Open source red teaming and behavioral validation for agentic AI applications

NuGuard is an AI application security toolkit published as open source, with a hosted commercial edition offered at nuguard.ai from the company's base in San Jose, California. It runs in five stages. First it extracts an AI bill of materials, recognizing more than twenty agent frameworks including LangChain, the OpenAI Agents SDK, and CrewAI, so the test knows what it is looking at. Static analysis then examines the application code and its dependency tree for structural weaknesses, policy validation checks the configuration against the rules an organization has set, and behavioral testing exercises the agent inside a sandbox.

The final stage is adversarial. NuGuard drives a catalog of over a hundred attack scenarios covering prompt injection and jailbreaks, tool misuse, data exfiltration paths, API abuse, and supply chain compromise, with attack generation adapting based on what the application does and an automated judge scoring whether an attempt succeeded. Because the whole flow runs against the application rather than a live deployment, teams can use it pre-release without production access. Results are mapped to OWASP and MITRE references and exported in SARIF, CycloneDX, SPDX, JSON, or Markdown, which lets findings land in the same pipelines and dashboards a team already uses for code and dependency scanning.