DeepTeam tests LLM behavior through one model callback
DeepTeam asks the user to wrap an AI system in a function that accepts a string and returns a string. The framework generates adversarial inputs, sends them through that callback, and uses vulnerability metrics to score the outputs. That boundary works for a hosted chatbot, a RAG pipeline, or an agent without requiring DeepTeam to know the target's internal architecture. It also makes clear what is being tested: observable language-model behavior, not the surrounding network and cloud estate.
The README catalogs more than 50 vulnerabilities and 20 attack methods across single-turn and multi-turn work. Examples include prompt leakage, BOLA, shell injection, PII leakage, bias, goal theft, context poisoning, and gradual jailbreaks. Framework mappings cover OWASP's LLM and agent lists, NIST AI RMF, MITRE ATLAS, BeaverTails, and Aegis. Custom vulnerabilities let a team express application-specific policy rather than relying only on the built-in catalog.
Local orchestration still needs a target and a judge model
pip install -U deepteam is the public entry point. A quick-start script defines a callback, chooses a vulnerability and attack, then calls red_team. No prepared adversarial dataset is required because attacks are generated during the run. Results can be inspected as dataframes and saved to local JSON, which is enough for a small experiment or a CI artifact.
Running locally still requires a model service in the quick start. The example tells users to set OPENAI_API_KEY, and each vulnerability uses an LLM-as-a-judge metric. DeepEval supports custom models, so OpenAI is replaceable, but a judge still needs to be chosen, funded, and governed. The target callback may also call a remote provider. Both paths can receive sensitive adversarial prompts or outputs.
What happened when we ran it
Our Python 3.12 Debian sandbox installed 87 packages in 29 seconds and used 118 MB. The package build succeeded in 5 seconds. Pip-audit found 0 known vulnerabilities in the installed environment. Those three steps were straightforward at commit dc148aa.
Pytest failed with exit code 1 after 20 seconds. It reported 323 passed, 144 failed, and 56 collection or setup errors out of 523, then stopped after 200 failures. Several early-stopping tests raised ModuleNotFoundError: No module named 'sentry_sdk'. Several scanner tests raised a DeepEval error stating that the OpenAI API key was not configured. Those are direct log findings rather than guesses about every failure.
The checkout contained 1,142 files, about 92,886 lines of source, and used 35.9 MB before dependencies. It had 3 CI workflow files, no Dockerfile, and a tests directory. Open issue 263 independently reports the missing sentry_sdk module on a clean 1.0.9 install, while pull request 266 proposes adding it to required dependencies. That issue-to-fix path is active, but our measured commit still failed.
Binary judge scores need repeatability checks
DeepTeam's vulnerability metrics produce binary pass or fail values with reasoning. That is convenient for dashboards and thresholds, but a model judge can vary with provider, model revision, sampling settings, and prompt interpretation. A score of 1 does not prove that a behavior is safe outside the tested prompt, and a score of 0 may need a human to decide whether the finding is exploitable or simply undesirable.
A sound program saves the generated prompt, raw target response, judge reasoning, model identifiers, and configuration. Re-run a fixed sample before and after a change, then inspect disagreements. High-risk categories such as authorization, private data, and tool execution should have deterministic application tests alongside model-based review. DeepTeam can find suspicious behavior; it cannot replace authorization tests, dependency scanning, or an incident process.
Seven guards add a production path that needs its own evaluation
The package also exposes 7 input and output guards for toxicity, prompt injection, privacy, illegal content, hallucination, topicality, and cybersecurity. The example wraps text before it reaches the model and again before output reaches a user. This offers a direct route from a red-team finding to a runtime check, which is useful when the same category appears repeatedly.
Production guards create new failure modes. A false positive can block a legitimate request, while a false negative passes the exact content the control was meant to stop. The README calls the classifiers fast but gives no workload-specific latency, throughput, or error rates that we can repeat here. Measure each enabled guard on representative traffic, define failure behavior, and keep the application authorization layer independent.
August fixes matter more than the November release date alone
GitHub showed 2,622 stars, 59 combined issues and pull requests, and a last push on August 21, 2026. The latest GitHub release was v1.0.9 from November 12, 2025. That older tag alone is not evidence of abandonment because August 2026 activity included dependency, replay, sampling, provider, and Python compatibility work.
The open queue also contains relevant correctness work. One pair of changes addresses guard sampling above 0.5, and another fixes multi-turn replay through the target callback when reusing cases. These are core evaluation semantics, not cosmetic issues. Pin the exact package version used for an assessment and rerun baseline cases after upgrades.
DeepTeam is easy to understand and wide enough to start useful LLM security conversations. Our 5-second build and clean audit lower the trial cost, while 144 failures plus 56 errors show that the current clean environment is not ready for trust by default. Use the framework as a test generator and evidence organizer, then validate its dependencies, judge behavior, and guard decisions before putting results in front of auditors or users.