Stop Deploying Blind: 179 AI Probes Exposed in 0DIN Scanner

Stop Deploying Blind: 179 AI Probes Exposed in 0DIN Scanner

What if your shiny new AI assistant could be jailbroken in under 30 seconds? What if a single malicious prompt could extract customer data, generate harmful content, or reveal your proprietary training secrets? Here's the brutal truth: most organizations deploying LLMs today are flying completely blind. They're building rocket ships without checking for holes in the hull.

The AI security landscape is a minefield. OWASP's LLM Top 10 reads like a horror story—prompt injection, insecure output handling, sensitive information disclosure, model theft. Yet teams push models to production daily, crossing fingers and hoping for the best. Traditional penetration testing? It doesn't translate. Your standard web scanner won't catch a cleverly crafted prompt injection that turns your helpful chatbot into a data-leaking nightmare.

Enter 0DIN AI Scanner—the open-source weapon that changes everything. Built on battle-tested NVIDIA garak technology and wrapped in a sleek Ruby on Rails interface, this isn't another toy project. With 179 community probes spanning 35 vulnerability families, 0DIN Scanner brings military-grade AI red teaming to your fingertips. No artificial limits. No enterprise gatekeeping. Just pure, unadulterated security visibility. The question isn't whether you can afford to scan your models. It's whether you can afford not to.

What is 0DIN AI Scanner?

0DIN AI Scanner is an open-source web application for AI model security assessments, architected on top of NVIDIA's garak framework—the same probing engine trusted by researchers worldwide. Born from the 0DIN AI security collective, this tool represents a paradigm shift: treating AI systems with the same rigorous security discipline we've applied to traditional software for decades.

The project's DNA is fascinating. NVIDIA garak provides the probing engine—a Python^{↗ Bright Coding Blog} framework specifically designed to find failure modes in generative AI. 0DIN wraps this raw power in production-ready infrastructure: Ruby on Rails for the application layer, PostgreSQL^{↗ Bright Coding Blog} for persistent storage, Docker^{↗ Bright Coding Blog} for seamless deployment. The result? A full-stack security platform that doesn't require a PhD in machine learning to operate.

Why is it trending now? Three converging forces. First, regulatory pressure—the EU AI Act, NIST AI RMF, and emerging compliance frameworks demand documented security assessments. Second, high-profile breaches—from Samsung's leaked source code to countless prompt injection incidents, the cost of negligence is skyrocketing. Third, the tooling gap—until now, AI red teaming required cobbling together scripts, spreadsheets, and prayer. 0DIN Scanner fills this void with structured, repeatable, reportable security testing.

The alignment with OWASP LLM Top 10 isn't marketing fluff—it's architectural intent. Every probe maps to real attack categories that keep security architects awake at night. The multi-tenancy and data encryption at rest signal enterprise readiness. The unlimited scans and users? That's a deliberate middle finger to the per-scan pricing models that gatekeep security from smaller teams.

Key Features That Separate 0DIN From the Pack

Let's dissect what makes this tool genuinely exceptional—not just feature-list exceptional, but architecturally transformative.

179 Community Probes Across 35 Vulnerability Families

This isn't a handful of basic prompt injections. We're talking about a systematically organized probe library covering the full OWASP LLM Top 10 spectrum. Each probe represents a distinct attack vector—some obvious, others insidiously subtle. The "community" designation matters: this library grows with collective intelligence, capturing new techniques as researchers discover them.

Multi-Target Scanning Architecture

Most tools pick a lane. 0DIN Scanner obliterates that limitation. API-based LLMs? Covered—test your OpenAI, Anthropic, or self-hosted endpoints directly. Browser-based chat UIs? Also covered—probe the actual user-facing interface, catching vulnerabilities that API-only testing misses. This dual capability is crucial because real attackers don't restrict themselves to your documented API.

Attack Success Rate (ASR) Scoring with Trend Tracking

Raw vulnerability counts lie. ASR scoring tells the truth about exploitability. More importantly, trend tracking across scan runs reveals whether your hardening efforts actually work. Watch your ASR drop from 34% to 8% over three sprints—that's measurable security progress.

Live Activity Stream and Database-Backed Execution

No more black-box scanning where you launch and pray. The Activity Stream provides real-time visibility into queued and running probes, with complete execution logs persisted to PostgreSQL. When something hangs or behaves unexpectedly, you diagnose immediately, not after a three-hour wait.

PDF Report Export with Per-Probe, Per-Attempt Drill-Down

Compliance auditors love this. Each probe attempt is documented, reproducible, and exportable. The drill-down capability means when a probe flags an issue, you can reconstruct exactly what happened—the prompt, the response, the success criteria.

SIEM Integration: Splunk and Rsyslog

Security doesn't exist in isolation. Forwarding results to your existing SIEM infrastructure means AI security events flow into your unified security operations. No new dashboard to monitor. No alert fatigue from yet another siloed tool.

Multi-Tenant with Encryption at Rest

Enterprise features, zero enterprise tax. Multiple organizations on a single deployment, with PostgreSQL-level encryption protecting data at rest. This is how you offer AI security testing as an internal service.

Real-World Use Cases Where 0DIN Scanner Shines

Use Case 1: Pre-Deployment AI Gatekeeping

Your team trained a fine-tuned model for customer support. Before it touches production, 0DIN Scanner runs the full 179-probe battery. The scan reveals prompt injection vulnerabilities in the system prompt handling—attackers could extract your base instructions. You patch, rescan, and deploy with documented security assurance. This is shift-left security for AI, and it's non-negotiable.

Use Case 2: Third-Party AI Vendor Validation

You're integrating a vendor's LLM API. Their SOC 2 looks shiny, but what about actual AI-specific security? Point 0DIN Scanner at their endpoint. The multi-target capability tests both their API and any embedded chat widget. ASR scoring gives you objective metrics for vendor risk assessment. Share the PDF report in procurement—watch how quickly security clauses get attention.

Use Case 3: Continuous Security Monitoring

AI models drift. Updates to base models, prompt templates, or retrieval pipelines can reintroduce vulnerabilities. Scheduled scans with configurable recurrence automate vigilance. The trend tracking catches regression: your ASR was 5% last month, now it's 12% after that "minor" prompt update. Investigate before attackers do.

Use Case 4: Red Team Operations and Security Research

Internal red teams use 0DIN Scanner as their systematic foundation, not replacement for creativity. Run the automated probe suite first—catch the low-hanging fruit. Then apply human ingenuity to the edge cases. The execution logs and per-attempt drill-down accelerate manual analysis. Export structured data for custom tooling integration.

Use Case 5: Compliance and Audit Documentation

Regulators increasingly demand demonstrable AI security practices. 0DIN Scanner's reports provide exactly that—timestamped, reproducible, comprehensive. The OWASP LLM Top 10 alignment maps directly to emerging frameworks. When auditors ask "how do you test AI security?", you show them your scanning program, not a vague policy document.

Step-by-Step Installation & Setup Guide

Getting 0DIN Scanner running takes minutes, not hours. Choose your path:

One-Line Automated Install

# Download and execute the official installation script
# This handles Docker, dependencies, and initial configuration automatically
curl -sL https://raw.githubusercontent.com/0din-ai/ai-scanner/main/scripts/install.sh | bash

The script detects your environment, installs prerequisites if needed, and launches the application stack. Ideal for quick evaluation or development environments.

Manual Docker Compose Deployment (Recommended for Production)

For teams who demand full configuration control, the manual path provides transparency:

# Step 1: Download the orchestration file
curl -O https://raw.githubusercontent.com/0din-ai/ai-scanner/main/dist/docker-compose.yml

# Step 2: Download the environment template
curl -O https://raw.githubusercontent.com/0din-ai/ai-scanner/main/.env.example

# Step 3: Create your active configuration from the template
cp .env.example .env

Now edit .env with critical security values:

# Generate a cryptographically secure secret for Rails
# This protects session cookies and encrypted data
openssl rand -hex 64
# Copy the output into SECRET_KEY_BASE in .env

# Set your PostgreSQL password—use a strong, unique value
POSTGRES_PASSWORD=your-unique-strong-password-here

# Set the initial admin password—CHANGE THIS IMMEDIATELY AFTER LOGIN
ADMIN_INITIAL_PASSWORD=change-me-on-first-login-please

Launch the stack:

# Start all services in detached mode
docker compose up -d

Access your instance at http://localhost and authenticate with:

• Username: admin@example.com
• Password: Your ADMIN_INITIAL_PASSWORD value

Critical security step: Change the initial password immediately after first login. This default credential is well-documented and must not persist.

For production deployments, consult the deployment documentation covering TLS termination, database hardening, and network isolation.

REAL Code Examples: Inside 0DIN Scanner's Implementation

Let's examine the actual infrastructure and patterns that power this platform.

Example 1: The One-Line Installer

# The installation script demonstrates modern shell distribution patterns
# -s: silent mode (no progress meter)
# -L: follow redirects (handles GitHub's CDN redirection)
# Pipe to bash for immediate execution—evaluate source trust before running
curl -sL https://raw.githubusercontent.com/0din-ai/ai-scanner/main/scripts/install.sh | bash

This pattern, while convenient, embodies a security trade-off: you're executing remote code. For production, the manual Docker Compose path provides auditability. The script itself likely performs environment detection, dependency resolution, and stack initialization—abstracting Docker complexity for rapid evaluation.

Example 2: Docker Compose Environment Bootstrap

# Retrieve the exact orchestration specification from version control
curl -O https://raw.githubusercontent.com/0din-ai/ai-scanner/main/dist/docker-compose.yml

# Get the configuration template with documented variables
curl -O https://raw.githubusercontent.com/0din-ai/ai-scanner/main/.env.example

# Create your instance-specific configuration (never commit this!)
cp .env.example .env

This three-step pattern is infrastructure-as-code best practice. The .env file separation keeps secrets out of version control while the docker-compose.yml provides reproducible infrastructure. The -O flag preserves original filenames, ensuring documentation references remain valid.

Example 3: Cryptographic Secret Generation

# Generate 64 bytes of random data, hex-encoded for configuration compatibility
# 64 bytes = 512 bits of entropy—exceeding current cryptographic requirements
openssl rand -hex 64

# Example output (your value will differ):
# 3a7f9e2b1c8d4e5f6a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f
# 3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b

Rails applications use SECRET_KEY_BASE for multiple cryptographic purposes: signed cookies, encrypted session storage, and message verifiers. The openssl rand -hex 64 command generates 128 hex characters representing 64 bytes of true randomness. This isn't overkill—compromised secrets enable session hijacking and privilege escalation.

Example 4: Docker Compose Launch Command

# -d: detached mode—containers run in background, terminal returns immediately
# Services defined in docker-compose.yml typically include:
#   - web: Ruby on Rails application server
#   - db: PostgreSQL with encryption configuration
#   - redis: Session and job queue caching (inferred from Rails conventions)
#   - worker: Background job processor for scan execution
docker compose up -d

The detached mode is essential for production-like operation. Logs remain accessible via docker compose logs -f [service], but the terminal isn't blocked. The service architecture follows standard Rails patterns: web server handles HTTP requests, worker processes execute the long-running garak probes, database persists state, and caching layers optimize performance.

Example 5: Security-Critical First Login

# Default credentials for initial access—treated as bootstrap, not persistent
Username: admin@example.com
Password: [value of ADMIN_INITIAL_PASSWORD from .env]

# IMMEDIATE ACTION REQUIRED: Navigate to profile settings and change password
# The default password exists in documentation and must be assumed compromised

This bootstrap pattern balances deployment simplicity with security awareness. The explicit warning in documentation serves as defense-in-depth—educated administrators change credentials immediately. The admin@example.com address is conventional but should be updated to your organization's admin email in production configurations.

Advanced Usage & Best Practices

Probe Selection Strategy: Don't blindly run all 179 probes every time. For rapid regression testing, select probe families matching your recent changes. Modified the system prompt? Prioritize prompt injection and jailbreak probes. Updated the RAG pipeline? Focus on data extraction and context manipulation probes. Save full suites for comprehensive assessments.

ASR Trend Interpretation: A single scan's ASR is a snapshot; the trend is the story. Configure weekly scheduled scans with identical parameters. Track ASR in your metrics platform. Sudden spikes demand immediate investigation—they often correlate with deployments, configuration changes, or upstream model updates.

SIEM Integration Tuning: Raw probe results generate volume. Configure severity-based filtering in your SIEM forwarding—only escalate high-confidence successes and novel failure modes. The per-attempt drill-down means when Splunk alerts fire, your analysts have immediate context, not just a binary flag.

Multi-Tenant Isolation: For managed security service providers, leverage the multi-tenant architecture. Each client organization gets isolated data with unified infrastructure. The encryption at rest satisfies client data protection requirements without per-client deployment overhead.

Custom Probe Development: The garak foundation supports extension. Organizations with unique threat models can develop proprietary probes while leveraging 0DIN's scheduling, reporting, and integration infrastructure. This hybrid approach—community probes for common attacks, custom probes for specialized risks—maximizes coverage efficiency.

Comparison with Alternatives

The strategic advantage is clear: 0DIN Scanner delivers enterprise-grade capabilities without enterprise-grade lock-in. Manual garak provides the same engine but demands significant DevOps^{↗ Bright Coding Blog} investment. Commercial platforms offer polish but at costs that exclude smaller organizations and create vendor dependency.

Frequently Asked Questions

What exactly does 0DIN AI Scanner test?

0DIN Scanner probes AI systems for vulnerabilities aligned with the OWASP LLM Top 10, including prompt injection, insecure output handling, sensitive information disclosure, model denial of service, and supply chain risks. The 179 probes systematically exercise these failure modes.

Is this only for API-based models, or can it test chat interfaces too?

Both. The multi-target scanning supports API endpoints (OpenAI-compatible, custom) and browser-based chat UIs. Testing the actual user interface catches vulnerabilities that API-only testing misses, like DOM-based prompt injection.

Do I need machine learning expertise to use 0DIN Scanner?

No. The web interface abstracts garak's complexity. Define your target, select probes, and launch. The results interpretation requires security awareness, not ML PhD—each report explains what was tested and why it matters.

How does this differ from using garak directly?

Garak is the engine; 0DIN Scanner is the vehicle. You get scheduling, multi-user access, persistent results, trend analysis, PDF reporting, and SIEM integration—none of which exist in raw garak without significant custom development.

Is my scan data secure?

Data encrypts at rest in PostgreSQL. Multi-tenant deployments isolate organizational data. For maximum control, self-host entirely within your infrastructure—no data leaves your network unless you configure SIEM forwarding.

What are the hardware requirements?

Docker Compose deployment runs on modest hardware: 4GB RAM minimum, 8GB recommended for concurrent scans. The probing itself is network-bound, not compute-intensive—no GPU required for the scanner platform.

Can I contribute new probes?

Absolutely. The community probe library grows through contribution. See CONTRIBUTING.md for probe development guidelines and the pull request process.

Conclusion: The Security Imperative You Can't Ignore

The AI deployment gold rush has created a massive security debt. Organizations are shipping models faster than they can assess their failure modes. 0DIN AI Scanner—available at github.com/0din-ai/ai-scanner—represents the reckoning: free, open-source, enterprise-capable security testing that meets AI where it lives.

The 179 probes aren't a marketing number. They're 179 ways your model can fail, each mapped to real attacker techniques documented in the OWASP LLM Top 10. The ASR scoring isn't vanity metrics—it's measurable security posture. The unlimited scans and users aren't generosity; it's the recognition that security can't be rationed.

My assessment? This is the most strategically important open-source AI security tool currently available. It bridges the gap between research-grade probing and operational security workflows. It respects your expertise while removing infrastructure drudgery. And it arrives precisely when the industry needs it most.

Don't deploy your next model without scanning it first. The installation takes minutes. The first scan takes less than an hour. The confidence? That lasts until your next deployment—which you'll also scan, because you've built the habit. Start now: github.com/0din-ai/ai-scanner.