LFLearn with Faisal

Free AI Toolkit (3/3): Test It, Secure It, Learn It From the Source

Faisal Adnan · 05 Nov 2026

QA and evaluation

  • Playwright (Apache-2.0): automates browser tests across Chromium, Firefox and WebKit with one API.
  • promptfoo (MIT): tests and red-teams your prompts, agents and RAG apps, and compares models side by side.
  • Ragas (Apache-2.0): measures whether a retrieval-based system's answers are faithful to its sources.

AI security

  • garak (Apache-2.0): NVIDIA's LLM vulnerability scanner. It probes for hallucination, data leakage, prompt injection, jailbreaks and other weaknesses. If you know nmap, think of it as nmap for language models.
  • PyRIT (MIT): Microsoft's open-source toolkit for red-teaming generative AI, with automated scans and adaptive multi-turn attacks.
  • Semgrep (LGPL-2.1): finds bugs and security flaws in code, in more than 30 languages.

ML core, data, games and design

  • Transformers (Apache-2.0): thousands of pretrained text, vision and audio models.
  • scikit-learn (BSD-3): classic machine learning made easy. It started in 2007 as a Google Summer of Code project.
  • Chroma (Apache-2.0): a vector database that gives your app memory.
  • Godot (MIT): a free 2D and 3D game engine with no royalties.
  • Penpot (MPL-2.0): an open-source alternative to Figma.

Learn from the source

  • nanochat (MIT): Karpathy's project to train your own ChatGPT-style model for around $100, on a single GPU node.
  • Neural Networks: Zero to Hero (MIT): from the basics to building a GPT.
  • Generative AI for Beginners (MIT): 21 lessons from Microsoft.
  • Hugging Face Agents Course (Apache-2.0): a free, hands-on course on AI agents.

Why security and testing deserve your time

Every story in my other posts, from the exposed Moltbook database to the deleted production data, was a testing or security failure at its root. The market is short of people who can find these problems before users do.

A starter plan

  1. Write ten test questions for any chatbot you built. Run them with promptfoo each time you change a prompt.
  2. Scan a small app of your own with garak or Semgrep, and fix the first thing it finds.
  3. Write up what you tested and what you found. That write-up is a portfolio piece.

Sources

Part of the talk "The AI Era" by Faisal Adnan, Riphah International University, 6 November 2026.