Adversarial red-team evaluation suites
Continuously attack prompts/agents with jailbreak corpora and safety suites before and after each release.
At a glance — Oct 2026
Updated 2026-10-27 · forward this page: /jtbds/adversarial-red-team-evals#briefScores as of 2026-10-19 (8 days old).
- Depot Pick
- Promptfoo · 8.36/10 for this job (curated estimate, high confidence)
Distinct from `continuous-eval-ci` (quality gates) — safety adversarial focus. Confidence: high for Promptfoo red-team.
- Runner-up
- Patronus AI · 7.46/10
Scores higher than the pick on: Capability fit, Latency / reliability.
- When not to use the pick
- Patronus safety SKUs preferred, or Confident/DeepEval already embedded.
- Lock-in / migration
- The pick has lower stored lock-in risk than runner-up Patronus AI (2.5 vs 5.5). Pick exit signals: open source (provider tag `oss`). Self-host fallback listed for this job: Promptfoo.
- Sourced price (no comparable unit)
Pick: no sourced price in this job's unit (no_sourced_price).
No cheapest SKU (no_comparable_unit_for_job). No price was invented.
- Free option
- Promptfoo (oss) — source, as of 2026-10-25
- Failure modes to watch
- Eval contamination: Keep gold labels out of the agent prompt. Store the harness version beside the score. Do not compare a number across a benchmark revision without saying the revision changed.
- Weak verification: Success requires an end-state check the agent does not grade for itself: tests, a database diff, or a separate judge that cannot see the gold label.
- Benchmark protocol mismatch: Store assisted-or-not, subset, and harness version beside every cited score. Refuse a ranking that mixes those fields.
- Inter-agent misalignment: Log the assigned subtask next to the worker's stated result. The lead rejects a result that does not match the assignment.
- Non-determinism: Run the task more than once and compare the end state, not a single transcript. Record the trial count next to any success rate you cite.
- Observability gap: Alert on a drop in trace ingestion and on certificate expiry for the trace host. Do not treat a missing trace as a successful quiet run.
Cite: Agent Provider Depot, Depot Pick for adversarial-red-team-evals: promptfoo, scores as of 2026-10-19. Agents: GET /api/decide?jtbd=adversarial-red-team-evals
Free Red-team evals options · for eval-judge agents · for security-review agents
Promptfoo
Distinct from `continuous-eval-ci` (quality gates) — safety adversarial focus. Confidence: high for Promptfoo red-team.
Pricing (directional): As of 2026-10-24 (promptfoo.dev/pricing, fetched 2026-10-24): Community 'Free Forever' ('Our open-source tool, perfect for individual developers and small teams.') with 'Red teaming (10k probes/month)' and 'Run locally or self-host on your …
Lock-in risk: higher = more lock-in (worse). Overall already inverts this dimension.
Default OSS eval harness. Braintrust when you want hosted collaboration; Promptfoo when you want local/CI control.
Quote for Adversarial red-team evaluation suites
Depot Pick stays Promptfoo. Prices below are sourced SKU rows only (as of 2026-10-27). Input and output are not blended. GET /api/quote?jtbd=adversarial-red-team-evals
Nothing was compared. no comparable sourced unit for this job; chat input $/1M and other units were not borrowed pickIsPriceWinner is null.
Sourced price unavailable for the Depot Pick. No row in the pricing index.
4 of 5 candidates have no sourced price row. 5 are excluded from the Matching price comparison (none). no comparable sourced unit for this job; chat input $/1M and other units were not borrowed
Runners-up
Patronus AI
Layer on when regulated hallucination/safety gates matter more than general CI evals. Lakera for injection…
Confident AI
Best when your team already thinks in pytest/DeepEval. Braintrust remains Depot hosted-evals default…
Galileo
Pick for production hallucination measurement + guardrails. Braintrust/Promptfoo for lighter eval loops.
Lakera Guard
Depot pick for a dedicated prompt-injection firewall in front of any LLM. NeMo when you need programmable…
When NOT to use the top pick
Patronus safety SKUs preferred, or Confident/DeepEval already embedded.
Full ranking (score table)
Ranked with this JTBD's weights. Scores are curated estimates unless marked otherwise. Agents: prefer /api/decide then this table for tie-breaks.
| # | Provider | Overall | Fit | $/perf | Latency | DX | As of |
|---|---|---|---|---|---|---|---|
| 1 | PromptfooDepot Pick | 8.4 | 8.2 | 9.2 | 7.8 | 8.8 | 2026-10-19 |
| 2 | Lakera Guard | 8.2 | 8.8 | 7.8 | 8.4 | 9.0 | 2026-09-14 |
| 3 | Confident AI | 8.0 | 8.6 | 7.8 | 8.0 | 9.0 | 2026-09-14 |
| 4 | Galileo | 7.5 | 8.4 | 6.2 | 8.0 | 7.8 | 2026-09-14 |
| 5 | Patronus AI | 7.5 | 8.4 | 5.5 | 8.0 | 7.2 | 2026-09-14 |
Score methodology for this job
Distinct from `continuous-eval-ci` (quality gates) — safety adversarial focus. Confidence: high for Promptfoo red-team.
capabilityFit: 32%pricePerformance: 12%latencyReliability: 14%developerDx: 12%privacyPosture: 12%lockInRisk: 8%maturity: 10%