SuperRed

Spec sheet

Purpose

SuperRed is an open-source framework for red-teaming chatbots, agents, and assistants by testing whether attacks can violate security properties.Read 4 Oct 2026 · rdi.berkeley.edu

Intended users

The project describes use by red-teamers, system builders, and evaluators, and its guide covers wrapping systems, writing attackers, defining success criteria, and running evaluations.Read 4 Oct 2026 · rdi.berkeley.edu

Maker

The site says SuperRed was made at the University of California, Berkeley.Read 4 Oct 2026 · rdi.berkeley.edu

Attacks and benchmarks

The module catalogue lists 35 modules: 21 attackers, 6 targets, and 8 benchmarks.Read 4 Oct 2026 · rdi.berkeley.edu

Composable components

It treats the attacker, system under test, and benchmark as separate interchangeable modules coordinated by a controller.Read 4 Oct 2026 · rdi.berkeley.edu

Composable modules

It keeps attackers, systems under test, and security claims as interchangeable modules coordinated by a controller.Read 4 Oct 2026 · rdi.berkeley.edu

Evaluation reports

Runs record model, cost, and success rate; the framework provides live progress and browsable reports with per-task details and trajectories.Read 4 Oct 2026 · rdi.berkeley.edu

Example modules

Listed modules include PAIR, TAP, AutoDAN-Turbo, Crescendo, AgentVigil, HarmBench, AgentDojo, and DecodingTrust-Agent.Read 4 Oct 2026 · rdi.berkeley.edu

Installation

The guide installs the framework with pip install superred and describes it as a Python framework whose guide assumes familiarity with Python and asyncio.Read 4 Oct 2026 · rdi.berkeley.edu

Integration

The getting-started example connects to any LiteLLM-compatible model endpoint using a base URL and API key.Read 4 Oct 2026 · rdi.berkeley.edu

Intended audience

The getting-started guide is for people who can read Python and have seen asyncio, and PyPI lists Science/Research as an intended audience.Read 4 Oct 2026 · rdi.berkeley.edu

License and maturity

PyPI lists the package under the MIT license and classifies its development status as Alpha.Read 4 Oct 2026 · pypi.org

Metrics and reports

Runs record model, cost, and success rate, with a live terminal dashboard and a web report for results.Read 4 Oct 2026 · rdi.berkeley.edu

Model endpoints

The example target uses a LiteLLM-compatible endpoint with a base URL and API key; the guide says most LLM-driven attackers also call models through LiteLLM.Read 4 Oct 2026 · rdi.berkeley.edu

Parallel runs

The framework can run multiple threat models in parallel, each against its own system instance.Read 4 Oct 2026 · rdi.berkeley.edu

Requirements

The package requires Python 3.11 through 3.13; Python 3.14 is not supported.Read 4 Oct 2026 · pypi.org

Scale

The controller can run many threat models in parallel, each against its own system instance.Read 4 Oct 2026 · rdi.berkeley.edu

Security controls

The controller filters attacker-visible and injectable surfaces according to security-domain scopes and can cap attacker model spend per task.Read 4 Oct 2026 · rdi.berkeley.edu

Security scope

The controller filters which controllables, observables, trajectory entries, and evaluation sub-scores the optimizer can access according to the configured scope.Read 4 Oct 2026 · rdi.berkeley.edu

Sensitive results

Persisted trajectories are not scrubbed and may contain jailbreaks, planted secrets, and exfiltrated content, so the maker says to treat the results folder as sensitive.Read 4 Oct 2026 · rdi.berkeley.edu

Supported targets

Targets can wrap fixed-response fixtures, simulated environments, sandboxes, or live deployments, and the guide recommends staging or throwaway instances for real systems.Read 4 Oct 2026 · rdi.berkeley.edu

Target types

Targets can wrap fixed-response fixtures, simulated environments, sandboxes, or live deployments.Read 4 Oct 2026 · rdi.berkeley.edu

Threat models

Each run can define attacker model, per-task budget, trust-boundary access, and whether benchmark feedback is visible to the attacker.Read 4 Oct 2026 · rdi.berkeley.edu

Where Specifiction places it

• AI Security Testing Tools#27 of 296.7