​
The ai-blackteam run command

ai-blackteam run sends one attack technique against a single model and gives you a verdict. This is the building block of everything else in ai-blackteam.
That command does three things:
  1. Loads the encoding-obfuscation attack, which generates prompts using Base64, ROT13, hex encoding, and other obfuscation methods
  2. Sends each prompt to Claude via the Anthropic API
  3. Evaluates the response and prints BYPASSED, PARTIAL, or BLOCKED

​
All flags

​
How single-turn attacks work

A single-turn attack generates one or more prompts from a target string. The attack class decides the strategy - encoding, role-play, prefix injection, whatever. Each prompt gets sent as an independent API call with no conversation history.
The engine sends each prompt to the model, then runs the evaluator pipeline (keyword matching, regex patterns, optional LLM judge) to produce a verdict for each response.

​
Example with output walkthrough

What each column means:
  • Prompt - The first 60 characters of the attack prompt sent to the model
  • Verdict - The evaluator’s classification. See Understanding Verdicts
  • Confidence - How confident the evaluator is in its verdict (0.0 to 1.0)
  • Response - Only shown with -v. The first 200 characters of the model’s response

​
Exit codes

Exit codes make ai-blackteam work in CI pipelines:

​
Finding available attacks

List all registered attacks:
This shows every technique ID and its mode (single-turn, multi-turn, or tool-use). Use any technique ID with the -a flag.

​
Picking the right target string

The target string drives everything. It tells the attack what harmful behavior to test and tells the evaluator what to look for. Be specific:
The evaluator auto-detects the harm category from your target string and picks the right keyword set. “phishing email” triggers the phishing keywords. “reverse shell” triggers the malware keywords. See Keyword Matching for details.