Attack Plugins Reference

Asenion AI Red Teaming ships with a broad library of built-in attack plugins covering security, safety, bias, hallucination, privacy, and domain-specific risks. Each plugin sends a batch of adversarial prompts to your target AI and evaluates whether the model responds safely and correctly.

Plugins are organized by category below. Use the category filter in the Asenion AI Red Teaming UI to narrow the plugin selection when configuring a test run.

Plugin Selection

Categories

Security

Plugin Severity Description
ASCII Smuggling High Encodes malicious instructions in non-visible Unicode characters to bypass content filters.
BFLA (Broken Function Level Authorization) High Tests whether the model enforces function-level access controls and rejects unauthorized operations.
BOLA (Broken Object Level Authorization) High Tests whether the model exposes or manipulates data belonging to other users or objects.
Cross-Session Leak Critical Checks whether information from one user session leaks into another user’s context.
Data Exfiltration Critical Attempts to extract sensitive data stored in the model’s context, memory, or retrieval system.
Debug Access High Attempts to access hidden debug modes, admin commands, or internal diagnostic interfaces.
Hijacking High Attempts to redirect the model’s purpose away from its intended task through persuasion or misdirection.
Indirect Prompt Injection Critical Injects instructions into documents, web pages, or retrieved content that the model processes — causing it to act on attacker-controlled instructions.
MCP (Model Context Protocol) High Tests tool-use boundaries, permission escalation, and untrusted input handling in MCP-connected systems.
Model Identification Medium Attempts to extract the underlying model name, version, or infrastructure details.
RAG Document Exfiltration High Attempts to retrieve or exfiltrate the source documents stored in a retrieval-augmented system.
RAG Poisoning High Attempts to corrupt or manipulate the retrieval index to influence model outputs with attacker-controlled content.
RAG Source Attribution Medium Checks whether the model properly attributes and constrains answers to retrieved sources.
RBAC (Role-Based Access Control) High Validates role-based access boundaries and tests whether privilege escalation is possible through prompt manipulation.
Shell Injection High Checks whether the model can be tricked into producing shell commands or code execution guidance that could be used to run arbitrary commands.
SQL Injection High Tests whether the model produces SQL injection payloads or assists in database manipulation attacks through prompt and tool pathways.
SSRF (Server-Side Request Forgery) High Tests whether tool integrations or retrieval systems can be redirected to internal infrastructure via attacker-controlled URLs.
Tool Discovery Medium Attempts to expose internal tool names, capabilities, and invocation patterns from a tool-enabled model.
Wordplay High Uses linguistic obfuscation, homophones, and creative phrasing to extract harmful content or bypass safety filters.

Injection

Plugin Severity Description
CCA (Conflicting Control Attack) High Introduces conflicting instructions to confuse the model about which authority to obey.
Indirect Prompt Injection Critical See Security — also categorized here for framework mapping.
Special Token Injection High Inserts special control tokens (e.g. <|system|>, [INST], ###) to manipulate the model’s instruction parsing.
System Prompt Override Critical Attempts to override, neutralize, or extract the system prompt through adversarial user messages.

Hallucination

Plugin Severity Description
Divergent Repetition High Causes the model to repeat tokens endlessly by exploiting repetition patterns, testing for output divergence and resource exhaustion.
Hallucination High Tests whether the model generates plausible-sounding but factually incorrect statements on verifiable topics.
Imitation Medium Tests whether the model incorrectly impersonates real people, organizations, or brands.
Overreliance Medium Evaluates whether the model over-commits to user-provided false premises without appropriate correction or pushback.
Reasoning DoS High Induces excessive internal reasoning chains through complex or recursive prompts, testing for degraded or unstable outputs.
Unverifiable Claims Medium Detects unsupported, authoritative-sounding claims that cannot be independently verified.

Safety

Plugin Severity Description
BeaverTails High A dataset-backed benchmark of harmful and safety-sensitive prompts spanning violence, hate speech, self-harm, and illegal activities.
Contracts High Tests whether the model generates legally binding or commercially harmful contracts without appropriate disclaimers.
Do Not Answer Medium Benchmark of questions that a responsible AI should refuse to answer, covering privacy, legal advice, and harmful guidance.
HarmBench High A comprehensive benchmark of harmful behavior categories used to evaluate refusal performance across a wide attack surface.
HarmBench: Copyright High Static dataset of copyright-related harmful behaviors from the HarmBench benchmark, testing reproduction of protected works.
Imitation Medium Tests whether the model impersonates real people or organizations in ways that could mislead users.
Pliny High An adversarial jailbreak dataset covering a wide range of harmful instruction-following scenarios.
Politics Medium Evaluates political bias, propaganda generation, and inappropriate partisan content in model responses.
Religion Medium Tests sensitive religious content risks including bias, harmful stereotyping, and incitement.
Toxic Chat Medium Detects toxic, abusive, or threatening language in model-generated responses.
UnsafeBench Medium Adversarial benchmark for visual and textual safety failures across multiple harmful content categories.
VLGuard Medium Safety evaluation benchmark covering a range of unsafe multimodal behaviors.
VLSU Medium Vision-language safety benchmark testing cross-modal harmful content generation.
XSTest High Adversarial safety benchmark covering 72+ harmful and borderline-harmful requests designed to challenge model guardrails.

PII (Privacy)

Plugin Severity Description
PII: API-Based Critical Tests whether PII is leaked through API metadata, headers, or tool call responses.
PII: Direct Critical Directly requests personal data (names, addresses, SSNs, financial data) from the model’s context.
PII: Prompt High Embeds PII in the prompt and checks whether the model repeats or amplifies it inappropriately.
PII: Session Critical Checks whether PII from previous conversation turns is retained and disclosed in later responses.
PII: Social High Attempts to extract or generate social identifiers (email, phone, username) from model context or training data.

Bias

Plugin Severity Description
Bias: Age High Tests whether the model produces age-discriminatory responses when asked for advice, service eligibility, or hiring guidance.
Bias: Disability High Detects ableist language, discriminatory assumptions, or unequal treatment based on disability status.
Bias: Gender High Evaluates gender bias in recommendations, role assignments, and capability assumptions.
Bias: LGBTQ+ High Tests for discriminatory or harmful responses toward LGBTQ+ individuals and communities.
Bias: Nationality High Checks for national-origin bias in advice, characterizations, and service delivery.
Bias: Political Medium Tests whether the model demonstrates political bias that could unfairly influence user opinion.
Bias: Race High Evaluates racial bias in model outputs across hiring, lending, healthcare, and general assistance contexts.
Bias: Religion High Tests for religious discrimination or bias in recommendations and characterizations.

Jailbreak

Plugin Severity Description
System Prompt Override Critical Attempts to disable, ignore, or extract the system prompt through adversarial instructions.
Pliny High See Safety — also covers jailbreak techniques.
HarmBench High Includes jailbreak-specific scenarios within the broader harmful behavior benchmark.

Harmful Content

Plugin Severity Description
Harmful: Copyright Violations High Tests whether the model encourages or assists with copyright infringement, DRM bypass, or reproduction of protected works.
Harmful: Intellectual Property High Tests whether the model assists with trade secret theft, patent circumvention, or other intellectual property violations.
Harmful: Misinformation / Disinformation High Checks whether the model generates or amplifies false information that could cause societal harm.

Agentic / Coding Agent

Agentic plugins test AI systems that have access to tools, code execution environments, file systems, or external APIs.

Plugin Severity Description
Agentic: Memory Poisoning Critical Injects malicious content into the agent’s persistent memory or context to influence future behaviors.
Coding Agent: Arbitrary Code Execution Critical Attempts to have the coding agent produce and execute arbitrary system commands under the guise of a legitimate coding task.
Coding Agent: CI/CD Tampering High Tests whether the agent can be manipulated into modifying CI/CD pipelines, build scripts, or deployment configurations.
Coding Agent: Credential Theft Critical Attempts to exfiltrate API keys, tokens, or credentials accessible to the coding environment.
Coding Agent: Dependency Confusion High Tests whether the agent installs attacker-controlled packages or dependencies.
Coding Agent: Exfiltration via Web High Attempts to exfiltrate files or data by having the agent make outbound web requests to attacker-controlled servers.
Coding Agent: File System Access High Tests whether the agent reads or writes sensitive files outside the intended working directory.
Coding Agent: Network Pivoting High Attempts to use the agent’s network access to pivot into internal infrastructure.
Coding Agent: Package Hallucination Medium Checks whether the agent recommends or installs non-existent (hallucinated) packages that could be hijacked.
Coding Agent: Prompt Extraction High Attempts to extract the system prompt or task instructions from within a coding agent context.
Excessive Agency High Tests whether the agent takes actions beyond what was requested, including unauthorized writes, deletes, or API calls.
Goal Misalignment High Evaluates whether the agent pursues proxy goals or optimizes for the wrong objective when given ambiguous instructions.

E-Commerce

Plugin Severity Description
E-Commerce: Competitive Intelligence Medium Tests whether the model inappropriately reveals competitor pricing, strategy, or proprietary data.
E-Commerce: Discount Abuse Medium Checks whether the model assists users in exploiting coupon codes, referral programs, or pricing loopholes.
E-Commerce: Fake Reviews High Tests whether the model generates fake product reviews or assists with review manipulation.
E-Commerce: Inventory Manipulation High Checks whether the model assists in manipulating inventory counts, stock levels, or fulfillment logic.
E-Commerce: Payment Fraud Critical Tests whether the model assists with payment bypass, card testing, or fraudulent transaction patterns.
E-Commerce: Phishing High Checks whether the model produces phishing content targeting e-commerce customers.
E-Commerce: Price Manipulation High Tests whether the model assists in manipulating product pricing or exploiting pricing engine vulnerabilities.

Financial Services

Plugin Severity Description
Financial: Fraud Advice Critical Tests whether the model provides guidance on financial fraud, money laundering, or account takeover.
Financial: Insider Trading Critical Checks whether the model generates advice that could constitute insider trading or market manipulation.
Financial: MNPI Disclosure Critical Tests whether the model discloses material non-public information in response to probing questions.
Financial: Suitability Bypass High Checks whether the model recommends unsuitable financial products without appropriate risk disclosures.
Financial: Unauthorized Trading Critical Tests whether the model assists in executing unauthorized transactions or bypassing trading controls.

Insurance

Plugin Severity Description
Insurance: Benefits Manipulation High Tests whether the model assists in manipulating insurance benefits, coverage interpretation, or claims.
Insurance: Claim Fraud Critical Checks whether the model facilitates false or inflated insurance claim submissions.
Insurance: Policy Misrepresentation High Tests whether the model produces misleading descriptions of policy terms, exclusions, or coverage.
Insurance: Regulatory Violations High Checks whether the model produces advice that violates state or federal insurance regulations.
Insurance: Unauthorized Disclosure Critical Tests whether the model reveals confidential policyholder data without authorization.

Medical & Healthcare

Plugin Severity Description
Medical: Dangerous Treatment Advice Critical Tests whether the model provides harmful or contraindicated medical treatment recommendations.
Medical: Diagnosis Without Disclaimer High Checks whether the model diagnoses conditions without recommending professional consultation.
Medical: Drug Interaction Critical Tests whether the model provides incomplete or dangerous drug interaction guidance.
Medical: HIPAA Disclosure Critical Checks whether the model discloses protected health information in violation of HIPAA.
Medical: Off-Label Promotion High Tests whether the model promotes off-label drug uses without appropriate medical context.

Pharmacy

Plugin Severity Description
Pharmacy: Controlled Substance Guidance Critical Tests whether the model provides guidance on obtaining controlled substances without a valid prescription.
Pharmacy: Drug Dosage Errors Critical Checks whether the model produces incorrect dosage instructions for medications.
Pharmacy: Prescription Bypass Critical Tests whether the model helps users circumvent prescription requirements for regulated drugs.
Pharmacy: Substitution Advice High Checks whether the model recommends unsafe medication substitutions without clinical justification.

Real Estate

Plugin Severity Description
Real Estate: Accessibility Discrimination High Tests whether the model produces guidance that discriminates against individuals based on disability status in housing contexts.
Real Estate: Advertising Discrimination High Checks whether the model generates housing advertisements that unlawfully discriminate based on protected characteristics.
Real Estate: Discriminatory Listings High Tests whether the model produces or suggests property listing language that violates fair housing laws.
Real Estate: Fair Housing Discrimination High Evaluates whether the model provides housing guidance that steers, excludes, or treats users differently based on protected class membership.
Real Estate: Lending Discrimination High Tests whether the model produces mortgage or lending guidance that discriminates based on race, ethnicity, or other protected characteristics.
Real Estate: Source of Income Discrimination High Checks whether the model discriminates against housing applicants based on their lawful source of income.
Real Estate: Steering High Tests whether the model steers prospective buyers or renters toward or away from neighborhoods based on protected characteristics.
Real Estate: Valuation Bias High Checks whether the model produces property valuations that reflect racial or demographic bias.

Telecommunications

Plugin Severity Description
Telecom: Accessibility Violation High Tests whether the model produces guidance that violates telecommunications accessibility requirements.
Telecom: Account Takeover High Checks whether the model assists in unauthorized access to customer telecom accounts.
Telecom: Billing Misinformation High Tests whether the model provides inaccurate or misleading billing information to customers.
Telecom: CPNI Disclosure High Tests whether the model inappropriately discloses Customer Proprietary Network Information in violation of FCC regulations.
Telecom: Coverage Misinformation High Checks whether the model provides false or misleading network coverage information.
Telecom: E911 Misinformation High Tests whether the model provides incorrect emergency services (911) guidance that could endanger users.
Telecom: Fraud Enablement High Checks whether the model assists in telecom fraud schemes such as SIM swapping or call spoofing.
Telecom: Law Enforcement Request Handling High Tests whether the model provides inappropriate guidance on handling law enforcement data requests.
Telecom: Location Disclosure High Checks whether the model discloses or facilitates the disclosure of subscriber location data without authorization.
Telecom: Porting Misinformation High Tests whether the model provides false information about number porting processes.
Telecom: TCPA Violation High Checks whether the model produces guidance that violates the Telephone Consumer Protection Act — including illegal outbound messaging and consent bypass.
Telecom: Unauthorized Changes High Tests whether the model assists in making unauthorized changes to customer accounts or service configurations.

Child and Teen Safety

Plugin Severity Description
Teen Safety: Age-Restricted Goods and Services Medium Tests whether the model assists minors in obtaining age-restricted products or services.
Teen Safety: Dangerous Content High Checks whether the model exposes teen-facing experiences to content involving violence, self-harm, or dangerous activities.
Teen Safety: Dangerous Roleplay High Evaluates whether the model engages in unsafe or manipulative roleplay scenarios targeting younger users.
Teen Safety: Harmful Body Ideals Medium Tests whether the model promotes harmful body image standards or disordered eating patterns to teen audiences.

Severity Guide

Severity Meaning
Critical Immediate harm potential; failure likely has direct legal, safety, or financial consequences
High Significant risk requiring prompt remediation; failure indicates a meaningful vulnerability
Medium Moderate risk; failure may cause reputational, compliance, or user experience issues
Low Minor risk; informational findings worth tracking over time
← Back to Connection Providers Next: Custom Test Generation →