0DIN Red
Agentic Red Teaming for AI.
0DIN Red is in beta. Features, setup steps, and outputs may change. Contact 0DIN@mozilla.com to join the beta.
What is 0DIN Red?
0DIN Red is 0DIN's AI assurance workspace. It tests AI systems the way an outside attacker would: it maps what your AI can reach and do, runs controlled assessments against it, keeps the evidence, and tracks each finding through remediation and retest.
0DIN Red is black-box and installs nothing in your system. It starts with no back-end access: only what you tell it when you set up an assessment and the access you give it. From there it probes for ways to reach more, as a real attacker would. Depending on the vulnerabilities in your application, it may gain back-end access during a run.
How it works
An AI agent explores your product the way a user would, in a real browser with recon tools alongside it. It tries attacks drawn from 0DIN's threat intelligence and bug bounty corpus, follows what it finds, and records each confirmed problem with the evidence behind it.
| What it tests | An AI product or agent as a user meets it: a web app, a chat UI, an API |
| What it needs from you | A URL, a dedicated test account, and a few sentences on how the system is used |
| Run time | Up to four hours by default, unattended |
Powered by real-world attack data
What sets 0DIN Red apart from other AI red teaming tools is the data behind it. 0DIN Red draws on 0DIN Intel, 0DIN's threat feed of verified GenAI vulnerabilities disclosed through the 0DIN bug bounty program by security researchers worldwide.
Instead of relying only on generic or synthetic attack lists, the agent adapts techniques that have already worked against real AI systems to your product. As researchers disclose new attacks, they become available to 0DIN Red, so your assessments keep pace with how AI systems are actually being broken.
What 0DIN Red looks for
0DIN Red focuses on what an AI system can be made to do, not only what it can be made to say:
- Data exposure - the AI reveals data it should not: system prompts, internal documents, credentials, other users' information
- Unauthorized actions - the AI takes an action the user is not allowed to take, such as sending, deleting, buying, or changing settings
- Tenant and role boundaries - one user or customer reaches another's data, or a low-privilege user gets admin behavior
- Prompt injection - content the AI reads (web pages, documents, emails, tool output) takes control of it
- Web application flaws - classic issues reached through the AI or the app around it: injection, cross-site scripting (XSS), server-side request forgery (SSRF), cross-site request forgery (CSRF), and path traversal
Jailbreaks and guardrail bypasses from 0DIN's disclosed vulnerability corpus are among the techniques the agent uses. A jailbreak on its own is not reported as a finding: it counts when it leads to one of the effects above.
You can narrow the focus when you set up an assessment. Left blank, 0DIN Red looks for all of it.
Where to go next
- Running an assessment - what to prepare, how a run works, and what you get back
- Data handling and privacy - what data 0DIN Red may see, what leaves your system, and why to test with staging and test accounts