$ cat ai-red-teaming/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
promptfoo 0.124.0 goes opt-in and removes ChatKit
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The release makes WatsonX, Slack, Langfuse and OpenAI Agents SDKs opt-in and drops the hosted ChatKit provider, so installs fail until you add the extras.
0.124.0 promptfoo/promptfoo
WatsonX, Slack, OpenAI Agents, Transformers and Langfuse SDKs are now opt-in installs, and the hosted ChatKit provider is gone. Upgrading without adding the extras turns those providers into resolution errors, so check your config before you pull the new version.
fix(providers): show the global install command for opt-in SDKs promptfoo/promptfoo
Until now a missing SDK produced a bare module-not-found for an optional dependency. The error now prints the global install command, resolving the SDKs from Promptfoo's own install location the same way the Codex Security SDK already worked.
fix(deps): update MCP SDK to 1.32.0 for redirect security fixes promptfoo/promptfoo
The MCP SDK moves from 1.30.0 to 1.32.0 because 1.30.1 still allowed cross-origin HTTP redirects to forward custom credentials and request bodies. If your setup talks to remote MCP servers, this is the reason to take the update.
feat(providers): add OpenAI Decisions support promptfoo/promptfoo
Adds openai:decisions:<model> for OpenAI's Decisions API, answering predicate, choice and ordered-score questions over text and inline images, with text-output llm-rubric and classifier grading. Existing OpenAI configs are untouched unless you reference the new provider.
FEAT: add MessageToolCallScorer for tool calls recorded in stored messages microsoft/PyRIT
MessageToolCallScorer grades the same ToolsCalled condition from the function-call pieces PyRIT already stores on messages, so tool-use scoring no longer requires an OpenTelemetry trace pipeline. Teams running PyRIT without tracing can score tool calls on stored conversations.
fix: reuse the WebSocket event loop across calls NVIDIA/garak
The generator opened and closed a new event loop per prompt while reusing the same socket, so from the second prompt onward sends raised a different-loop RuntimeError that the catch-all returned as an empty message. One loop per generator now persists across calls.
fix(detectors): scope safe-token suppression to its own match NVIDIA/garak
A single detector-wide key_found flag meant a safe placeholder such as mypassword anywhere in the output masked every other credential match. Suppression is now scoped to the match that set it, so AWS sample keys and similar findings surface again.
[FIX]: Bind GUI Compose publication to localhost microsoft/PyRIT
The GUI Compose port is bound to 127.0.0.1:8000:8000 rather than every host interface, matching the Jupyter default. Local GUI access, the container listener and existing authentication behavior are unchanged.
$ ls ai-red-teaming/week/ # the briefings behind this review
Keep up with AI Red Teaming in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.