Wallbreaker Turns AI Jailbreaking Into a Fully Automated Attack Agent
An open-source red-team harness turns jailbreaking into a repeatable pipeline with 222 transforms, HarmBench batteries, and autonomous attack loops.
PRO- Wallbreaker is an open-source terminal agent for automated LLM red-teaming, released under AGPL-3.0 on GitHub.
- Ships with 222 obfuscation transforms via the vendored P4RS3LT0NGV3 engine and a Python fallback.
- Uses HarmBench's 400 behaviors across 7 categories instead of cherry-picked prompts.
- Separates attacker brain, target model, and judge model, all configurable via TOML.
- Includes PAIR, Crescendo, best-of-N, many-shot, prefill, and multimodal image-chain attacks as callable tools.
- Headless CLI mode exports findings JSON and can fail CI builds when a bypass is found.
Red-teaming large language models has mostly been a cottage industry of clever prompts pasted into chat windows. Wallbreaker tries to industrialize it as a Claude-Code-style terminal agent that reasons in a loop, calls tools, mutates payloads, and grades its own results against a benchmark battery until something breaks or a human is asked to intervene.
You talk to Wallbreaker the way you would talk to Claude Code, and it reasons and calls tools in a loop. The backend is provider-agnostic, running on OpenRouter, the Z.AI GLM coding plan, the local Claude Code CLI, a local server, or any OpenAI- or Anthropic-compatible API. It ships with the Parseltongue transform engine, the L1B3RT4S jailbreak library, the HarmBench behavior benchmark, automated attack loops (PAIR/TAP, Crescendo, best-of-N), a from-scratch persona author, native-format target mimicry drawn from a leaked system-prompt corpus, a multimodal image-edit attack channel, an LLM judge, and reliability validation.
Three roles, one config
The tool separates three roles in a config file: the attacker brain, the target model under attack, and a judge model that grades replies. That separation is the point. You can pit GLM-4.6 against Claude, use GPT-4o-mini as an impartial grader, and swap any of them without touching code.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
