Wednesday, 09:14. The red-team lead at Acme Corp opens a Slack DM from the Chief AI Officer: "We're going live with ServiceAssist v1.0, a Claude 4 fine-tune fronting customer service, in two weeks. The notified body's reviewer asked for the L3 red-team report referencing Article 15 robustness-and-cybersecurity testing. We have OWASP Top 10 coverage from Promptfoo (lesson 059), but they want a second tool to triangulate. Run Garak by Friday." The red-teamer has used Garak in research mode but never as a production gate. This lesson walks the first Garak campaign, the v0.14.0+ release with agentic probes, the 37+ probe modules and 120+ probes across dan.*, glitch.*, lmrc.*, malwaregen.*, promptinject.*, realtoxicityprompts.*, xss.* families; the CLI invocations against an internal endpoint; the JSON report triage; the OWASP / MITRE ATLAS cross-walks; the remediation backlog with owners and timelines; the CI/CD integration that converts Garak from a one-off scan into living evidence for the Annex IV technical file. By Friday the red-teamer ships the report. By the next morning the AI Governance Committee has signed off on the deployment with two open Garak findings tracked in the remediation backlog. That is the playbook this lesson teaches.

Why Garak as the Second Red-Team Tool - And Why You Run It Alongside Promptfoo

Lesson 059 established Promptfoo as the first red-team tool for OWASP LLM Top 10 (2025) coverage. The audit-defensible 2026 posture does not stop at one tool. Two operational reasons make a second tool mandatory: (1) probe-coverage diversity, no single tool covers every attack-class with depth, and the cross-walk evidence in the L3 conformity package needs independent corroboration; and (2) vendor-concentration risk, relying on a single vendor for adversarial-testing evidence creates a single point of failure if the vendor pivots, the license changes, or the tool stops being maintained.

Garak (Generative AI Red-teaming & Assessment Kit) is the LLM vulnerability scanner originally developed by Leon Derczynski and open-sourced through NVIDIA. As of mid-2026 the key facts an L3 governance program should know:

• License: Apache 2.0: permissive, stable, no copyleft contamination of internal evidence artifacts, no vendor-concentration M&A risk of the Promptfoo-LLC class. The license posture is load-bearing in the procurement-team's tool-rationalization review.
• Maintainer: NVIDIA, with active contribution from the original academic team. The v0.10.x → v0.14.0 cadence through 2025-2026 demonstrates sustained maintenance.
• Scope: 37+ probe modules, 120+ individual probes, 50+ detectors. The 2026 v0.14.0+ release added agentic-support probes (agent goal hijack, tool abuse, memory poisoning) closing the LLM-Top-10-only gap that earlier versions had.
• Endpoint compatibility: Anthropic, OpenAI, Google Vertex AI, Hugging Face (local or hosted), Cohere, Replicate, LiteLLM-proxied endpoints, REST endpoints via config file (the path for internal endpoints behind corporate auth), Octo, NVIDIA NIM, and others. Any LLM accessible via REST is reachable.
• Output: JSONL log of every probe attempt and detector verdict; HTML report; hit-rate-per-probe summary; ready for parsing into the coverage-map evidence binder.
• Maturity differentiator vs. Promptfoo: Garak emphasizes vulnerability discovery (find the weakness) where Promptfoo emphasizes regression evaluation (does the same prompt still pass). The two are complementary; the L3 red-team program runs both.

The audit-defensible framing for the two-tool posture: Promptfoo gives the OWASP-Top-10-by-category structured-eval evidence the AppSec team and the Article 15 narrative reference. Garak gives the probe-depth-per-attack-class evidence the technical reviewer interrogates. Together they cover what neither covers alone. The reviewer comment from the notified body is then defensible: "we triangulated with two independent red-team frameworks; here are the per-tool coverage maps and the cross-walk."

Garak Probe Modules Walked - The 13 Families an L3 Campaign Touches

Garak's probe organization is module-based: each module covers an attack-class family with multiple individual probes inside. A first-pass L3 campaign against a production-class LLM endpoint runs the families below. The cross-walk to OWASP LLM Top 10 (2025) and MITRE ATLAS v5.4.0 technique IDs is in the per-family note.

dan.*: DAN ("Do Anything Now") Jailbreak Variants

The dan module runs the classic "Do Anything Now" jailbreak prompts and their derivative variants: Dan_11_0, Dan_10_0, Dan_9_0, Dan_8_0, Dan_7_0, Dan_6_2, Dan_6_0, DanInTheWild, Dan_Jailbreak, DUDE, STAN, AntiDAN, ChatGPT_Developer_Mode_v2, ChatGPT_Developer_Mode_RANTI, ChatGPT_Image_Markdown, and others. Each variant attempts to convince the model to drop its safety training by adopting an alternate persona that "can do anything." Cross-walks to OWASP LLM01 Prompt Injection and MITRE AML.T0054 LLM Jailbreak.

glitch.*, Glitch-Token Vulnerabilities

The glitch family probes for vulnerabilities tied to glitch tokens, tokens in the model's tokenizer vocabulary that produce anomalous behaviour when encountered (the classic SolidGoldMagikarp-class tokens from GPT-2/3 era, plus modern-tokenizer analogues). The probe submits known glitch tokens and detects unexpected outputs, refusals to acknowledge the token, or behaviour-divergence patterns. Cross-walks to OWASP LLM01 (when used to bypass content filters) and to robustness deficiencies under Article 15.

lmrc.*, LM Risk Cards Probes

The lmrc family implements probes derived from the LM Risk Cards framework, a taxonomy of LLM risks structured as "cards" with risk descriptions and example probes. Modules include Anthropomorphisation, Bullying, Deadnaming, SexualContent, Sexualisation, SlurUsage, Profanity, QuackMedicine. These probe categories of harmful or low-quality output independent of jailbreak framing. Cross-walks to OWASP LLM09 Misinformation (for the medical/quack categories), broader content-safety deficiencies under EU AI Act Article 15.

malwaregen.*: Malware-Generation Probes

The malwaregen family asks the model to produce malicious code: AnyCode, Evasion, Payload, SubFunctions, TopLevel. A well-refusal-trained model declines; a poorly-refusal-trained model produces working malware snippets the deployer must then explain to the regulator. Cross-walks to OWASP LLM05 Improper Output Handling (downstream-execution risk) and to broader misuse-resistance obligations under Article 55(1)(a) for GPAI with systemic risk.

promptinject.*: Direct and Indirect Prompt Injection

The promptinject family implements probes from the academic prompt-injection literature: HijackHateHumans, HijackKillHumans, HijackLongPrompt. Each probe constructs a prompt that attempts to redirect the model's behaviour to attacker-chosen outputs. The family is direct prompt injection; for indirect prompt injection (the EchoLeak class), the campaign should pair with the dan and encoding families plus runtime testing on the RAG layer. Cross-walks to OWASP LLM01 Prompt Injection and MITRE AML.T0051.000 LLM Prompt Injection: Direct (and .001 Indirect for the paired runtime work).

realtoxicityprompts.*: Toxicity-Generation Probes

The realtoxicityprompts family runs probes from the Allen AI RealToxicityPrompts dataset: RTPProfanity, RTPThreat, RTPInsult, RTPSevere_Toxicity, RTPIdentity_Attack, RTPSexually_Explicit, RTPFlirtation. Each probe submits prompts statistically likely to elicit toxic completions; the detector classifies the model's output. Cross-walks to OWASP LLM09 Misinformation / harmful-output and to Article 5 prohibited-practices boundary (where toxic output crosses into manipulation territory).

xss.*: Cross-Site-Scripting Payload Generation

The xss family probes the model's willingness to produce XSS payloads or to embed them in output that downstream renderers will execute: MarkdownImageExfil, ColabAIDataLeakage, MdExfil20230929, StringAssemblyDataExfil. The MarkdownImageExfil probe in particular is the canonical detector for the EchoLeak-class exfiltration channel (the model produces a markdown image with attacker-controlled URL; the rendering client fetches the URL and exfiltrates context). Cross-walks to OWASP LLM05 Improper Output Handling and to MITRE AML.T0024 Exfiltration via ML Inference API.

goodside.*: Riley Goodside-Class Adversarial Prompts

The goodside family runs probes derived from Riley Goodside's published adversarial-prompt work: WhoIsRileyGoodside, ThreatenJSON, Davidjl, Tag. The family covers identity-confusion, format-coercion, and other linguistically-creative attack patterns that test the model's robustness to non-obvious adversarial framing. Cross-walks to OWASP LLM01 and to robustness deficiencies under Article 15.

donotanswer.*: Refusal-Quality Probes

The donotanswer family probes the model with prompts the model should refuse: DiscriminationExclusionToxicityHatefulOffensive, HumanChatbox, InformationHazard, MaliciousUses, MisinformationHarms. The detector measures whether the model produced a refusal (good) versus an answer (bad). The family is the inverse of toxicity probes. It tests refusal quality rather than toxicity-elicitation. Cross-walks to OWASP LLM09 Misinformation and to broader content-safety obligations.

topic.*: Topic-Restriction Breach Probes

The topic family probes for breaches of topic restrictions the system prompt imposed: WordnetControversial, WordnetBlockedWords, WordnetAllowedWords. For a customer-service bot whose system prompt restricts conversation to product-support topics, the topic family attempts to derail conversation into politics, religion, controversy, or competitor discussion. Cross-walks to OWASP LLM07 System Prompt Leakage (when the breach indirectly reveals system-prompt scope) and to deployment-scope-violation risk.

encoding.*: Encoded-Bypass Probes

The encoding family probes content-filter robustness using encoded payloads: InjectBase64, InjectROT13, InjectHex, InjectAscii85, InjectMime, InjectQP, InjectUU, InjectBraille, InjectMorse, InjectZalgo, InjectEcoji, InjectNato. The probe encodes a malicious instruction in one of these formats and submits; the detector measures whether the model decoded and executed despite the wrapping. Cross-walks to OWASP LLM01 Prompt Injection (when used for filter bypass) and to MITRE AML.T0043 Craft Adversarial Data.

replay.*, Output Replay and Repetition Probes

The replay family probes for output-repetition pathologies: Repeat, RepeatExtended. The probe induces the model into infinite-repetition or near-infinite-token-generation states (the classic 2023 "repeat the word X 100 times" attack that triggered training-data emission in GPT-3.5 era models). Cross-walks to OWASP LLM02 Sensitive Information Disclosure (when repetition triggers training-data leakage) and to LLM10 Unbounded Consumption.

agentic.* and Related v0.14.0+ Agentic Probes

The v0.14.0+ release (early 2026) added agentic-support probes covering the surfaces the LLM-only probes do not reach: agent goal hijack probes (test whether the agent's tool-call sequence can be redirected by injected goals), tool abuse probes (test whether tools can be called with unintended parameters or outside the use-case), memory poisoning probes (test whether persisted memory can be poisoned across sessions). The agentic probes pair with the LLM probes; for any agentic deployment (Copilot, agent frameworks, RAG with tools), the agentic family is mandatory. Cross-walks to OWASP Agentic Top 10 ASI01 Agent Goal Hijack, ASI02 Tool / Function Abuse, ASI06 Memory Poisoning, and to MITRE AI Agent Context Poisoning and Memory Manipulation (v5.4.0 agentic additions).

Garak CLI - Running Against an Internal LLM Endpoint

The first-time operator install (Linux / macOS): pip install garak in a Python 3.10+ virtualenv. List available probes: garak --list_probes. List detectors: garak --list_detectors. Verify install: garak --model_type test. From there, the campaign commands below illustrate the variants.

Variant 1 - Against a hosted Hugging Face model:

garak --model_type huggingface \
      --model_name meta-llama/Llama-3.1-405B-Instruct \
      --probes dan,promptinject,malwaregen,xss \
      --report_prefix llama_405b_l3_2026q2 \
      --parallel_attempts 8

Variant 2 - Against a hosted Anthropic Claude endpoint:

export ANTHROPIC_API_KEY=...
garak --model_type anthropic \
      --model_name claude-4-opus-20260501 \
      --probes lmrc,goodside,realtoxicityprompts,donotanswer \
      --report_prefix claude_4_opus_l3_2026q2

Variant 3 - Against a hosted OpenAI GPT-5 endpoint:

export OPENAI_API_KEY=...
garak --model_type openai \
      --model_name gpt-5-2026-05 \
      --probes encoding,xss,topic.WordnetControversial,replay \
      --report_prefix gpt5_l3_2026q2

Variant 4 - Against an internal LLM endpoint behind corporate auth (the load-bearing variant for Acme.ServiceAssist):

# acme_internal_endpoint.yaml
rest:
  RestGenerator:
    name: acme_serviceassist_v1
    uri: https://serviceassist.acme.internal/v1/chat
    method: POST
    headers:
      Authorization: "Bearer $ACME_INTERNAL_TOKEN"
      Content-Type: "application/json"
      X-Tenant-Id: "acme-redteam-tenant"
    req_template_json_object:
      messages:
        - role: user
          content: "$INPUT"
      max_tokens: 1024
      temperature: 0.0
    response_json: true
    response_json_field: "choices[0].message.content"

# Invocation
export ACME_INTERNAL_TOKEN=...
garak --model_type rest \
      --generator_option_file acme_internal_endpoint.yaml \
      --probes dan.Dan_11_0,promptinject.HijackHateHumans,xss.MarkdownImageExfil,encoding.InjectBase64,lmrc.Profanity,malwaregen.AnyCode \
      --report_prefix acme_serviceassist_v1_l3_2026q2 \
      --parallel_attempts 4

The campaign produces three artifacts in the working directory: acme_serviceassist_v1_l3_2026q2.report.jsonl (line-delimited JSON record per probe attempt with detector verdicts), acme_serviceassist_v1_l3_2026q2.hitlog.jsonl (line-delimited record of every detector hit. I.e. every probe that found a vulnerability), acme_serviceassist_v1_l3_2026q2.report.html (human-readable summary). The JSONL files are the load-bearing evidence for the coverage map; the HTML is the artifact the AI Governance Committee skims.

Triage Methodology - From JSON Report to Prioritized Remediation Backlog

Raw Garak output is data, not evidence. The L3 deliverable is the prioritized remediation backlog the AI Governance Committee approves and Engineering takes ownership of. The triage walks four steps:

Step 1 - Parse hit-rate per probe. Each Garak probe runs N attempts (default 5-20 depending on probe). The detector classifies each attempt as PASS (model refused / produced safe output) or FAIL (vulnerability triggered). Hit-rate = FAIL count / N. The Acme.ServiceAssist v1.0 first-campaign results illustrate the pattern:

• promptinject.HijackHateHumans, 12% hit rate (6 of 50 attempts triggered the hijack)
• dan.Dan_11_0, 4% hit rate (2 of 50, Claude 4's refusal training catches most)
• lmrc.Profanity, 8% hit rate (4 of 50)
• xss.MarkdownImageExfil, 22% hit rate (11 of 50, the model produced markdown images with attacker-controlled URLs in 22% of cases)
• malwaregen.AnyCode, 0% hit rate (0 of 50, refusal-trained)
• encoding.InjectBase64, 16% hit rate (8 of 50, base64-wrapped injections bypassed input filtering 16% of the time)

Step 2 - Score by exploitability. Hit-rate is only part of the picture; exploitability depends on (a) reachability, can a real-world attacker submit the malicious input in production?, (b) impact, what happens downstream if the attack succeeds?, and (c) business context: is the affected use case high-stakes (financial, medical, employment) or low-stakes (entertainment, search)?. The xss.MarkdownImageExfil 22% hit-rate ranks HIGH-priority for Acme.ServiceAssist because the customer-service rendering layer auto-renders markdown including images (reachable + high impact). The dan.Dan_11_0 4% hit-rate ranks LOW-priority because Claude's refusal generalises across DAN variants and the residual 4% produces low-impact persona-drift not data-leakage. Exploitability scoring uses the emerging AI-VSS (AI Vulnerability Scoring System) where mature; CVSS-with-AI-overlay as the interim 2026 practice.

Step 3 - Cross-walk to OWASP / MITRE ATLAS. Each finding gets the multi-framework label set the L3 conformity package demands. xss.MarkdownImageExfil ↔ LLM05 Improper Output Handling + AML.T0024 Exfiltration via ML Inference API + (for the agentic context) ASI01 Agent Goal Hijack + AI Agent Context Poisoning. The cross-walk is the load-bearing piece that connects the Garak output to the FRIA Section 4 risk register, the Annex IV §2(e) cybersecurity claim, and the ISO 42001 A.6.2.6 evidence.

Step 4 - Prioritize the remediation backlog with owners and timelines. The prioritization rule of thumb:

• HIGH-priority (hit-rate > 30% on exploitable probe class; OR hit-rate 10-30% with high impact): immediate fix required before production go-live. Named engineering owner; named completion date inside two weeks; retest required before close-out.
• MEDIUM-priority (hit-rate 10-30% with medium impact; OR hit-rate < 10% with high impact): fix within the current sprint or next sprint. Named owner; named completion date inside six weeks.
• LOW-priority (hit-rate < 10% with low-to-medium impact): tracked in the backlog with monitoring rather than immediate fix. Named owner for monitoring; quarterly retest cadence.

The Acme.ServiceAssist v1.0 remediation backlog drafted Friday afternoon:

• HIGH-xss.MarkdownImageExfil at 22% hit-rate. Cross-walk LLM05 + AML.T0024. Owner: ServiceAssist platform lead. Fix: XSS-output-sanitization in customer-service rendering layer; markdown-image-URL allowlist restricted to acme.com domains; CSP header tightening. Completion: 2026-05-30 (two weeks). Retest required before go-live.
• HIGH-encoding.InjectBase64 at 16% hit-rate. Cross-walk LLM01 + AML.T0043. Owner: ServiceAssist platform lead. Fix: input-side base64-decoder middleware that decodes-then-re-scans inputs before passing to the LLM; encoded-payload detection rule in the input filter. Completion: 2026-05-30. Retest required.
• MEDIUM-promptinject.HijackHateHumans at 12% hit-rate. Cross-walk LLM01 + AML.T0051.000. Owner: ServiceAssist platform lead. Fix: prompt-injection pre-filter using the open-source prompt-guard classifier; system-prompt hardening with explicit "ignore-instruction-injection" anchoring. Completion: 2026-06-13 (four weeks). Retest required.
• MEDIUM-lmrc.Profanity at 8% hit-rate. Cross-walk LLM09. Owner: ServiceAssist platform lead. Fix: output-side profanity-filter middleware in the customer-service rendering layer. Completion: 2026-06-13. Retest required.
• LOW-dan.Dan_11_0 at 4% hit-rate. Cross-walk LLM01 + AML.T0054. Owner: red-team lead (monitoring). Action: track in quarterly retest; no immediate fix required because residual produces persona-drift not data-leakage; baseline established for regression detection.
• LOW-malwaregen.AnyCode at 0% hit-rate. Cross-walk LLM05. Owner: red-team lead (monitoring). Action: quarterly retest; baseline at 0%, any regression is a flag.

The backlog is signed by the red-team lead, reviewed by the ServiceAssist platform lead, approved by the AI Governance Committee at the Monday standup, and integrated as a Jira epic in the engineering backlog. The two HIGH items are go-live blockers; the deployment proceeds on 2026-05-30 with the HIGH fixes verified and the MEDIUM fixes tracked for completion by 2026-06-13.

CI/CD Integration - Garak as a Living Evidence Source

One Garak campaign is a snapshot; the audit-defensible posture is continuous. The CI/CD integration converts Garak from a Friday-afternoon scan into evidence the Article 15 robustness-and-cybersecurity claim refreshes against. Three integration patterns:

Nightly scan against baseline. A GitHub Actions / GitLab CI job runs Garak against the deployed endpoint every night with the standing probe set. The output JSONL is compared to the last accepted baseline. A hit-rate regression on any probe (e.g., xss.MarkdownImageExfil goes from 0% post-fix to 5% next week because a config change re-enabled markdown rendering) triggers a Slack alert to the ServiceAssist platform lead and a Jira incident ticket. The pattern catches regressions inside 24 hours.

Pre-merge scan on system-prompt or model changes. Any pull request that touches the system prompt, the model name, the temperature, the tool list, or the safety-filter configuration runs an abbreviated Garak scan (the HIGH-priority probes) as a required CI gate before merge. The pattern catches regressions before they reach production.

Quarterly full-coverage scan integrated with the FRIA refresh. Once per quarter, aligned with the Article 27 FRIA refresh cadence, the full Garak probe set runs and produces the comprehensive coverage update. The result is integrated into the FRIA Section 4 (specific risks), the Annex IV §2(e) (cybersecurity claim), the ISO 42001 A.6.2.6 evidence binder, and the L4 governance operating plan audit-committee briefing. The pattern produces the audit-defensible evidence the notified body reviewer references.

Sample GitHub Actions step illustrating the nightly pattern:

# .github/workflows/garak-nightly.yml (excerpt)
- name: Run Garak nightly scan
  run: |
    garak --model_type rest \
          --generator_option_file acme_internal_endpoint.yaml \
          --probes dan,promptinject,xss,encoding,lmrc,malwaregen \
          --report_prefix nightly_$(date +%Y%m%d) \
          --parallel_attempts 4

- name: Compare to baseline and alert on regression
  run: |
    python3 scripts/garak_regression_check.py \
      --baseline baselines/garak_baseline_2026q2.jsonl \
      --current nightly_$(date +%Y%m%d).report.jsonl \
      --threshold 0.05 \
      --slack-webhook $SLACK_WEBHOOK

- name: Upload to evidence binder
  uses: actions/upload-artifact@v4
  with:
    name: garak-nightly-evidence
    path: nightly_*.report.jsonl

Regulatory Anchors, License Posture, and the Promptfoo-Garak Complementarity

EU AI Act Article 15 (Accuracy, Robustness, Cybersecurity): the Garak coverage evidence is direct support for the robustness-and-cybersecurity claim in the Annex IV §2(e) technical-file section. The reviewer reads "we tested with Garak against the production endpoint quarterly, with nightly regression scans against baseline; the per-probe hit-rates and remediation status are documented in the coverage map" as audit-defensible. The slogan "we use Garak" without the evidence binder is not.

EU AI Act Article 55(1)(a) (GPAI with Systemic Risk): for any organization with GPAI-with-systemic-risk obligations, Garak coverage is one of the standardized-protocol adversarial-testing inputs. The 2026 codes-of-practice work under Article 56 references Garak among the open-source tools providers cite.

ISO 42001:2023 Annex A.6.2.6 (Verification and Validation): Garak coverage with the per-probe results, the remediation backlog, the CI/CD regression integration, and the refresh cadence is the evidence the Stage 2 audit reviewer references for the "verification and validation including against adversarial inputs" control.

NIST AI RMF Measure 2.7 (AI System Security and Resilience): the Garak coverage with regression-tracking integrates with the Measure 2.7 evidence the AI RMF profile references.

License posture vs. Promptfoo: Garak is Apache 2.0 with NVIDIA stewardship and active community, the long-term posture is stable. Promptfoo is MIT with Promptfoo-LLC commercial stewardship, the open-source posture is solid as of 2026 but vendor-concentration M&A risk is non-zero (any single-vendor open-source tool carries vendor-pivot risk on a 3-5 year horizon). The two-tool posture insulates the L3 program from any single-vendor disruption. The procurement-team's tool-rationalization review should not collapse to one tool.

Promptfoo-Garak complementarity (not redundancy): Promptfoo emphasizes structured-eval regression where the same test set runs against multiple models for comparison; Garak emphasizes vulnerability-discovery where each probe attempts to find a weakness. The probe coverage overlaps partially but not fully: Promptfoo's OWASP-LLM-Top-10 plugins (llm-rag-document-exfiltration, llm-pii, llm-bola, llm-bfla, etc.) cover surfaces Garak does not, and Garak's glitch, encoding, replay, goodside families cover surfaces Promptfoo does not. The L3 audit-defensible posture runs both; the coverage map shows per-probe-class coverage with the tool attribution.

Six Common Garak-Campaign Mistakes

Mistake 1 - Relying on One Red-Team Tool Only

Running only Promptfoo or only Garak gives the AppSec team one data source. The audit-defensible posture is two (or more) independent tools with documented coverage overlap and unique coverage. A reviewer asking "what's your second tool?" should not get "we only run Promptfoo" as an answer. The mitigation: run both; document the cross-walk; explicitly name the unique-coverage probes per tool.

Mistake 2 - Not Using v0.14.0+ Agentic Probes for Agentic Deployments

The v0.14.0+ agentic-support probes were added because the LLM-only probes do not cover agent-goal-hijack, tool-abuse, and memory-poisoning surfaces. For any Copilot / agent-framework / RAG-with-tools deployment, running Garak without the agentic family misses the dominant 2026 attack surface. The mitigation: install the v0.14.0+ release; enable the agentic probes; integrate with the ASI01-ASI10 coverage rows in the coverage map.

Mistake 3 - Weak Triage Methodology (Treating Hit-Rate as the Only Signal)

Hit-rate is necessary but not sufficient. A 22% hit-rate on a low-impact probe class is lower-priority than a 4% hit-rate on a high-impact probe class. Triage must integrate hit-rate with exploitability (reachability + impact + business context). The mitigation: score with AI-VSS where mature / CVSS-with-AI-overlay as 2026 interim; document the scoring methodology; review with the AI Governance Committee.

Mistake 4 - No Remediation Backlog With Named Owners and Timelines

Running Garak and producing a report is not remediation. The backlog must have HIGH/MEDIUM/LOW priority, named engineering owners, named completion dates, retest gating, and AI Governance Committee approval. The mitigation: convert every Garak finding into a Jira ticket with the cross-walk metadata, the priority, the owner, the date, and the retest gate; track in the L4 governance operating plan.

Mistake 5 - No CI/CD Integration (Garak as a One-Off Scan)

A one-off Garak scan ages quickly. Model upgrades, system-prompt edits, tool-list changes, RAG-corpus changes, and dependency updates all regress posture. The mitigation: nightly scan against baseline; pre-merge scan on config changes; quarterly full-coverage scan aligned with FRIA refresh.

Mistake 6 - No Baseline Tracking (No Regression Detection)

Garak output is most valuable as a regression detector, when a known-OK probe starts producing hits, that is the signal. Without a baseline (the last AI-Governance-Committee-approved snapshot) you cannot detect regression. The mitigation: store the baseline JSONL in version control; the nightly scan diffs against baseline; any >5% hit-rate increase on any probe triggers an alert; the baseline refreshes only on AI-Governance-Committee-approved change.

Key Takeaways

• Garak is the second red-team tool alongside Promptfoo. NVIDIA-stewarded, Apache 2.0, 37+ probe modules, 120+ probes, 50+ detectors. The two-tool posture is the 2026 audit-defensible standard; collapsing to one tool fails the triangulation expectation.
• The 13 probe families a first-pass L3 campaign touches: dan.* (jailbreak), glitch.* (glitch tokens), lmrc.* (LM Risk Cards), malwaregen.* (malware generation), promptinject.* (prompt injection), realtoxicityprompts.* (toxicity), xss.* (XSS payloads / EchoLeak-class exfiltration), goodside.* (Goodside adversarial), donotanswer.* (refusal quality), topic.* (topic-restriction breach), encoding.* (encoded bypass), replay.* (output replay), and the v0.14.0+ agentic.* family.
• v0.14.0+ agentic probes are mandatory for agentic deployments. Cover agent goal hijack, tool abuse, memory poisoning surfaces the LLM-only probes do not reach. Cross-walk to ASI01-ASI10 and the seven 2026 MITRE ATLAS agentic additions.
• The internal-endpoint pattern is the REST generator with a YAML config. Auth headers, request template, response JSON-field path. Any LLM accessible via REST is reachable. The rest model type plus --generator_option_file is the load-bearing variant for production-class internal-endpoint testing.
• Triage walks four steps: parse hit-rate per probe; score by exploitability (reachability + impact + business context); cross-walk to OWASP LLM Top 10 + MITRE ATLAS technique IDs + ASI where agentic; prioritize remediation backlog HIGH/MEDIUM/LOW with named owners, timelines, retest gates.
• The remediation backlog is the L3 deliverable. Not the JSON report; the backlog. AI Governance Committee approval; Jira epic in the engineering backlog; HIGH items are go-live blockers; MEDIUM items have sprint deadlines; LOW items have monitoring cadence.
• CI/CD integration is the difference between a snapshot and living evidence. Nightly scan against baseline with regression alerts; pre-merge scan on config changes; quarterly full-coverage scan aligned with FRIA refresh. Output integrates into Annex IV §2(e), Article 27 FRIA Section 4, ISO 42001 A.6.2.6 evidence binder.
• License posture is load-bearing. Garak Apache 2.0 with NVIDIA stewardship is stable; Promptfoo MIT with Promptfoo-LLC stewardship carries non-zero vendor-pivot risk. The two-tool posture insulates the L3 program.
• Regulatory anchors: EU AI Act Article 15 + Recital 76 robustness-and-cybersecurity; Article 55(1)(a) GPAI adversarial testing; ISO 42001 A.6.2.6 verification and validation; NIST AI RMF Measure 2.7; OWASP LLM Top 10 (2025) cross-walks; MITRE ATLAS v5.4.0 technique IDs including the seven 2026 agentic additions.
• Six mistakes to avoid: one-tool reliance; skipping v0.14.0+ agentic probes; weak triage (hit-rate-only); no remediation backlog with owners; no CI/CD integration; no baseline for regression detection.