AI Security Scanning Tools for LLMs: 2026 Picks Compared

The AI security scanning tools for LLMs worth running in 2026 are NVIDIA garak for a baseline vulnerability scan, Promptfoo for CI-gated red teaming, Microsoft PyRIT for multi-turn attack campaigns, ModelScan or picklescan for model-file deserialization checks, and Snyk Agent Scan for MCP servers. All are open-source licensed, and no single one covers every layer.

The tools split along three surfaces. Behavior scanners send adversarial prompts to a live model or application and score the responses. Artifact scanners inspect serialized model files for code that executes on load, the pickle deserialization route to model-supply-chain compromise. Agent scanners inventory the MCP servers and skills an agent can reach. Runtime filters in the request path are a separate purchase, covered in the LLM firewall buying guide and the prompt injection detection tools overview.

The shortlist at a glance

Behavior scanners: garak, Promptfoo and PyRIT

garak is the default first scan. The Apache-2.0 NVIDIA project “checks if an LLM can be made to fail in a way we don’t want,” and its PyPI listing, which shows version 0.17.0 released September 9, 2026, compares it to nmap and Metasploit, “but for LLMs.” Probes cover DAN jailbreaks, PromptInject, encoding attacks, GCG adversarial suffixes, package hallucination, training data replay and malware generation, against targets from Hugging Face and OpenAI to AWS Bedrock, LiteLLM and generic REST endpoints. A README example:

python3 -m garak --target_type openai --target_name gpt-5-nano --spec probes.encoding

Each run writes a JSONL report plus a hit log of the attempts that produced a vulnerability. The garak paper (Derczynski et al., June 2024) explains the design: a vulnerability in one deployment context may not matter in another, so the tool is built for structured exploration rather than certification.

Promptfoo is the pick for pipelines. The MIT-licensed CLI and library for “evaluating and red-teaming LLM-based apps” runs from declarative configs with CI/CD integration. Its red-team mode breaks failure modes into adversarial “plugins,” including harmful content, broken object-level authorization (BOLA) and broken function-level authorization (BFLA), and produces a risk report with mitigation suggestions. The quickstart is three commands: npx promptfoo@latest redteam setup, then redteam run and redteam report.

Ownership changed this year. OpenAI announced on March 9, 2026 that it would acquire Promptfoo and integrate it into OpenAI Frontier, its enterprise agent platform, TechCrunch reported. Promptfoo’s announcement said the project “will remain open source” and keep supporting other providers. Teams testing non-OpenAI models should pin versions.

PyRIT is a framework rather than a scanner, built for operators running deliberate campaigns. The PyRIT paper (October 2024) describes six components: targets, converters that transform payloads (Base64, ROT13, leetspeak), prompt datasets, scorers that judge whether an attack succeeded, orchestrators that assemble attacks, and memory that logs every exchange. Supported techniques include Crescendo, PAIR, TAP, Skeleton Key and many-shot jailbreaking. The MIT-licensed project reached version 1.1.0 on September 4, 2026, per PyPI.

Model-file scanners: ModelScan, picklescan and fickling

Loading an untrusted model file is a code-execution decision. Hugging Face’s pickle documentation explains the mechanism: GLOBAL and STACK_GLOBAL opcodes import callables such as exec, and REDUCE invokes them during unpickling, so a PyTorch checkpoint can run arbitrary code on load. The Hub runs ClamAV on every file under 2 GB at each commit, lists pickle imports beside each file, and has Protect AI’s Guardian scan public repositories. Hugging Face still warns that its import check “is not 100% foolproof.” Scan again before load.

ModelScan, from Protect AI, covers the most formats. It reads file bytes for unsafe code signatures in H5, Pickle and SavedModel files, lists Keras V3, Joblib, Dill and Cloudpickle in its format table, and ranks findings CRITICAL, HIGH, MEDIUM or LOW. Install is pip install modelscan; the repository lists v0.8.8 as the latest release. Format coverage matters because, as Hugging Face puts it, “Pickle is not the only exploitable format out there”: Keras Lambda layers offer another route to arbitrary code execution.

picklescan is the lightweight CI option. The MIT-licensed scanner flags pickles that call dangerous globals such as eval(), reads PyTorch zip-format .bin and NumPy .npy files, and can pull a Hub repository directly with picklescan --huggingface ykilcher/totally-harmless-model. Exit codes of 0 (clean), 1 (malware found) and 2 (scan failed) make it a drop-in build gate. Version 1.0.5 shipped July 1, 2026.

fickling, from Trail of Bits, is the forensic tool: a “decompiler, static analyzer, and bytecode rewriter” for pickles, licensed LGPL-3.0. Beyond its --check-safety CLI flag, fickling ships fickling.hook.activate_safe_ml_environment(), which hooks pickle loading and blocks imports outside an allowlist of ML-library imports, turning detection into load-time enforcement. It also identifies and inspects PyTorch polyglot files.

Scanning backs up provenance; it does not replace it. OWASP’s LLM03:2025 Supply Chain entry calls for models “from verifiable sources,” integrity checks with signing and file hashes, and an SBOM or AI BOM inventory. Prefer safetensors wherever the framework supports it.

Agent and MCP scanners: Snyk Agent Scan

The tool many teams know as mcp-scan has moved: the invariantlabs-ai/mcp-scan repository now resolves to snyk/agent-scan, an Apache-2.0 “Security scanner for AI agents, MCP servers and agent skills.” Run with uvx snyk-agent-scan@latest, it auto-discovers configurations for clients including Claude Code, Claude Desktop, Cursor, Gemini CLI and Windsurf. Version 0.6 and later checks MCP servers for prompt injection, untrusted content, private data and destructive capabilities, and checks skills for malicious code and exposed secrets.

Two README caveats matter. The scanner requires a Snyk API token and sends component information, with secrets redacted, to the Agent Scan API. It also starts stdio MCP servers by executing their configured commands, so the project recommends a sandbox for untrusted configurations. The threat model behind these checks is laid out in AI agent security risks for 2026.

What do LLM scanners miss?

LLM scanners miss most design flaws that never show up in a single prompt and response: excessive tool permissions, broken retrieval access control and weak model provenance. A behavior scan runs known attack classes against the current model and system prompt. A clean report means those probes failed on that run, not that the deployment is safe.

Three gaps recur. Results are stochastic, so findings need success rates over repeated attempts, as the AI red team methodology guide sets out. Probe libraries trail new techniques. Artifact scanners look for code that runs on load, not for weights edited to change behavior; OWASP LLM03 notes that for models, “static inspection can offer little to security assurances.” Permission design and data classification still need the manual controls in the LLM security audit checklist.

How to wire scanners into a release pipeline

1. Within 7 days: put picklescan or ModelScan in front of every model download path, fail the build on any nonzero exit, and load third-party weights as safetensors where available.
2. Within 14 days: run a garak baseline against each production model and system prompt, archive the JSONL report, and rerun on every model, prompt or tool change.
3. Within 30 days: add promptfoo redteam run to CI for pull requests that touch prompts, tool definitions or retrieval sources.
4. Within 30 days: run Snyk Agent Scan in a sandbox on developer workstations and agent hosts, after a data-egress review of its API dependency.
5. Every quarter: run an operator-led PyRIT campaign with multi-turn strategies such as Crescendo against the highest-risk agent workflow.

FAQ

are there free ai security scanning tools for llms?

Yes. garak (Apache-2.0), PyRIT (MIT), Promptfoo (MIT), ModelScan (Apache-2.0) and picklescan (MIT) are free and open source, and together they cover model behavior and model files. Snyk Agent Scan is Apache-2.0 licensed but needs a Snyk API token, because it validates components through Snyk’s hosted Agent Scan API.

what is the difference between garak and pyrit?

garak is a ready-made scanner and PyRIT is a framework. garak runs prebuilt probe sets against a model endpoint from one command and writes a JSONL report of hits. PyRIT gives operators targets, converters, scorers, orchestrators and memory to script custom multi-turn attacks such as Crescendo. Most programs run garak routinely and PyRIT for targeted campaigns.

does hugging face scan models for malware?

Yes, but not exhaustively. Hugging Face runs ClamAV on every repository file under 2 GB at each commit, extracts and displays pickle imports, and has Protect AI’s Guardian scan public repositories. Its documentation says the pickle import check is not 100% foolproof, so scan downloaded weights locally with picklescan or ModelScan before loading them.

how often should you scan an llm for vulnerabilities?

Run automated scans on every change and deeper manual campaigns on a schedule. A model upgrade, fine-tuning run, system prompt edit, new tool registration or new retrieval source can each invalidate an earlier clean result, so wire garak or Promptfoo into CI for those triggers and run operator-led PyRIT campaigns quarterly or before major releases.