Your LLM security, tested and proven compliant.

~31,000 defensive adversarial prompts (injection, jailbreak, data leakage, toxicity, excessive agency, misinformation…) to replay against YOUR models with free tools (garak, promptfoo). The resulting report is your robustness evidence for the EU AI Act Annex IV file. On-prem, nothing leaves your infrastructure.

31 000+
adversarial prompts
8 bundles
6 OWASP categories
EU AI Act
Annex IV + OWASP/ATLAS/NIST
~50%
original in-house content

What we added recently

A living feed: here is the coverage added to it, dated.

  • +274 sondes
  • +82 sondes
  • +58 sondes
  • +104 sondes

Eight LLM attack surfaces covered.

Prompt Injection & Jailbreak

LLM01, direct/indirect injections, DAN, obfuscation, many-shot, Unicode smuggling.

Data leakage (PII)

LLM02, system-prompt extraction, secrets, PII, prior-turn leakage.

Insecure output handling

LLM05, inert XSS/SQLi/SSTI/exfil canaries that downstream code may mishandle.

Excessive agency

LLM06, proxy unsafe tool calls (delete, email exfil, shell) without approval.

Misinformation

LLM09, false facts, hallucinated citations/packages, false-premise agreement.

Unbounded consumption

LLM10, resource exhaustion / denial-of-wallet (loops, recursive expansion).

+ two bundles from reference benchmarks (permissive): harmful-content refusal and toxicity generation. Every prompt is labelled with its technique + OWASP category + MITRE ATLAS technique, with a coverage report. ~50% of the content is original (in-house generated, proprietary).

Compliance evidence, not just prompts.

01
Mapped to 4 frameworks

Every prompt → OWASP LLM Top 10 → EU AI Act (Art. 15 / Annex IV) → MITRE ATLAS → NIST AI 600-1.

02
Replayable, free tools

Formats ready for garak (NVIDIA) and promptfoo. One command, a pass/fail report on YOUR models.

03
On-prem, sovereign

You run it in-house. No prompt or model is sent to a third-party SaaS, essential for regulated orgs.

04
Multi-source + 50% in-house

Permissive sources (garak, MIT/Apache benchmarks) deduplicated + half original content generated by us.

05
Defensive by design

Payloads = harmless canaries (PWNED, reveal your prompt…). Real malware/CBRN/PII filtered at build.

06
Continuously growing

New techniques and categories added as LLM threats evolve. One key, always current.

How do I run it?

The pack ships prompts as JSONL, ready promptfoo tests (YAML) and a garak probe (tc_redteam.py). With garak: `garak --target_type ollama --target_name <model> --probes tc_redteam.Injection`. With promptfoo: `promptfoo eval --tests bundles/<bundle>/promptfoo-tests.yaml`. Both tools are free and open-source; point them at your model or endpoint.

How does it help with the EU AI Act?

EU AI Act Art. 15 requires robustness against adversarial attacks (adversarial examples, model evasion), and Annex IV requires the matching technical documentation. Replaying this feed against your system produces a test report, a direct documentation artifact for your compliance file. We also map NIST AI 600-1 (MEASURE actions) and MITRE ATLAS. Note: prompt-based coverage targets LLM01/02/05/06/07/09/10; architectural risks (LLM03/04/08) are process controls, not prompts.

What license? Can I redistribute it?

The pack is a proprietary subscription product (EULA included). You may use it to test your own systems; you may not redistribute, resell or build a competing feed from it. The ThreatClaw-generated original content (~half) and the compilation are our property; permissive third-party components keep their own license (attributed in the pack).

Ready to prove your LLMs are robust?

Annual subscription. Instant key. On-prem. Cancel anytime.

€349 / month, billed annually €4,188 excl. tax
Try before you buy: free demo pack

A sample of our in-house rules across every engine we run (Sigma, YARA, osquery, Velociraptor, Falco, network, policy), each detection with its investigation playbook in the CACAO 2.0 standard, importable into your SOAR. The Sigma rules come already converted for 6 SIEMs: Splunk, Sentinel, Elastic, QRadar, CrowdStrike and Panther. A NIS2 compliance-coverage sample is included. Generated without AI.

Download the demo pack .zip

What this pack does not cover

What we do not cover, we tell you

No one detects 100%, and a feed that claims otherwise burns out your analyst. Anything that does not compile on the real engine, or lights up on a benign corpus, never reaches the pack. What a rule cannot see, we show as a gap rather than paper over it. And by default the agent observes and proposes, acting only after human validation (human-in-the-loop). You buy signal, not volume.

Detection that holds up in front of the auditor

The question is no longer only “can I detect?” but “can I prove it?”. Every subscription ships with the compliance layer, at no extra cost.

Design coverage, not a certification nor a real-time measurement: it evidences that the catalogue addresses the requirement, your CISO validates compliance.

Detection guides

The method behind the pack, on our blog.

2026-08-23
Detecting Shadow AI: Finding Unsanctioned AI Use in Your Logs

Shadow AI is shadow IT's faster, leakier cousin. This guide covers what it is, why it is a real risk, and — the part nobody writes about — how to actually detect unsanctioned AI use in your network, proxy and endpoint logs, with a working Sigma rule.

2026-08-23
OWASP Top 10 for LLM Applications: A Practical Testing Reference

The full OWASP Top 10 for LLM Applications (2025 edition), explained the way most write-ups skip: for each of the 10 risks, what it is, a concrete example, and — the part that matters — how you actually test or detect it.

2026-07-22
When a Prompt Opens a Shell: RCE via Injection in AI Agents

Microsoft showed a single prompt can launch calc.exe via Semantic Kernel. CVE-2026-26030 and 25592 turn injection into RCE. How to test your own AI agents.

2026-07-16
Garak vs PyRIT vs Promptfoo: Choosing Your LLM Red Team Tools

A comparison of LLM red team tools: Garak scans the raw model, PyRIT runs multi-turn attacks, and Promptfoo tests the application in CI/CD before production.

2026-07-15
Red-Teaming an MCP Server: Testing Indirect Prompt Injection to Tool Execution

How to red-team an MCP server against indirect prompt injection: verify a poisoned document cannot reach a tool call, file access, or command execution.

2026-07-13
Protecting an LLM API with WAF Rules: SSRF and Prompt Injection

A WAF rule set (OWASP CRS/Coraza) placed in front of an LLM API blocks SSRF payloads and prompt injection attempts before they ever reach the application code.