Automated prompt injection audits via LLM-on-LLM interrogation

What it does

promptmap2 is a security scanner that bombards a target LLM application with adversarial prompts to see if it will leak system instructions, generate harmful content, or abandon its purpose. It supports both white-box testing, where you supply the system prompt and model details directly, and black-box testing against remote HTTP endpoints using a YAML-driven request schema. A separate controller LLM evaluates the target’s responses against pass/fail conditions defined in YAML rules, removing the need for brittle string matching or human eyeballing.

The interesting bit

The evaluation is the hard part of LLM red-teaming, and promptmap2 solves it by making another LLM do the judging. The controller model is given explicit success and failure criteria for each attack—such as whether the output contains the system prompt or refuses the request—and renders a verdict, which means the tool can handle nuanced, conversational responses that regex would miss.

Key highlights

• Dual-LLM architecture: a target model under test and an independent controller model that evaluates results.
• 50+ built-in test rules across six categories, including prompt stealing, jailbreaking, harmful content, hate speech, and social bias.
• Black-box HTTP scanning via lightweight YAML configs that support custom headers, payload encoding, proxies, and response slicing.
• Firewall testing mode to assess whether a guardrail LLM sitting in front of the main application actually catches malicious inputs.
• Supports commercial providers (OpenAI, Anthropic, Google, XAI) and local models via Ollama.

Caveats

• The controller LLM needs to be a strong model—GPT-5, Gemini 2.5 Pro, Claude 4 Sonnet, or similar—or evaluations may produce false positives and negatives.
• The tool was completely rewritten in 2025 after an initial 2023 release, so prior familiarity with the original may not transfer.

Verdict Teams shipping custom LLM applications or guardrail layers should consider this for systematic regression testing. If you are looking for a generic web vulnerability scanner or do not pay for API access to top-tier models, this is not your tool.