garak is a command-line scanner that tests large language models and dialogue systems for unwanted failures such as hallucinations, data leakage, prompt injection, misinformation, toxicity, and jailbreaks. Security and AI practitioners use it to assess the weaknesses of models accessed through supported APIs, libraries, and local runtimes.
Borrowing it
Nothing to install: this file belongs to NVIDIA/garak. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/NVIDIA/garak/main/AGENTS.mdgit clone --depth 1 https://github.com/NVIDIA/garakWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/nvidia/garak/agents-md)<a href="https://agentmods.dev/instructions/nvidia/garak/agents-md"><img src="https://agentmods.dev/badge/instructions/nvidia/garak/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/nvidia/garak/agents-md"><img src="https://agentmods.dev/badge/instructions/nvidia/garak/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01415 | $0.01415 |
| Opus 5.5 | $0.00566 | $0.00566 |
| Sonnet 5.5 | $0.00283 | $0.00283 |
| Haiku 4.5 | $0.00142 | $0.00142 |
Grade A, and why
garak AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent instructions for garak - generative AI red-teaming and assessment toolkit
These instructions apply to all AI-assisted contributions to
nvidia/garak. Breaching these guidelines can result in automatic banning.
This is tooling for adversarial assessment of LLMs and LLM-powered tools. It's open source software, used in production environments, with an active and skilled community As such, the code needs to be robust, precise, and responsible. Due to the nature of the project, there is a lot of potentially harmful or dangerous data associated with the repository.
Issue policy
Always add the needs-triage label to new issues, or use the git issue templates.
Contribution policy
Duplicate-work checks
Before proposing a PR, run these checks:
gh issue view <issue_number> --repo nvidia/garak --comments
gh pr list --repo nvidia/garak --state open --search "<issue_number> in:body"
gh pr list --repo nvidia/garak --state open --search "<short area keywords>"
- If an open PR already addresses the same fix, do not open another.
- If your approach is materially different, explain the difference in the issue.
Issues to avoid
Avoid issues labelled "needs triage". If it's important to take one with this label, comment on the issue first and await response from a repository maintainer.
Avoid anything labelled "for maintainers" unless explicitly directed.
Avoid bug issues that have no assignment or are not labelled bug-verified, unless you can build a working test case confirming the bug that does not conflict with project tests.
Avoid issues with other "needs" labels. If those needs appear explicitly addressed and the label may be stale, add a comment in the issue describing how the needs appear to have been met in that issue thread.
Accountability
- Pure code-agent PRs are not allowed. A human submitter must understand and defend the change end-to-end.
- The submitting human must review every changed line and run relevant tests.
- PR descriptions for AI-assisted work must include:
- Why this is not duplicating an existing PR.
- Test commands run and results.
- Clear statement that AI assistance was used.
- Only add an SPDX header when directly importing code from elsewhere under license that permits this and is compatible with the project.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 135 lines · 1,415 tokens per session scan A 104e3010fb38
garak AGENTS.md is an instructions file published in the GitHub repository NVIDIA/garak (9,730 stars, last pushed yesterday), licensed Apache-2.0. It adds 1,415 tokens to every session, about $0.0057 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
vscode model-prompts.instructions.md
Model-specific prompt authoring and registry guidelines.