AI Security Tools Open Source 2026: 9 Projects to Protect Your LLM Stack

LLM apps have a new attack surface. These open-source tools cover scanning, red teaming, and runtime protection.

## AI Security Tools Open Source 2026: 9 Projects to Protect Your LLM Stack Securing an LLM application means defending prompt injection, data leakage, tool misuse, and model abuse. The open-source ecosystem now covers the full lifecycle: scan, test, monitor, protect. Here are nine projects worth knowing in 2026. ## The 9 Projects **1. OWASP LLM Top 10 + llm-verification.** Not a tool but the checklist that organizes everything. The OWASP Top 10 for LLM Applications is the de facto standard threat model. **2. garak (NVIDIA).** An LLM vulnerability scanner that runs hundreds of probes: prompt injection, jailbreak, data leakage, hallucination, encoding attacks. CLI-first, model-agnostic. The standard red-teaming entry point. **3. PyRIT (Microsoft).** Python Risk Identification Toolkit for automated red teaming. Includes jailbreak strategies, scoring, and conversation management. Designed to run at scale against APIs. **4. promptfoo.** Open-source LLM evaluation and red-teaming with regression testing. You write test cases (including injection payloads), it scores model outputs, and it fails CI on regressions. **5. LLM Guard (Protect AI).** Input/output sanitization: detects jailbreak attempts, PII, and prompt injection before they reach the model; filters secrets from outputs. **6. NeMo Guardrails (NVIDIA).** Adds rails around the dialog flow: topical rails block off-topic/harmful directions; fact-checking rails validate claims. Config-driven (Colang). **7. Guardrails AI.** Python library that validates LLM outputs against validators (regex, PII, toxicity, custom). Pairs with any model provider. **8. LangSmith / Langfuse (observability).** Langfuse is the open-source option: traces every prompt and tool call, making prompt injection and data exfiltration visible. **9. OWASP LLM Pentesting tools (garak + promptfoo + custom).** The practical stack most teams run: garak for breadth, promptfoo for regression, and a logging layer for runtime anomalies. ## The Minimal Production Setup 1. **Scan** - garak against every model before launch 2. **Regression** - promptfoo in CI with your injection test set 3. **Filter** - LLM Guard or NeMo Guardrails at the input/output boundary 4. **Observe** - Langfuse to trace and alert ## FAQ **Are these free?** All are open source (Apache-2.0/MIT mostly); some offer paid cloud versions. **Which one first?** garak - run it against your model and see what breaks. It takes 10 minutes to set up. **Do these protect against all LLM attacks?** No - they reduce risk. The model itself, your deployment, and your data pipeline are all part of the attack surface.