What OWASP’s GenAI Red Teaming Manual asks defenders to prove

OWASP's manual lays out a red-teaming process from planning and reconnaissance through attack-surface mapping, exploitation, persistence, impact assessment, reporting and remediation. It considers models, applications, agents and multimodal inputs. That breadth matters because an apparently safe model can still sit inside a workflow with broad tools, weak retrieval boundaries or private data in reach.

For a defender, the manual is most useful as a test-planning aid. Draw the system first: who can send input, which sources can be retrieved, which tools the agent can call, and what approval stands between a suggestion and an action.

1. 1

   Set a boundary. Define permitted test accounts, data, tools and escalation contacts. Avoid using live sensitive material just to make a demonstration dramatic.

2. 2

   Capture the route. Record the exact input, retrieved content, model or application version, tool permissions, output and downstream action. A screenshot alone rarely explains the trust failure.

3. 3

   Prioritise impact. Ask what changed outside the model: data disclosure, unauthorised action, unsafe advice or a persistent configuration change. Separate a surprising answer from a security outcome.

4. 4

   Retest the repair. Assign an owner and repeat the same path after controls change. Test adjacent paths too: a fixed prompt may leave the tool permission or data boundary untouched.

The report should let another analyst replay the route, understand the permissions that mattered, and check whether the fix survived a realistic variation. That is a far better hand-off than a collection of jailbreak screenshots.