$ the-wire · showcase
PyRIT fails loudly on bad config paths, promptfoo stabilizes its OTLP receiver
By RepoJournal · Filed · About AI Red Teaming · Composed from the cited sources · methodology
Two operator-facing fixes land: PyRIT's scanners now refuse a --config-file path that doesn't exist instead of silently running with defaults, and promptfoo's tracing receiver no longer reconfigures itself on repeated startups.
FIX: Reject explicitly supplied --config-file paths that do not exist microsoft/PyRIT
A --config-file path that doesn't exist used to be dropped without a word, so a typo left pyrit_scan or pyrit_shell pointed at an unintended server or auth mode; `pyrit_scan list-targets --config-file /does/not/exist.yaml` exited 0. It now rejects the path, which will surface as a hard failure in any script or CI job that was quietly running on defaults.
fix(tracing): preserve OTLP receiver startup options promptfoo/promptfoo
Repeated calls to startOTLPReceiver used to overwrite the shared endpoint's accepted formats and fallback redaction/tool policies and try to bind a second listener. The first successful startup's options now persist, and shutdown/startup are serialized so an idle stop can't close a fresh receiver and a restart can't reuse a closing listener.
FEAT: Browse Scenario result parents and children in the GUI (#3602) microsoft/PyRIT
PyRIT's GUI now lets you walk a scenario result's parent and child runs rather than only the flat outcome, which matters when you're tracing a multi-turn attack back to the prompt that triggered it.
FIX: Reread recently modified scorer metrics instead of caching them microsoft/PyRIT
The progress read model keyed its metric cache on mtime, ctime, size and inode, so a same-length rewrite within one filesystem clock tick showed stale scorer metrics in the GUI. Metrics are now reread after a recent write, so a rescored run updates without a restart.
FIX: Make ShellCommandOutputScorer destructive-shell regex linear time (#3702) microsoft/PyRIT
ShellCommandOutputScorer's destructive-shell regex now runs in linear time instead of backtracking on hostile model output. Elsewhere the long tail: the Anthropic SDK moves to 1.1.0 and the Claude Agent SDK to 0.3.309 (both major-adjacent bumps worth a quick smoke test of your provider config), Biome goes to 2.6.2, invalid duration values are handled, and .env_example points at a current Gemini...
Action items
