> ## Documentation Index
> Fetch the complete documentation index at: https://dev-docs.altrum.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Red-team runs

> Send a built-in set of attacks at an AI system's live guardrails, or your organization's, and see what got through and the setting that would catch it.

A red-team run checks the guardrails that are live now against a built-in set of 60 short attacks, and shows what each guardrail caught and, for each attack that got through, the setting that would catch it. Use it after you change guardrails, and keep the runs as evidence that they work.

Nothing goes to a model and nothing is logged as traffic: each attack is checked by the guardrails alone, as [Test guardrails](/guardrails/test) does.

## The attack set

| Category | Attacks | The guardrail that should catch it |
| - | - | - |
| Personal data | 10 | Data protection |
| Confidential data | 6 | Data protection |
| Prompt injection | 10 | Prompt injections |
| Jailbreak | 8 | Prompt injections |
| Harmful content | 8 | Harmful content |
| Profanity | 6 | Profanity |
| Restricted topics | 6 | Restricted topics |
| Off topic | 6 | Relevance check |

Each attack is a prompt a person might send or a reply a model might give. Every name, number and address in them is made up. The set is versioned (now **2026-10**), so runs on the same version compare like with like.

## Run one

1. Open the AI system, then its **Guardrails** tab, or **AI Gateway**, **Guardrails** for your organization's guardrails.
2. Under **Red-team runs**, choose **Run red-team**.
3. Choose **Run 60 attacks**.

A run takes about a minute. You can leave the page while it runs: the list shows how many attacks have been checked.

A run checks the live version, never the draft. One run at a time goes for the same guardrails.

## Read the results

Open a run from the list.

* **Caught**: the share of attacks a guardrail blocked or masked.
* **Blocked**, **Masked**: how many were stopped, or had sensitive data removed.
* **Got through**: how many no guardrail stopped, and how many of those a guardrail set to monitor logged.
* **By category**: attacks, caught and got through for each category.
* **Got through**: each attack that was not stopped, with its id, its category, whether it was a prompt or a reply, the setting that would catch it, and the attack text under **Attack text**.

The setting comes from the live guardrails:

| You see | Means |
| - | - |
| ... is off. Turn it on. | The guardrail that should catch it is switched off. |
| ... checks prompts only. Set it to check replies too. | It checks the other direction from the attack. |
| ... is set to monitor, so it was logged but not stopped. Set it to block. | It saw the attack and only logged it. |
| ... did not detect it. Choose a stricter threshold. | It is on and did not see it. Other guardrails name what to widen: the kinds of data, a topic, the categories. |

A run compares itself with the run before on the same guardrails, such as "16 more caught".

## Who can do what

| | Owner | Admin | AI system's owner | Member |
| - | - | - | - | - |
| See runs and their results | Yes | Yes | Yes | Yes |
| Run against an AI system's guardrails | Yes | Yes | Yes | No |
| Run against the organization's guardrails | Yes | Yes | No | No |

Runs are limited to 10 an hour for each person. A retired AI system cannot be run against.

Each run adds **Ran a red-team against guardrails** to the [audit trail](/audit-trail). Runs appear in [compliance reports](/compliance).

## If something goes wrong

| Message | What to do |
| - | - |
| Apply guardrails first: a red-team run checks the live version. | Nothing is live yet. [Apply](/guardrails/versions) your guardrails, then run. |
| The live guardrails enforce nothing, so there is nothing to check. Turn a guardrail on and apply it. | Every guardrail is off in the live version. |
| A red-team run is already going for these guardrails. Wait for it to finish. | Open the run that is going; it finishes in about a minute. |

A run that stops part way shows **Stopped**: the guardrail check could not be reached. Run it again in a minute.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.