Before users jailbreak your LLM, try fuzzing it first

What it does

ps-fuzz is an interactive red-team tool for LLM applications. It reads your system prompt and launches a battery of simulated attacks—jailbreaks, prompt injections, vector-database poisoning, and system-prompt extraction—to see if your guardrails hold. After the run, it gives you a security evaluation and a Playground chat where you can iteratively rewrite the prompt and retest.

The interesting bit

Instead of running a static checklist, the fuzzer adapts its attack strategy to your system prompt’s domain and configuration. It also covers RAG-specific threats, testing whether poisoned documents in a vector store can override your instructions.

Key highlights

• 16 attack types, from Base64 evasion and typoglycemia to the “Hidden Parrot” RAG poisoning vector.
• Provider-agnostic: supports 16 LLM backends including OpenAI, Anthropic, Azure, and Ollama.
• Includes a Playground chat interface for iterative prompt hardening without leaving the tool.
• Can target self-hosted or custom endpoints via Ollama or OpenAI-compatible URLs.
• Runs multi-threaded tests and offers both interactive and unattended batch modes.

Caveats

• Every test consumes real API tokens, so automated CI runs could get expensive.
• Docker support is listed as “coming soon”; right now you install via pip.
• RAG poisoning tests require an embedding provider and chromadb.

Verdict

Worth a look if you are shipping an LLM app with a system prompt and want to red-team your own defenses first. Skip it if you need a free, static linter—this is an active, API-powered attack simulator.