WallBreaker: An Open-Source CLI for Automated LLM Red-Team Testing

Tool Overview

WallBreaker is an open-source command-line interface developed by the JailbrokenAI team for red-team penetration testing of large language models (LLMs). It interacts with the target model through a dual-protocol adapter that supports OpenRouter, Z.AI, OpenAI API, Anthropic API and local Claude Code CLI, enabling coverage of most commercial LLM APIs.

Core Engine

Automatic Attack Loop

The engine runs a self-contained attack loop that repeatedly mutates and re-sends payloads until either the finish() function signals success or the ask_operator() function pauses for human intervention. The loop operates fully automatically without manual iteration.

Attack Technique Library

WallBreaker bundles research‑grade attack techniques, each enhanced with chain-of-thought (CoT) prompting. Notable methods include:

CipherChat / SelfCipher – sourced from ICLR 2024, embeds ciphertext attacks.

Skeleton Key – from Russinovich 2024, uses “Warning:” tags to re‑frame guardrails.

PAP‑16 Persuasion – Zeng 2024, applies sixteen persuasion strategies simultaneously.

DrAttack – Li 2024, decomposes the target into harmless fragments before recombination.

ICA – Wei 2023, compresses N harmful Q&A pairs into a single context.

PAIR / TAP – automatic iterative adversarial attacks.

Parseltongue Transformation Engine

The built-in engine provides 59 chained transformations (encoding, Unicode fonts, steganography, homoglyphs, zero-width characters, tag injection, bijections, garbled text, etc.) that can be combined to bypass text-classifier guardrails. The upgraded P4RS3LT0NGV3 version, which requires a Node.js environment, expands the set to 222 transformations, including 45 cipher schemes, Braille-like scripts, full‑encoding options and steganographic functions.

Persona Generation System

Using the author_persona command, WallBreaker automatically creates “loyal persona” jailbreak prompts following the ENI methodology: self‑evaluation → verification → refinement → distillation. The sysprompt_* tool extracts leaked system prompts from public LLM APIs (Claude, GPT, Gemini, Grok, etc.) and formats them so the payload speaks the target model’s “native language”.

Multimodal Image Attack Channels

query_image_edit

: send an image plus instruction to the target and evaluate the visual result. image_chain: decompose a rejected image into a multi-step benign edit ladder (jailbreak chain).

T2I composition transform: third-layer text-to-image attack.

LLM Judge Evaluation

WallBreaker includes an LLM Judge module that scores attack outcomes against the HarmBench benchmark suite (400 behaviors across seven categories), providing an unbiased assessment instead of manually curated samples.

Swarm Mode (v2)

Version 2 adds a collaborative multi-model attacker mode that adapts its framework based on the target’s measured defensive posture, allowing several models to cooperate for higher breakthrough rates.

Prompt Vault (v2)

Successful attacks are automatically stored in a model-specific Prompt Vault for later reproducibility and research.

Performance Optimizations (v2)

Token cost reduced by ~20%.

Prompt caching eliminates O(n²) input overhead.

HTTP/2 connection‑pool keep-alive.

Success rate (ASR) increased by roughly 30%.

Configuration and Quick Start

System requirements: Python 3.10+, optional Node.js for the full transformation set, API keys for OpenRouter/Z.AI/OpenAI/Anthropic, and Linux/macOS/Windows (WSL) OS.

Typical installation steps:

git clone https://github.com/JailbrokenAI/wallbreaker
cd wallbreaker
python -m venv .venv
. .venv/bin/activate
pip install -e ".[dev]"   # optional [barcodes] for QR-code tools
cp config.example.toml config.toml   # insert your API keys
wallbreaker check   # verify configuration
wallbreaker         # launch interactive CLI

A sample config.toml defines default profiles, API endpoints, keys and model selections for both the target LLM and the judge LLM.

Licensing

The article is original content from 华盟网 and retains all rights; images are licensed accordingly.