Augustus is an open-source LLM vulnerability scanner built in Go by Praetorian that tests large language models against 210+ adversarial probes across 47 attack categories, including jailbreaks, prompt injection, data extraction, and RAG poisoning. It ships as a single binary with zero runtime dependencies and connects to 28 LLM providers out of the box. It is listed in the AI security category.
OWASP ranks prompt injection as the number one security risk in LLM applications, yet most organizations deploy LLMs into production with minimal adversarial testing. Augustus addresses this gap with a production-grade scanning framework that goes beyond research-oriented tools to deliver concurrent scanning, rate limiting, retry logic, and actionable vulnerability reports.
The scanner is part of Praetorian’s “The 12 Caesars” open-source security release campaign and is licensed under Apache 2.0.
What is Augustus?
Augustus operates through a five-stage pipeline: probe selection defines adversarial inputs, buff transformations apply optional evasion layers, generators send requests to target LLMs, detectors analyze responses, and a scoring engine records findings. This modular architecture lets security teams mix and match probes, transformations, and detectors to build custom scan profiles.
Unlike research-focused tools that prioritize breadth of academic coverage, Augustus targets production security testing. It handles concurrency through Go goroutine pools, includes built-in rate limiting to avoid API quota exhaustion, and supports proxy integration with tools like Burp Suite for interception and analysis.
Key Features
| Feature | Details |
|---|---|
| Probe Coverage | 210+ probes across 47 attack categories |
| Providers | 28 provider categories, 43 generator variants |
| Detectors | 90+ detection mechanisms (pattern matching, LLM-as-judge, HarmJudge, Perspective API) |
| Buff Transformations | 7 evasion techniques: Base64, character codes, paraphrase, poetry, translation, lowercase |
| Multi-Turn Attacks | Crescendo (gradual escalation), GOAT (adaptive technique switching), Hydra (backtracking), Mischievous User |
| Output Formats | Table, JSON, JSONL, and HTML reports |
| Proxy Support | Burp Suite integration for request interception |
| Concurrency | Goroutine pools with configurable parallelism |
| Language | Go (compiles to single portable binary) |
| License | Apache 2.0 |
Attack Categories
Augustus organizes its 210+ probes into distinct attack categories that target different weaknesses in LLM safety mechanisms:
| Category | Examples |
|---|---|
| Jailbreaks | DAN variants, AIM, AntiGPT, grandma exploits, ArtPrompt (ASCII art obfuscation) |
| Prompt Injection | Base64, ROT13, Morse code, hex encoding, tag smuggling, FlipAttack (16 variants) |
| Adversarial Examples | GCG, AutoDAN, PAIR, TAP, TreeSearch — iterative attacks using multi-turn conversations and judge-based scoring |
| Data Extraction | API key probes, package hallucination tests, PII leakage detection, training data replay |
| Context Manipulation | RAG poisoning, context overflow, conversation steering |
| Format Exploits | Markdown injection, YAML/JSON parsing attacks, ANSI escape sequences, XSS payloads |
| Evasion | ObscurePrompt, character substitution, homoglyphs, zero-width characters, glitch tokens |
| Safety Benchmarks | DoNotAnswer, RealToxicityPrompts, Snowball, LMRC |
Buff Transformations
Buffs are evasion layers applied to probes before they reach the target model. Augustus includes 7 transformation types that can be chained for layered evasion:
- Base64 and character code encoding — Obfuscates payloads to bypass text-based filters
- Pegasus paraphrase — Uses a paraphrase model to rephrase attack prompts while preserving intent
- Poetry formatting — Wraps payloads in haiku, sonnet, limerick, or free verse structures
- Low-resource language translation — Translates probes via DeepL into languages with weaker safety training
- Case transformation — Lowercase conversion to evade case-sensitive filters
Detection Methods
Augustus ships with 90+ detectors for evaluating whether a target model was successfully compromised:
- Pattern matching — Regex-based detection for known jailbreak indicators
- LLM-as-a-judge — Uses a separate LLM to evaluate whether the target’s response constitutes a successful attack
- HarmJudge — Semantic harm assessment aligned with the MLCommons AILuminate framework
- Perspective API — Google’s toxicity and threat scoring integration
- Unsafe content detection — Classification of harmful, biased, or policy-violating outputs
Multi-turn attack engines
Augustus includes four specialized multi-turn attack engines that conduct extended conversations with the target LLM:
- Crescendo — Gradual escalation over 10 turns, slowly building toward harmful content
- GOAT — Aggressive 7-technique strategy switching with Chain-of-Attack-Thought reasoning
- Hydra — Single-path with turn-level backtracking on refusal detection
- Mischievous User — Casual persona over 5 turns, designed to evade detection patterns
Advanced CLI options
Augustus supports fine-grained control over scan execution:
--concurrency 20— Configurable goroutine pools for parallel scanning--timeout 60m— Extended timeouts for iterative multi-turn probes--buffs-glob "encoding.*"— Chain multiple buff transformations--probes-glob "dan.*,goodside.*"— Pattern-based probe selection--format jsonl— Streaming output for pipeline integration--config '{...}'— Custom REST endpoint configuration for any OpenAI-compatible API
Getting Started
go install github.com/praetorian-inc/augustus/cmd/augustus@latest. Requires Go 1.25.3 or later. Compiles to a single binary with no additional dependencies. Alternatively, build from source with git clone && make build.export OPENAI_API_KEY="sk-..." for OpenAI, export ANTHROPIC_API_KEY="..." for Anthropic, or configure custom REST endpoints.augustus scan openai.OpenAI --probe dan.Dan_11_0 --detector dan.DAN --verbose. This runs a single DAN jailbreak probe and checks the response.augustus scan anthropic.Anthropic --all --buff encoding.Base64 --html report.html. This applies Base64 encoding to all probes.When to Use Augustus
Augustus is built for security professionals who need to test LLM deployments against real adversarial attacks in a production context. The single Go binary with built-in concurrency, rate limiting, and proxy support makes it practical for enterprise security teams, red teamers, and penetration testers.
It is particularly useful for pre-deployment security assessments (test before you ship), guardrail regression testing (verify fixes after model or prompt updates), red team exercises (systematic adversarial testing against deployed LLMs), and compliance validation (prove that LLM deployments were tested against known attack categories).
How Augustus Compares
Augustus fills a production-focused role among AI security tools. Compared to Garak, which is Python-based with deeper research coverage and a larger community, Augustus offers faster execution, lower memory footprint, and single-binary distribution. For mutation-based jailbreak fuzzing specifically, see FuzzyAI. For a broader evaluation framework that combines red teaming with prompt testing, look at Promptfoo. For Microsoft’s enterprise red teaming orchestrator, check PyRIT.
For runtime protection rather than pre-deployment scanning, consider Lakera Guard, LLM Guard, or NeMo Guardrails.
For a broader overview of AI security tools, see the AI security tools category page.
