Mesmer

Mesmer is an open-source cognitive red-teaming toolkit for LLM applications. Instead of firing static prompt-injection payloads, Mesmer runs a multi-turn agent system that treats each target like a language-shaped security surface. It profiles the target, chooses cognitive techniques such as foot-in-door, authority bias, narrative transport, and cognitive overload, sends probes, judges the result, and adapts. The core feature is memory. Every run builds an attack graph of what was tried, what scored well, and what became a dead end. Under that, Mesmer maintains a belief map: falsifiable hypotheses about the target, evidence that raises or lowers confidence, and utility-ranked next moves. A second run can start from what the first run learned instead of rediscovering the same failures. This fits "Build for what's next" because AI agents are moving from chat windows into tools, workflows, devices, and robots. Red-teaming them will not only be about bytes and APIs. It will also be about language, persuasion, memory, and intent. Long term, I want Mesmer to become shared infrastructure for the AI security community: something closer to Metasploit for LLMs than a single red-team script. The current project is the cornerstone: a runtime, module system, target adapters, attack graph, belief map, and benchmark pipeline. From here, the community could contribute new cognitive techniques, reusable prompt banks, target profiles, evaluation recipes, and a public catalog of language-level exploit patterns. Not CVEs in the traditional binary sense, but a structured place to document how LLM systems fail under language pressure and how defenders can test against those failures.