OWASP GenAI Red Teaming Guide

What this guide is

The GenAI Red Teaming Guide comes from the same OWASP project that publishes the Top 10 for LLM Applications and the Top 10 for Agentic Applications. Version 1.0 was published on 22 January 2025. It is written for security professionals, AI and ML engineers, red team practitioners, risk managers and the leaders who commission red team work.

Where the Top 10 lists tell you what can go wrong, this guide tells you how to plan and run a structured test of a generative AI system to find out whether it does.

What it covers

The guide takes what it calls a holistic approach in four areas:

• Model evaluation: how the model itself behaves, including harmful output, bias and robustness.
• Implementation testing: the application around the model, such as prompts, retrieval, guardrails and tools.
• Infrastructure assessment: the hosting, APIs, data stores and supply chain the system depends on.
• Runtime behaviour analysis: how the deployed system behaves with real users, agents and integrations over time.

Around these it discusses why AI red teaming differs from classic penetration testing, how to scope an engagement, which risks to prioritise, the blend of manual and automated testing, and how to report findings in a way that leads to fixes.

Is it worth your time?

Yes, especially on the red-teaming side of AI security. Many beginners start with tools and collections of jailbreak prompts and never learn method. This guide gives you the method: a scope, a risk list, test rounds, evidence and a report. It also helps app builders, because knowing how a red team will approach your system tells you what evidence to prepare.

It stays at the level of process and risk categories rather than handing out attack strings, which makes it a safe, professional starting point.

How to use it well

• Read it before running garak, PyRIT or promptfoo, so the tools serve a plan rather than replace one.
• Use its four areas as headings in your own test plan for an app you built.
• Map each finding to an OWASP LLM risk or a MITRE ATLAS technique so other teams understand it.
• Practise only on systems you own or have written permission to test.

Free or paid?

Free to download from the OWASP Gen AI Security Project site.