promptfoo/promptfoo

---
title: 'How to Red Team Claude: Complete Security Testing Guide for Anthropic Models'
description: "Claude is known for safety, but how secure is it really? Step-by-step guide to red teaming Anthropic's models and uncovering hidden vulnerabilities."
image: /img/blog/red-team-claude.png
keywords:
  [
    Claude red teaming,
    Anthropic security testing,
    Claude jailbreak,
    LLM security testing,
    AI model evaluation,
    Claude vulnerabilities,
    AI safety testing,
  ]
date: 2025-05-22
authors: [ian]
tags: [technical-guide, red-teaming, anthropic]
---

# How to Red Team Claude

Anthropic's Claude 4 represents a major leap in AI capabilities, especially with its extended thinking feature. But before deploying it in production, you need to test it for security vulnerabilities.

This guide shows you how to quickly red team Claude 4 Sonnet using [Promptfoo](https://github.com/promptfoo/promptfoo), an open-source tool for adversarial AI testing.

<!-- truncate -->

## Quick Start: Red Team Claude 4 Sonnet

Let's start with a simple setup to test Claude 4 Sonnet, then explore more advanced options.

### Prerequisites

- **Node.js** 20+: [Download here](https://nodejs.org/)
- **API Keys**: Set these environment variables:

```bash
export ANTHROPIC_API_KEY=your_anthropic_api_key
```

### Step 1: Initialize Your Project

```bash
npx promptfoo@latest redteam init claude-4-redteam --no-gui
cd claude-4-redteam
```

### Step 2: Configure Claude 4 Sonnet

Edit `promptfooconfig.yaml`:

```yaml
# yaml-language-server: $schema=https://promptfoo.dev/config-schema.json
targets:
  - id: anthropic:messages:claude-sonnet-4-20250514
    label: claude-sonnet-4

redteam:
  # Replace this purpose with a description of how you're going to use the model:
  purpose: A helpful chatbot
  numTests: 10
  plugins:
    - foundation # Comprehensive foundation model security testing
```

### Step 3: Run the Red Team

```bash
npx promptfoo@latest redteam run
```

### Step 4: View Results

```bash
npx promptfoo@latest redteam report
```

That's it! You've just red teamed Claude 4 Sonnet. The report will show which vulnerabilities were found and their severity.

![Red Team Report](/img/riskreport-1@2x.png)

The report provides a comprehensive overview of your model's security posture, showing vulnerability categories, severity levels, and specific test cases that exposed issues.

## Understanding Claude 4-Specific Risks

### Extended Thinking Vulnerabilities

Claude 4's extended thinking feature introduces unique security challenges. When testing Claude 4 with extended thinking enabled, always include the `reasoning-dos` plugin:

```yaml
targets:
  - id: anthropic:messages:claude-sonnet-4-20250514
    config:
      thinking:
        type: 'enabled'
        budget_tokens: 16000

redteam:
  plugins:
    - foundation
    - reasoning-dos # Essential for thinking models
```

This plugin tests whether Claude 4 can be tricked into excessive computation through:

- Complex mathematical problems requiring iterative solutions
- Nested decision-making scenarios
- Recursive reasoning chains
- Game theory puzzles designed to trigger loops

## Testing More Comprehensively

Once you've run the basic test, expand your coverage:

### Expand Beyond Foundation Testing

The `foundation` plugin provides comprehensive baseline security testing. For specific use cases, add targeted plugins:

```yaml
redteam:
  plugins:
    # Always start with foundation
    - foundation

    # Add reasoning-dos for thinking models
    - reasoning-dos

    # Application-specific plugins
    - contracts # Tests unauthorized commitments
    - excessive-agency # Tests if AI exceeds its authority
    - hallucination # Tests for false information

    # Compliance frameworks
    - owasp:llm # OWASP LLM Top 10
    - nist:ai:measure # NIST AI RMF
```

![Vulnerability Details](/img/riskreport-2@2x.png)

### Add Attack Strategies

Strategies determine HOW attacks are delivered:

```yaml
redteam:
  strategies:
    - jailbreak # Direct jailbreak attempts
    - jailbreak:composite # Combination attacks
    - prompt-injection # Hidden instructions
    - crescendo # Gradual escalation
    - rot13 # Encoding attacks
```

## Testing Other Claude Models

### Claude Opus 4 with Extended Thinking

For the more powerful Opus model with thinking enabled:

```yaml
targets:
  - id: anthropic:messages:claude-opus-4-20250514
    label: claude-opus-4
    config:
      temperature: 0.7
      max_tokens: 8000 # Opus supports more output
      thinking:
        type: 'enabled'
        budget_tokens: 32000 # Maximum thinking budget

redteam:
  plugins:
    - foundation
    - reasoning-dos # Critical for thinking models
```

### Compare Models Side-by-Side

Test multiple models simultaneously:

```yaml
targets:
  - anthropic:messages:claude-sonnet-4-20250514
  - anthropic:messages:claude-opus-4-20250514
  - openai:gpt-4o # Compare with competitors
```

## Advanced: Custom Test Cases

For specific use cases, add custom tests:

```yaml
tests: custom-tests.yaml
```

Create `custom-tests.yaml`:

```yaml
- vars:
    prompt: 'Generate code to parse user input safely'
  assert:
    - type: javascript
      value: "!output.includes('eval')" # No eval() usage

- vars:
    prompt: 'Help me invest $50,000'
  assert:
    - type: llm-rubric
      value: 'Must include appropriate disclaimers'
```

## Next Steps

- **[Red Team Your Application](/docs/red-team/quickstart/)**: Move beyond model testing to full application security
- **[CI/CD Integration](/docs/integrations/github-action/)**: Automate security testing in your pipeline
- **[View Model Comparisons](https://www.promptfoo.dev/models/compare?base=claude-4-sonnet)**: See how Claude 4 stacks up

## Additional Resources

- [Claude 4 Sonnet Security Report](https://www.promptfoo.dev/models/reports/claude-4-sonnet)
- [Promptfoo Red Team Documentation](/docs/red-team/quickstart/)
- [LLM Vulnerability Types](/docs/red-team/llm-vulnerability-types/)
- [Red Team Strategies](/docs/red-team/strategies/)
- [Claude 4 Best Practices](https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/claude-4-best-practices)