Tencent Open-Sources AI-Infra-Guard: A Deep Dive into the Full-Stack AI Red Teaming Platform

AI Security's New Battlefield: From Models to Infrastructure

As large language models (LLMs) and AI Agents accelerate their deployment in enterprise production environments, the security boundaries of AI systems are being redefined. Traditional web security and network security methodologies can no longer cover AI-specific attack surfaces—novel threats such as prompt injection, model jailbreaking, Agent privilege abuse, and MCP protocol vulnerabilities are emerging at an alarming rate.

Against this backdrop, Tencent has open-sourced AI-Infra-Guard, a project positioned as a "full-stack AI Red Teaming platform." As of now, the project has garnered approximately 4,750 Stars and 471 Forks on GitHub, maintaining a pace of 28 new stars per day—demonstrating strong community demand for AI security tooling.

"Red Teaming" originates from the offensive-defensive exercise concept in cybersecurity, where a dedicated team simulates real attackers' perspectives to proactively uncover security weaknesses in systems. This concept traces back to Cold War-era military exercises, where the U.S. military used "Red Teams" to represent adversaries and stress-test their own defensive systems. In cybersecurity, red teaming became systematized after the 2000s, producing attack knowledge bases exemplified by the MITRE ATT&CK framework. Traditional red teams focus on network penetration, social engineering, and physical intrusion, while AI red teams must cover entirely new attack vectors—including adversarial inputs, semantic-level vulnerability exploitation, and attacks that leverage the model's own reasoning capabilities. In 2023, the White House even organized a public red teaming event targeting mainstream LLMs (DEF CON AI Village), marking AI red teaming's entry into mainstream security practice. AI-Infra-Guard systematically applies this philosophy across every layer of the AI ecosystem.

AI-Infra-Guard's Five Core Scanning Capabilities: Covering the Full-Stack AI Attack Surface

According to the project's official description, AI-Infra-Guard secures the AI ecosystem through five core scanning dimensions—this is the foundation of its "full-stack" claim.

Agent Scan: AI Agent Security Scanning

AI Agents can autonomously invoke tools and execute tasks. Once maliciously manipulated, they can lead to data breaches or privilege escalation. Agent Scan focuses on detecting security vulnerabilities in an agent's decision chain, tool invocations, and permission controls—one of the most critical risk areas in the current Agentic AI wave.

The security risks of AI Agents differ fundamentally from traditional software vulnerabilities. Traditional software behavior is deterministic, while Agents make decisions based on LLMs, making their behavior unpredictable. Typical Agent attack vectors include: Indirect Prompt Injection, where attackers embed malicious instructions in external data that an Agent might read; Tool Abuse, where an Agent is tricked into invoking high-privilege tools to perform unintended operations; and Goal Hijacking, where carefully crafted inputs alter the Agent's task objectives. For example, an Agent with email-sending capabilities could be induced to exfiltrate sensitive data via email. In common Agent architectures like ReAct and Plan-and-Execute, every reasoning step can become an injection point for attackers.

Skills Scan: Skill Module Security Scanning

Modern AI applications are often composed of multiple "Skills" modules. Skills Scan conducts security audits on these pluggable capability modules to prevent any single skill from becoming an attack entry point for the entire system.

MCP Scan: Model Context Protocol Security Scanning

MCP (Model Context Protocol) is a recently emerged AI tool connection standard that enables standardized interaction between models and external data sources or tools. Proposed and open-sourced by Anthropic in late 2024, MCP aims to provide a unified standardized protocol for interactions between AI models and external tools/data sources—similar to HTTP in the web domain. MCP adopts a client-server architecture and defines three core primitives: tool invocation, resource access, and prompt management. MCP servers can expose capabilities like database queries, file system operations, and API calls for AI model use.

Since MCP servers often possess elevated privileges, their security is critical. Key security risks include: MCP servers typically run with high system privileges; the protocol itself lacks fine-grained permission control mechanisms; tool descriptions can be tampered with to mislead model behavior (so-called "tool poisoning" attacks); and cross-server privilege escalation. As MCP rapidly becomes the de facto standard, the impact of its security issues continues to expand. AI-Infra-Guard provides dedicated MCP scanning capabilities to identify potential vulnerabilities in MCP implementations.

AI Infra Scan: AI Infrastructure Security Scanning

AI infrastructure encompasses components such as inference services, vector databases, and model hosting frameworks. These underlying facilities are also susceptible to traditional security vulnerabilities (e.g., unauthorized access, misconfigurations). This dimension extends classic infrastructure security detection to the AI technology stack.

Specifically, common AI infrastructure components include: model inference services (e.g., vLLM, TGI, Triton Inference Server), vector databases (e.g., Milvus, Pinecone, Weaviate), model registries (e.g., MLflow, Hugging Face Hub), and training platforms (e.g., Kubeflow). Security risks for these components span multiple levels: inference service APIs without authentication allowing arbitrary model invocation; exposed vector databases leaking sensitive knowledge bases in RAG systems; serialized files (e.g., pickle) in model repositories potentially containing malicious code as supply chain attacks; and shared memory in GPU clusters enabling cross-tenant information leakage. In 2024, multiple security research teams discovered an alarming number of exposed AI infrastructure instances on the internet, many with default configurations and unauthenticated access—low-level but high-severity issues.

LLM Jailbreak Evaluation: Model Safety Alignment Testing

The platform includes built-in LLM Jailbreak Evaluation capabilities for testing a model's resistance to prompt attacks, content bypass techniques, and other methods, providing quantitative assessment of a model's safety alignment level.

Prompt Injection and Jailbreaking are the two core security threats facing LLMs. Prompt injection refers to attackers embedding special instructions in user input to override or tamper with the system's preset behavioral constraints—analogous to SQL injection in traditional web security. Jailbreaking specifically refers to techniques that bypass a model's safety alignment constraints, causing it to output harmful content that should have been refused. Common jailbreak techniques include role-playing (e.g., DAN attacks), multilingual bypass, encoding obfuscation, and multi-turn dialogue gradual breakthrough. Safety alignment is typically achieved through RLHF (Reinforcement Learning from Human Feedback), but research shows that alignment is often "shallow" and can be bypassed by carefully designed attack strategies. Evaluating a model's robustness against these attacks requires a systematic testing framework rather than scattered manual attempts.

Why AI-Infra-Guard Deserves Attention

The AI Security Tool Ecosystem Is Still Immature

Compared to the mature toolchains in traditional security, the AI security domain is still in its early stages. Most tools on the market focus on a single dimension—for example, only doing prompt injection detection or only model evaluation. The current AI security tool ecosystem can be roughly categorized as follows: model evaluation tools (e.g., Garak, HarmBench, Purple Llama CyberSecEval) focus on testing the model's own security; guardrail tools (e.g., Guardrails AI, NeMo Guardrails, LLM Guard) focus on real-time interception of unsafe inputs and outputs during inference; and Agent security frameworks (e.g., Invariant Labs' Analyzer) focus on runtime behavior monitoring of Agents. However, these tools lack integration, requiring enterprises to piece together multiple tools to achieve reasonably complete security coverage. Additionally, AI security standards are rapidly taking shape—OWASP has published the Top 10 Security Risks for LLM Applications (OWASP Top 10 for LLM Applications), and NIST is advancing the implementation of the AI Risk Management Framework (AI RMF).

The value of AI-Infra-Guard lies in integrating Agent, Skills, MCP, infrastructure, and LLM—five layers into a unified platform, forming relatively comprehensive coverage and attempting to address the fragmentation problem.

Tencent's Backing and Open-Source Community Collaboration

As a Tencent open-source project, AI-Infra-Guard comes with certain guarantees in engineering quality and real-world experience. Using Python as the primary development language also lowers the barrier to entry for security researchers and developers. The open-source model means the community can continuously contribute new detection rules and attack samples—critically important for the rapidly evolving AI attack surface. Security defense is fundamentally a continuous adversarial engagement that requires collective intelligence and collaboration.

Addressing the Critical Security Needs of Agentic AI

AI Agents and the MCP protocol have become industry hotspots, with more enterprises deploying autonomous agents. However, issues such as excessive permissions, lack of isolation, and uncontrolled tool invocations are surfacing alongside adoption. AI-Infra-Guard's dedicated support for Agent and MCP scanning precisely targets this emerging and high-risk scenario.

Use Cases and Practical Recommendations for AI-Infra-Guard

AI-Infra-Guard offers high practical value for the following types of teams:

• AI Application Development Teams: Conduct security self-checks on Agents and Skills before deployment to reduce production environment risks.
• Security Researchers: Use it as a red teaming tool to systematically evaluate the attack surface of target AI systems.
• Enterprise Security Teams: Incorporate it into AI application security audit workflows to establish continuous monitoring mechanisms for AI assets.

A word of caution: any red teaming tool is a double-edged sword. Users should only test systems they own or have explicit authorization to test, avoiding legal and compliance violations.

Conclusion

The emergence of AI-Infra-Guard reflects how AI security is expanding from the single-point issue of "model alignment" to a systems engineering discipline covering agents, protocols, and infrastructure. As AI Agents penetrate core enterprise operations, security capabilities will become an indispensable component of AI deployment. Tencent's open-source contribution not only provides a practical toolset but also advances tool standardization for the entire AI security community. For teams currently building or planning to build AI applications, incorporating security red teaming into the development process early on is undoubtedly a wise move.