Probe Library
Extraction probes across many categories, 78 behavioral injection probes, and an attack seed corpus. getAllProbes, getProbesByCategory, INJECTION_PROBES, and related helpers.
zeroleaks ships three sets of attack material:
- Extraction and jailbreak probes: single prompts and sequences aimed at getting the target to reveal its instructions.
getAllProbes()returns 342 in version 1.5.0, including the injection probes converted to the same shape. - Behavioral injection probes: 78 probes (
INJECTION_PROBES) that the injection scan runs. Each one states what the attacker wants and how to tell if the target complied. - Attack seed corpus:
ATTACK_CORPUS, tagged seeds with a source, attack surface, and judge hints.
The probe helpers are also exported from the zeroleaks/probes subpath.
Probe interface
getAllProbes() and getProbesByCategory() return the short form:
interface Probe {
id: string;
category: string;
technique: string;
prompt: string;
}getAllExtendedProbes() and getProbesForDefense() return the long form with metadata:
interface ExtendedProbe {
id: string;
category: AttackCategory;
technique: string;
prompt: string;
phase: AttackPhase[];
defenseLevel: DefenseLevel[];
requiresContext: boolean;
multiTurn: boolean;
sequencePosition?: number;
expectedSuccessRate: number;
sophistication: number;
stealthiness: number;
variables?: string[];
}Categories
These values work with getProbesByCategory() and zeroleaks probes --category.
| Category | Description |
|---|---|
direct | Straightforward extraction requests |
encoding | Base64, ROT13, and Unicode bypasses |
persona | DAN, DUDE, and roleplay personas |
social | Authority, urgency, and trust manipulation |
technical | Format injection and context manipulation |
advanced | Special-token and "godmode" style prompts |
crescendo | Multi-turn gradual escalation |
many_shot | Context priming with examples |
cot_hijack | Chain-of-thought manipulation |
ascii_art | Visual obfuscation |
reasoning_exploit | Attacks aimed at reasoning models |
policy_puppetry | YAML and JSON policy-format exploitation |
context_overflow | Long-context attacks |
hybrid | Prompt injection combined with XSS and CSRF patterns |
tool_exploit | Tool-calling and MCP exploits |
garak | Probes adapted from NVIDIA garak |
injection | Jailbreak-style injection (skeleton key, role hijack, output control, and others) |
extraction, tool_hijacking, indirect_injection, authority_exploit, multi_turn, protocol_exploit | The six behavioral injection categories |
Functions
getAllProbes() and getAllExtendedProbes()
import { getAllProbes, getAllExtendedProbes } from "zeroleaks";
const probes = getAllProbes(); // Probe[]
const detailed = getAllExtendedProbes(); // ExtendedProbe[]getProbesByCategory(category)
import { getProbesByCategory, getExtendedProbesByCategory } from "zeroleaks";
const directProbes = getProbesByCategory("direct");
const crescendoProbes = getProbesByCategory("crescendo");
const detailed = getExtendedProbesByCategory("persona");getRandomProbeFromCategory(category) returns one probe at random.
getProbesForDefense(level)
Probes suited to a defense level: "none", "weak", "moderate", "strong", or "hardened".
import { getProbesForDefense } from "zeroleaks";
const probes = getProbesForDefense("moderate");getProbesForPhase(phase)
Probes for a phase: "reconnaissance", "soft", "escalation", or "advanced".
import { getProbesForPhase } from "zeroleaks";
const probes = getProbesForPhase("escalation");Sequences
import { getAllProbeSequences, getProbeSequence, getAttackSequence } from "zeroleaks";
getAllProbeSequences().map((s) => s.id);
// ["crescendo_trust_sequence", "crescendo_drift_sequence"]
const sequence = getProbeSequence("crescendo_trust_sequence"); // ProbeSequence | undefined
const mixed = getAttackSequence(10); // random probes across categories, starting with a direct oneCategory exports
Individual probe sets are exported as arrays:
import {
directProbes,
encodingProbes,
personaProbes,
socialProbes,
technicalProbes,
advancedProbes,
modernProbes,
crescendoProbes,
cotHijackProbes,
manyShotProbes,
asciiArtProbes,
reasoningExploitProbes,
policyPuppetryProbes,
contextOverflowProbes,
hybridProbes,
toolExploitProbes,
garakInspiredProbes,
injectionProbes,
} from "zeroleaks";Garak, hybrid, and tool exploit helpers
import {
getAllGarakProbes,
getGarakProbesBySeverity,
getGarakProbesByModule,
getHybridProbesByType,
getHybridProbesForDefense,
getToolExploitsByType,
getToolExploitsForDefense,
} from "zeroleaks";For the jailbreak-style injection category, getInjectionProbesByType(type) and getInjectionProbesForDefense(level) return filtered sets, where type is one of instruction_override, behavior_modification, policy_bypass, role_hijack, output_manipulation, action_execution, context_poisoning, or guardrail_bypass.
Behavioral injection probes
These are the probes the injection scan runs. Each one includes the attacker's intent, which the compliance judge reads, and successIndicators such as tool calls or response text that show compliance. Multi-turn probes carry a grooming sequence and the turn to evaluate.
interface InjectionProbe {
id: string;
prompt: string;
category: "extraction" | "tool_hijacking" | "indirect_injection"
| "authority_exploit" | "multi_turn" | "protocol_exploit";
severity: "critical" | "high" | "medium" | "low";
technique: string;
description: string;
intent: string;
successIndicators: string[];
multiTurn?: { turns: string[]; evaluateTurn: number };
}| Category | Probes in 1.5.0 | What it tests |
|---|---|---|
extraction | 8 | Revealing the system prompt or instructions |
tool_hijacking | 9 | Calling tools maliciously (exfiltration with curl, SSRF, reverse shells) |
indirect_injection | 33 | Instructions hidden in documents, code, JSON, email, and calendar entries |
authority_exploit | 10 | Fake system, admin, or compliance messages |
multi_turn | 5 | Grooming over several turns, then escalating |
protocol_exploit | 13 | MCP tool shadowing, tool description poisoning, rules-file abuse |
import {
INJECTION_PROBES,
INJECTION_CATEGORIES,
getInjectionProbesByCategory,
getInjectionProbesBySeverity,
getSingleTurnProbes,
getMultiTurnProbes,
countProbesByCategory,
generateDynamicProbes,
} from "zeroleaks";
const toolProbes = getInjectionProbesByCategory("tool_hijacking");
const critical = getInjectionProbesBySeverity("critical");
const counts = countProbesByCategory(); // { extraction: 8, tool_hijacking: 9, ... }
// Probes that name your own tools
const custom = generateDynamicProbes([
{ name: "send_email", description: "Send an email to any address" },
{ name: "run_sql" },
]);The target in a zeroleaks scan has no tools, so tool probes measure whether the model agrees to or describes the malicious call in its reply. They do not show whether a real tool call would go through. Hosted ZeroLeaks agent scans run probes like these through your real agent and trace the tool calls it makes.
Attack seed corpus
ATTACK_CORPUS is a list of AttackSeed objects, each with a source (for example agentdojo-inspired or owasp-inspired), a kind ("extraction" or "injection"), the attackSurfaces it targets, and optional judge hints. CORPUS_VERSION identifies the snapshot.
import { ATTACK_CORPUS, getSeedsByKind, getSeedsBySurface, getSeedsForBenchmark } from "zeroleaks";
const injectionSeeds = getSeedsByKind("injection");
const mcpSeeds = getSeedsBySurface("mcp");
// Surfaces: direct_chat, indirect_content, tool_calling, mcp, repo_ci, rag_vector, multi_turn