$ cat ai-red-teaming/week/2026-10-12.log
the week in review · Oct 12 – Oct 18, 2026
PyRIT gates target creation and locks down uploads
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Two breaking changes hit operators running CoPyRIT: only administrators can now create targets that execute model repository code, and API-created HTTP targets no longer pick their own upload folder.
[BREAKING] FIX: Require administrator access to create targets that run model repository code microsoft/PyRIT
HuggingFaceChatTarget begins loading its model on construction, so a caller setting trust_remote_code=True through POST /api/targets could make the server run Python published in a model repo. Administrators are now the only ones who can create those targets, which means any automation or service account that builds them will start getting refused.
[BREAKING] FIX: Keep uploads from API-created HTTP targets in a server-chosen folder microsoft/PyRIT
Operators who relied on specifying allowed_upload_directory per target will find the server choosing the folder instead. If your runbooks or scripts assert on a specific upload path, check them before you upgrade.
[BREAKING] FEAT: Add scenario dataset controls to CLI, REST, and GUI (#3143) microsoft/PyRIT
Scenario dataset controls now exist across CLI, REST, and GUI, and the PR is flagged breaking. Anything driving scenarios programmatically should be re-tested against the new surface rather than assumed compatible.
FIX: record UNDETERMINED when the objective scorer returns no score microsoft/PyRIT
A response with no score from the objective scorer is now recorded as UNDETERMINED with "Objective scorer returned no score" rather than FAILURE, across PromptSendingAttack, MultiPromptSendingAttack, RedTeamingAttack and ChunkedRequestAttack. Prior dashboards and thresholds that treated those rows as failures will read differently.
v0.17.1 NVIDIA/garak
garak 0.17.1 adds hit@k attack success rate as a new evaluator metric, exposed as terminal output and per probe/detector pair in the final digest entry of report.json. If you compare garak runs across versions, the new metric changes the shape of your digests.
fix: remove stale MCP evaluation summary cache promptfoo/promptfoo
MCP list_evaluations now queries evaluation summaries on every request, so a long-lived server sees newly created, updated, and deleted evaluations instead of a stale snapshot. Dataset filters, pagination and error responses are preserved; the cacheStats field remains but reports zeros.
FIX: decode variation selector payloads next to emoji with presentation selectors microsoft/PyRIT
VariationSelectorSmugglerConverter in decode mode returned '\x0f' instead of the hidden text when an ordinary emoji such as ❤️ or ✔️ preceded the payload, because the decoder misread the U+FE0F presentation selector. Hidden prompts behind emoji now come back rather than getting lost.
MAINT: Fail CoPyRIT deployment pipeline when initialization fails microsoft/PyRIT
Alongside: CoPyRIT deployments now expose an uncached /api/ready endpoint returning 200 when PyRIT can accept runs and 503 otherwise, the attack analytics SDK and REST surface landed, and promptfoo dropped its default config and MCP summary caches so declarative edits show up on the next load.
$ ls ai-red-teaming/week/ # the briefings behind this review
Keep up with AI Red Teaming in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.