0DIN is a generative AI security programme, backed by Mozilla and led by researchers, that tests chatbots, AI applications and agents against exploits found and validated by its research community. It started as a bug bounty for large language models and now turns those real attacks into testing tools, threat intelligence and runtime detection.
It is for security teams shipping generative AI who need to know whether their models and agents can be talked into leaking data or taking actions they should not, using attacks that have already worked in the wild rather than synthetic ones.
At A Glance
| Vendor | 0DIN (Mozilla-backed) |
|---|---|
| Category | AI model security testing and GenAI bug bounty |
| Deployment | Hosted service; Defense classifier self-hosted or as a hosted early-access beta |
| Agentic AI | Testing of tool-using, autonomous agents and agent threat hunting |
| Customers | Cisco |
| Market classification | AI Model Security; also Vulnerability Management |
What 0DIN Does
The model is a loop. Real attacks arrive through a bug bounty that anyone can join, and the team turns them into probes, intelligence feeds and detection models. Security teams then use those assets to test their chatbots, AI applications and agentic workflows for data exposure, policy bypass, unsafe output, tool misuse and multi-turn social engineering. Results are packaged as audit-ready evidence aimed at SOC 2, ISO 27001 and NIST AI RMF, and findings are mapped to the OWASP LLM Top 10 and MITRE ATLAS.
Products
SusFactor
SusFactor helps teams stop hostile prompts before they reach a model. It scores each prompt for jailbreak and prompt-injection intent and returns a suspicion score between 0 and 1, with an is_suspicious flag at a 0.5 cutoff.
Scanner
Scanner is an open-source platform for monitoring, tracking and analysing vulnerabilities in generative AI and agentic models. It suits teams that want to run their own testing programme across several models:
- Real-time vulnerability tracking with an interactive metrics dashboard
- Structured probe management and automated security testing
- Cross-model tracking and trend analysis
- Scheduled scans, rerun when a model or prompt changes, and PDF reports
AI Vulnerability Intelligence
Red teams that already use tools such as PyRIT and Garak can feed them with 0DIN’s curated, versioned Probe Packs in JSONL or YAML and with the 0DIN Intel feed.
Defense
Defense is runtime protection that blocks jailbreaks and prompt injection as they happen. It embeds detection of prompt-based attacks in the application, adds agent threat hunting, and its classifier can be self-hosted.
GenAI Bug Bounty
Model and application owners get real-world findings from the bounty, which covers guardrail jailbreaks, prompt injection and interpreter jailbreaks. Rewards run from Low ($500) to Severe ($15,000) and are paid before disclosure. Eligible application bugs start with a prompt injection and must lead to unauthorised actions, while eligible model bugs must sit in the models themselves rather than in surrounding software.
AI Control Gap Assessment
For organisations that want a starting point, the AI Control Gap Assessment is a focused first-pass review of one AI workflow.
How It Works
Defense runs in four steps: deploy, score, decide and act, with the fine-tuned SusFactor classifier doing the scoring.
| Component | What it does |
|---|---|
| Local encoder | Default detection runs in-process, so prompts stay in the customer’s environment and no network call is needed. |
| REST API | SusFactor can be called self-hosted or through the hosted early-access beta, which is not meant for production or sensitive data. |
| Training data | 0DIN Intel, the bounty feed of real jailbreaks, trains the classifier, with WildJailbreak used for refinement. |
| Disclosure process | The team responds on scope within 3 business days, tries to validate a report within 2 weeks, gives application vendors up to 120 days before public disclosure and pays researchers within 30 days of a contractual agreement. |
Agentic AI Capabilities
Testing extends to tool-using, autonomous agents, where a successful attack can lead to actions rather than just bad text. Probes look for:
- Agent control failures
- Attacks delivered through untrusted input the agent reads
- Unauthorised tool use by the agent
The bug bounty accepts agentic vulnerabilities too, and its High tier covers tool-call abuse and exfiltration of RAG sources or sensitive context.
Integrations
| Area | Integrations |
|---|---|
| Security operations | SIEM export into existing tools |
| Red teaming tools | Probe Packs for PyRIT, Garak or in-house tooling |
| Guardrail frameworks | any-guardrail and litellm-shield |
Company Background
| Launch | Mozilla announced the 0Day Investigative Network in June 2024 as a bug bounty programme for large language models and other deep learning technologies |
|---|---|
| Ownership | Backed by Mozilla and listed among Mozilla New Products as a GenAI bug bounty platform |
| Research community | More than 3,200 researchers |
Note: This overview is compiled from 0DIN’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.