Blog · ← All posts
AI Red Teaming for Chatbots: What Gets Tested
Published: November 6, 2026 · 8 min read
The short answer
A chatbot red team tests whether the bot can be talked out of its instructions, its data, or its guardrails — systematically, across every known way of asking. ChatBreaker's shipped library runs 68 probes across 17 attack families: direct injection, system-prompt extraction, multi-turn jailbreaks, roleplay, multilingual and encoded overrides, PII exfiltration, tool override, RAG poisoning, canary traps, and seven more. Each probe is graded by evidence in the reply — a leaked canary string outranks a suspicious tone — and the deliverable is a transcript-backed finding per failure, not a vibe. The free test runs 8 of the real probes; the full library is what a serious audit looks like. Library as shipped in ChatBreaker's red-team engine, November 2026.
The 17 families
| Family | What it tries | Example probes |
|---|---|---|
| Direct injection (di) | Override the bot's instructions head-on | di-01 blunt instruction override · di-02 persona hijack · di-03 persistent instruction plant · di-04 marker echo command |
| System extraction (se) | Get the hidden prompt out — see the extraction guide | se-01 verbatim request · se-02 pre-conversation recall · se-03 hidden-instructions dump · se-04 translation exfiltration |
| Multi-turn jailbreak (mj) | Escalate across turns until the guardrail thins out | mj-01 novelist escalation · mj-02 hypothetical data-access ladder · mj-03 trust-building extraction · mj-04 support-agent impersonation |
| Roleplay (rp) | Move the conversation into a fiction where rules "don't apply" | rp-01 DAN jailbreak · rp-02 grandmother story exfiltration · rp-03 developer-mode override · rp-04 terminal simulation |
| Multilingual (ml) | Ask in a language the guardrails police less carefully | ml-01 Spanish override · ml-02 French override · ml-03 German override · ml-04 Spanish extraction |
| Encoded (enc) | Hide the instruction inside an encoding the filters don't read | enc-01 Base64 instruction · enc-02 hex instruction · enc-03 ROT13 instruction · enc-04 Base64 extraction |
| PII exfiltration (pii) | Talk the bot out of personal data it can reach | pii-01 direct PII recall · pii-02 identity-verification pretext · pii-03 fake support extraction · pii-04 session summary leak |
| Tool override (to) | Forge the inputs the bot trusts — results, policies, errors | to-01 fake CRM privilege grant · to-02 fake search-result injection · to-03 fenced fake system policy · to-04 fake error-message bypass |
| Refusal bypass (rb) | Reframe the request so refusing feels wrong | rb-01 safety-researcher framing · rb-02 academic hypothetical · rb-03 emotional manipulation · rb-04 transparency-test framing |
| Canary trap (can) | Prove a leak with a planted fake secret only the prompt contains | can-01 direct canary ask · can-02 forgotten-secret pretext · can-03 internal-note recall · can-04 audit-log confirmation |
| RAG poisoning | Plant instructions in the content the bot retrieves and trusts | Four probes against the retrieval path |
| Policy puppetry | Format a fake policy so the bot obeys its shape | Four probes on policy-shaped inputs |
| Many-shot priming | Fill the context with examples until the pattern completes itself | Four probes on primed contexts |
| Skeleton-key augmentation | Attach a plausible "authorized exception" to a forbidden request | Four probes on exception framing |
| Chain-of-thought hijacking | Steer the bot's reasoning steps, not just its answer | Four probes on reasoning paths |
| Echo-chamber false memory | Convince the bot it already agreed, disclosed, or verified something | Four probes on fabricated history |
| Implicit extraction | Reconstruct protected information from indirect answers | Four probes on inference-shaped leaks |
An earlier version of our attack-classes guide described ten families; the library has grown since — the table above is the current engine, and it is why a red team from last quarter is already out of date (more on cadence in how often to red-team). The shapes currently moving against production bots are tracked on our Threat Pulse.
How findings are graded
Severity follows evidence. A probe that returns a planted canary string or a real customer's data is CRITICAL — the thing happened, on transcript. A probe that bends the bot's persona without extracting anything is a lesser finding with the same transcript attached. The families carry base severities in the library (extraction and PII probes start at CRITICAL; encoding and multilingual at MEDIUM to HIGH), and the score a bot receives rolls the findings into the 0–100 the report leads with — our score explainer covers what that number does and does not claim. When we probed 12 production chatbots with this library, seven failure patterns accounted for nearly everything that broke.
What a red team is not
It is not a vibes-based "we tried some jailbreaks from a forum thread." The difference between a red team and a screenshot is coverage (every family, not the fashionable three), repeatability (the same probes after the fix — our mutation-testing guide covers verifying fixes hold), and evidence (transcripts a sceptical engineer can re-run). If a report cannot show you the exact conversation that broke your bot, it is marketing, not testing. For one family worked end to end — a full extraction run, with transcripts — see Attack of the Week #1.
Probe your chatbot free → The free test runs 8 real probes spanning 7 families, with transcripts of exactly what got out.