$ the-wire · showcase
PyRIT locks down credential-backed targets, deprecates label queries
By RepoJournal · Filed · About AI Red Teaming · Composed from the cited sources · methodology
PyRIT closed a privilege escalation where a non-administrator could point a credentials-backed AzureBlobStorageTarget at a caller-chosen container, and both projects spent the rest of the day on dependency and CI hygiene that operators can mostly ignore.
[BREAKING] FIX: Require administrator access to create targets that use the server's stored credentials microsoft/PyRIT
Creating a target that uses the server's own credentials through POST /api/targets now requires administrator access. In api_key mode with no token supplied, AzureBlobStorageTarget falls back to a server-configured token or DefaultAzureCredential, which meant a non-admin could set container_url and name a blob such as .pyrit_conf in file_name metadata; the PR is flagged BREAKING, so any non-adm...
MAINT: deprecate labels on message and prompt-score queries microsoft/PyRIT
The labels argument on get_message_pieces_async and get_prompt_scores_async still works but now warns, because labels moved to attack results and filtering messages by label only ever matched an attack's final conversation. Query get_attack_results_async by label and fetch the conversations from there; BatchScorer keeps its labels filter and does that lookup internally with the same scope as be...
ci: fall back when the Docker image mirror is throttled promptfoo/promptfoo
The Docker sandbox example now falls back to Docker Hub at the identical pinned digest when Public ECR's bounded retries exhaust on 'toomanyrequests: Data limit exceeded', and tags the source that actually succeeded. Only registry throttling advances to the next allowlisted source, so authentication errors, missing manifests and exhausted mirrors still fail rather than silently switching.
chore(deps): update dependency mermaid to v12 promptfoo/promptfoo
Mermaid is now on 12.1.0 with lockfile entries updated, since the earlier override-only change still resolved 11.17.2. The docs keep the Dagre layout and classic appearance rather than Mermaid 12's ELK and neo defaults, so the diagram output you read is unchanged.
chore(deps): lock file maintenance promptfoo/promptfoo
Lockfile maintenance across the root/workspace and code-scan-action keeps the 64 MiB decompressed-response limit explicit after Undici changed its default to unlimited, and leaves Mermaid on 11 pending the migration review. Playwright and playwright-core move from 1.63.0 to 1.64.0; the intervening Windows failure in the real Python cancellation test was a readiness check that polled for the mar...
Action items
