Enterprise AI Security Red Teaming Platform

Test any AI model for security vulnerabilities in minutes — real attack scenarios, CVSS scoring, and audit-ready evidence across 6 compliance frameworks. Built with Codex + GPT-5.6.

Comment

Inspiration

Enterprises are adopting AI faster than they can secure it. Companies are wiring large language models into customer support, internal tools, and decision-making. But most have no way to answer a simple question their legal and security teams are now asking: "Can our AI be tricked into leaking confidential data, breaking its own rules, or violating compliance?' Existing security scanners were built for deterministic software, not probabilistic AI. We built the tool that fills that gap.

What it does

The Enterprise AI Security Red Teaming Platform stress-tests any AI model for security and compliance weaknesses in minutes:

  • Runs structured attack scenarios: prompt injection, sensitive data leakage, jailbreaking, hallucination, bias amplification, and promise violation against any commercial model.
  • Transforms each attack through 10 stylistic techniques (poetry, role-play, academic framing, and more) to bypass surface-level filters and probe deeper.
  • Scores every finding on CVSS v3.1: the same standard enterprise security teams already use for traditional vulnerabilities.
  • Maps results to six compliance frameworks: SOC 2, ISO 27001, GDPR, CCPA, NIST AI RMF, and CPCSC, producing audit-ready evidence automatically.
  • Compares vendors side by side so teams can choose the safer model with data, not marketing claims.
  • Generates an Executive Summary: built with OpenAI Codex and GPT-5.6 that turns technical findings into a plain-English briefing a CEO or compliance officer can act on immediately.

How we built it

The backend is FastAPI + PostgreSQL + SQLAlchemy; the frontend is Next.js, React, and Tailwind. The platform is live in production on DigitalOcean with an automated deploy pipeline.

For Build Week, we used OpenAI Codex with GPT-5.6 to design and ship the Executive Summary feature end to end. Codex wrote the FastAPI background-job endpoint, the OpenAI adapter method, and the React polling UI in a single session. Then helped us harden it with graceful error handling and a deterministic fallback so the feature never breaks, even if the AI provider is unavailable.

Challenges we ran into

Taking a demo-grade capstone to production surfaced real engineering problems: database connection-pool exhaustion under load, a rolling-deploy deadlock where the old container starved the new one of connections, and a proxy-timeout race condition on the summary endpoint. We solved each one: singleton connection pooling, background-thread startup, and moving long AI calls off the request path into polled background jobs. Codex accelerated diagnosis and the fixes.

Accomplishments that we're proud of

The thing we keep coming back to: this isn't a mockup. It's a real product, live right now, that you can open and actually run a security test against. A lot of hackathon projects are held together with tape behind the scenes — ours isn't. It's been through real production problems (database connections running out, deploys getting stuck in a loop) and we fixed them the right way instead of papering over them. We're also proud that a non-engineer can read the output. Security tools usually spit out logs only another engineer can decode. Ours hands a CEO or a compliance officer a plain paragraph telling them what broke and what to do about it — that was the whole point of building this. And honestly, shipping a new feature with Codex in the middle of an already-live, already-working platform without breaking anything for existing users felt like a small win on its own.

What we learned

The difference between "it works in a demo" and "it works in production" is a discipline, not a feature. Graceful degradation, honest error surfacing, and fast-failing timeouts matter more than any single capability.

What's next for Enterprise AI Security Red Teaming Platform

Continuous monitoring instead of one-off tests, runtime protection, SOC 2 certification, and CI/CD integrations so teams can gate deployments on AI security tests.

Built With

Share this project:

Updates

posted an update —

Shipped a new feature tonight: Executive Summary.

After a security test finishes, you can now click one button and get a plain English summary of what happened, written for someone who isn't technical. A CEO or a compliance officer doesn't want to read risk scores and vulnerability categories. They want to know what broke, how bad it is, and what to do next. That's what this does.

Built it using OpenAI Codex and GPT-5.6 for Build Week. Codex wrote the background job, the OpenAI integration, and the frontend polling logic in one session. The trickier part wasn't the AI call itself, it was making sure the feature never actually breaks. If OpenAI is slow or unavailable, the platform falls back to a summary built directly from the test data instead of just failing. Small thing, but it's the difference between a demo and something you'd actually trust.

Also spent time tonight fixing real production issues that only show up once real traffic hits the app: a database connection limit, and a timeout race condition between our backend and the hosting platform's own proxy. Neither of those are visible to a user, but they're the kind of thing that separates "it works on my machine" from "it works."

Platform's live if you want to try it yourself.

Log in or sign up for Devpost to join the conversation.