sql-injection/) | Attempts to perform SQL injection attacks to manipulate database queries | `sql-injection` | 🚨 | 🚨 | ✅ |
| [Malicious Resource Fetching](/docs/red-team/plugins/ssrf/) | Server-Side Request Forgery (SSRF) tests | `ssrf` | 🚨 | 🚨 | ✅ |
| [System Prompt Override](/docs/red-team/plugins/system-prompt-override) | Tests if an AI system can be manipulated to ignore or override its original system prompt | `system-prompt-override` | 🚨 | 🚨 | ✅ |
| [Tool Discovery](/docs/red-team/plugins/tool-discovery/) | Tests if an AI system reveals the list of tools, functions, or API calls it has access to | `tool-discovery` | 🚨 | 🚨 | 🚨 |
| [XSTest](/docs/red-team/plugins/xstest/) | Tests how well LLMs handle ambiguous words (homonyms) that can have both harmful and benign interpretations | `xstest` | 🚨 | 🚨 | 🚨 |

### Privacy Violations

| Plugin Name | Description | Plugin ID | RAG | Agent | Chatbot |
| --- | --- | --- | --- | --- | --- |
| [COPPA](/docs/red-team/plugins/coppa/) | Tests compliance with children's privacy regulations (COPPA) | `coppa` | 🚨 | 🚨 | 🚨 |
| [FERPA](/docs/red-team/plugins/ferpa/) | Tests compliance with student educational privacy regulations (FERPA) | `ferpa` | 🚨 | 🚨 | 🚨 |
| [Privacy Violation](/docs/red-team/plugins/harmful/) | Content violating privacy rights | `harmful:privacy` | 🚨 | 🚨 | 🚨 |
| [PII in API/Database](/docs/red-team/plugins/pii/) | PII exposed through API or database | `pii:api-db` | 🚨 | 🚨 | ✅ |
| [Direct PII Exposure](/docs/red-team/plugins/pii/) | Direct exposure of PII | `pii:direct` | 🚨 | 🚨 | ✅ |
| [PII in Session Data](/docs/red-team/plugins/pii/) | PII exposed in session data | `pii:session` | 🚨 | 🚨 | ✅ |
| [PII via Social Engineering](/docs/red-team/plugins/pii/) | PII exposed through social engineering | `pii:social` | 🚨 | 🚨 | ✅ |

### Criminal Activities

| Plugin Name | Description | Plugin ID | RAG | Agent | Chatbot |
| --- | --- | --- | --- | --- | --- |
| [Chemical & Biological Weapons](/docs/red-team/plugins/harmful/) | Content related to chemical or biological weapons | `harmful:chemical-biological-weapons` | 🚨 | 🚨 | 🚨 |
| [Child Exploitation](/docs/red-team/plugins/harmful/) | Content exploiting or harming children | `harmful:child-exploitation` | 🚨 | 🚨 | 🚨 |
| [Copyright Violations](/docs/red-team/plugins/harmful/) | Content violating copyright laws | `harmful:copyright-violations` | 🚨 | 🚨 | 🚨 |
| [Cybercrime](/docs/red-team/plugins/harmful/) | Content related to cybercriminal activities | `harmful:cybercrime` | 🚨 | 🚨 | 🚨 |
| [Illegal Activities](/docs/red-team/plugins/harmful/) | Content promoting illegal activities | `harmful:illegal-activities` | 🚨 | 🚨 | 🚨 |
| [Illegal Drugs](/docs/red-team/plugins/harmful/) | Content related to illegal drug use or trade | `harmful:illegal-drugs` | 🚨 | 🚨 | 🚨 |
| [Indiscriminate Weapons](/docs/red-team/plugins/harmful/) | Content related to weapons without context | `harmful:indiscriminate-weapons` | 🚨 | 🚨 | 🚨 |
| [Intellectual Property Violation](/docs/red-team/plugins/harmful/) | Content violating intellectual property rights | `harmful:intellectual-property` | 🚨 | 🚨 | 🚨 |
| [Non-Violent Crime](/docs/red-team/plugins/harmful/) | Content related to non-violent criminal activities | `harmful:non-violent-crime` | 🚨 | 🚨 | 🚨 |
| [Sex Crimes](/docs/red-team/plugins/harmful/) | Content related to sexual crimes | `harmful:sex-crime` | 🚨 | 🚨 | 🚨 |
| [Violent Crime](/docs/red-team/plugins/harmful/) | Content related to violent criminal activities | `harmful:violent-crime` | 🚨 | 🚨 | 🚨 |

### Harmful Content

| Plugin Name | Description | Plugin ID | RAG | Agent | Chatbot |
| --- | --- | --- | --- | --- | --- |
| [Aegis](/docs/red-team/plugins/aegis/) | Evaluates model safety responses using the NVIDIA Aegis dataset | `aegis` | 🚨 | 🚨 | 🚨 |
| [Graphic Content](/docs/red-team/plugins/harmful/) | Displaying graphic or violent content | `harmful:graphic-content` | 🚨 | 🚨 | 🚨 |
| [Harassment and Bullying](/docs/red-team/plugins/harmful/) | Content that harasses or bullies individuals | `harmful:harassment-bullying` | 🚨 | 🚨 | 🚨 |
| [Hate Speech](/docs/red-team/plugins/harmful/) | Content that promotes hate or discrimination | `harmful:hate` | 🚨 | 🚨 | 🚨 |
| [Methamphetamine](/docs/red-team/plugins/harmful/) | Tests handling of methamphetamine-related content | `harmful:illegal-drugs:meth` | 🚨 | 🚨 | 🚨 |
| [Insults](/docs/red-team/plugins/harmful/) | Content that insults or demeans individuals | `harmful:insults` | 🚨 | 🚨 | 🚨 |
| [Profanity](/docs/red-team/plugins/harmful/) | Content containing profane or inappropriate language | `harmful:profanity` | 🚨 | 🚨 | 🚨 |
| [Radicalization](/docs/red-team/plugins/harmful/) | Content that promotes radical or extremist views | `harmful:radicalization` | 🚨 | 🚨 | 🚨 |
| [Self Harm](/docs/red-team/plugins/harmful/) | Content that encourages self-harm or suicide | `harmful:self-harm` | 🚨 | 🚨 | 🚨 |
| [Sexual Content](/docs/red-team/plugins/harmful/) | Explicit or inappropriate sexual content | `harmful:sexual-content` | 🚨 | 🚨 | 🚨 |
| [IED](/docs/red-team/plugins/harmful/) | Tests handling of Improvised Explosive Devices | `harmful:weapons:ied` | 🚨 | 🚨 | 🚨 |
| [ToxicChat](/docs/red-team/plugins/toxic-chat/) | Tests handling of toxic user prompts from the ToxicChat dataset | `toxic-chat` | 🚨 | 🚨 | 🚨 |
| [UnsafeBench](/docs/red-team/plugins/unsafebench/) | Tests handling of unsafe image content through multi-modal model evaluation | `unsafebench` | 🚨 | 🚨 | 🚨 |
| [VLGuard](/docs/red-team/plugins/vlguard/) | Tests handling of potentially unsafe image content using the VLGuard dataset | `vlguard` | 🚨 | 🚨 | 🚨 |
| [Wordplay](/docs/red-team/plugins/wordplay/) | Tests whether AI systems can be tricked into generating profanity through innocent-seeming wordplay | `wordplay` | 🚨 | 🚨 | 🚨 |

### Misinformation and Misuse

| Plugin Name | Description | Plugin ID | RAG | Agent | Chatbot |
| --- | --- | --- | --- | --- | --- |
| [Competitor Endorsement](/docs/red-team/plugins/competitors/) | Competitor mentions and endorsements | `competitors` | 🚨 | 🚨 | 🚨 |
| [Unsupervised Contracts](/docs/red-team/plugins/contracts/) | Enters business or legal commitments without supervision | `contracts` | 🚨 | 🚨 | 🚨 |
| [Excessive Agency](/docs/red-team/plugins/excessive-agency/) | Model taking excessive initiative or misunderstanding its capabilities | `excessive-agency` | 🚨 | 🚨 | 🚨 |
| [Goal Misalignment](/docs/red-team/plugins/goal-misalignment/) | Tests whether AI systems recognize when optimizing measurable proxy metrics might not align with true underlying objectives (Goodhart's Law) | `goal-misalignment` | 🚨 | 🚨 | 🚨 |
| [Hallucination](/docs/red-team/plugins/hallucination/) | Model generating false or misleading information | `hallucination` | 🚨 | 🚨 | 🚨 |
| [Misinformation and Disinformation](/docs/red-team/plugins/harmful/) | Spreading false or misleading information | `harmful:misinformation-disinformation` | 🚨 | 🚨 | 🚨 |
| [Specialized Advice](/docs/red-team/plugins/harmful/) | Providing advice in specialized fields without expertise | `harmful:specialized-advice` | 🚨 | 🚨 | 🚨 |
| [Unsafe Practices](/docs/red-team/plugins/harmful/) | Content promoting unsafe or harmful practices | `harmful:unsafe-practices` | 🚨 | 🚨 | 🚨 |
| [Imitation](/docs/red-team/plugins/imitation/) | Imitates people, brands, or organizations | `imitation` | 🚨 | 🚨 | 🚨 |
| [Off-Topic Manipulation](/docs/red-team/plugins/off-topic/) | Tests whether AI systems can be manipulated to go off-topic from their intended purpose | `off-topic` | 🚨 | 🚨 | 🚨 |
| [Overreliance](/docs/red-team/plugins/overreliance/) | Model susceptible to relying on an incorrect user assumption or input | `overreliance` | 🚨 | 🚨 | 🚨 |
| [Political Opinions](/docs/red-team/plugins/politics/) | Makes political statements | `politics` | 🚨 | 🚨 | 🚨 |
| [Religious Sensitivity](/docs/red-team/plugins/religion/) | Tests handling of religious content and bias | `religion` | 🚨 | 🚨 | 🚨 |
| [Unverifiable Claims](/docs/red-team/plugins/unverifiable-claims/) | Tests whether AI systems make claims that cannot be verified even in principle | `unverifiable-claims` | 🚨 | 🚨 | 🚨 |

### Bias

| Plugin Name | Description | Plugin ID | RAG | Agent | Chatbot |
| --- | --- | --- | --- | --- | --- |
| [Age Bias](/docs/red-team/plugins/bias/) | Tests handling of age bias, stereotypes, and discrimination | `bias:age` | 🚨 | 🚨 | 🚨 |
| [Disability Bias](/docs/red-team/plugins/bias/) | Tests handling of disability bias, stereotypes, and discrimination | `bias:disability` |