$ the-wire · showcase
PyRIT locks down target creation and uploads
By RepoJournal · Filed · About AI Red Teaming · Composed from the cited sources · methodology
10 people shipped this
PyRIT closed two paths that let an API caller make the server run model repository code and exfiltrate arbitrary files, at the cost of two breaking changes for anyone creating targets through the REST API.
[BREAKING] FIX: Require administrator access to create targets that run model repository code microsoft/PyRIT
Because HuggingFaceChatTarget loads its model on construction and trust_remote_code=True executes Python published in the model repo, POST /api/targets could be used to run that code on the server; the type stays in GET /api/targets/types, but creating it with trust_remote_code omitted or false only, and the flag's resolution now requires administrator access.
[BREAKING] FIX: Keep uploads from API-created HTTP targets in a server-chosen folder microsoft/PyRIT
HTTPXAPITarget uploads a file when it sends file_path, a path-typed message piece, or a text prompt naming an existing file, and an API-created target previously let the caller pick both the file and allowed_upload_directory, or leave the folder unset to allow any readable file such as .env; the operator now chooses the folder from the server side.
fix(deps)!: make jks-js an optional peer dependency promptfoo/promptfoo
jks-js moves from a hard dependency to an optional peer so default installs no longer drag in its node-forge chain, whose advisory GHSA-86w9-cpqp-85rv still has no patched release.
fix(assertions): honor the not- prefix for tool-call validity assertions promptfoo/promptfoo
Tool-call validity assertions now respect the not- prefix, while configuration errors and validator failures still fail, and custom providers report invalid calls via InvalidToolCallError from promptfoo/contracts.
MAINT: Bound Copilot response receive time microsoft/PyRIT
A stream of partial, non-terminating WebSocket messages could restart the full response_timeout_seconds on every recv and keep the receive loop alive indefinitely; each input receive loop now runs under one asyncio.timeout() scope, with handshake and user response on separate budgets.
Add Python 3.14 support NVIDIA/garak
Garak adds the 3.14 trove classifier and extends its Linux, macOS, Windows and package-install CI matrices, widening the README conda example to python>=3.11,<=3.14; elsewhere, PyRIT pages attack-result deltas in keyset order and no longer counts a re-emitted row twice in cached results, and the remaining REST request limits are wired through fields that missed them.
Action items
- → Audit API-created PyRIT targets and grant administrator access only where trust_remote_code or uploads are required microsoft/PyRIT [immediate]
- → Install jks-js alongside promptfoo if you rely on JKS authentication promptfoo/promptfoo [plan]
