Promptfoo moves off vulnerable MSAL 7.0.x

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

PyRIT's week was mostly quieter: char_split and context_wrap techniques, three new credential patterns, and a GCG gradient fix.

105 commits 141 PRs merged 7 briefings covered

all ai-red-teaming reviews →

← previous week ai-red-teaming wire →

fix(deps): update direct MSAL dependency to 7.1.0 promptfoo/promptfoo

by renovate

The optional @azure/msal-node dependency moves from 7.0.1 to ^7.1.0, so the published range no longer resolves to the 7.0.x versions covered by the authorization-code origin advisory (GHSA-xcx6-jx8p-x3h5). If you use the Azure checkout path, upgrade rather than pinning an older 7.0.x.

chore(deps): patch body-parser and fast-uri promptfoo/promptfoo

by dependabot

Both Express body parsers move in the lockfile, 2.3.0 to 2.4.0 for the API server and 1.20.8 to 1.20.9 for the docs dev server, because a compressed JSON request with trailing bytes could crash the process. The qs override now starts at 6.16.1 to satisfy body-parser 2.4.0.

fix(deps): update anthropic packages promptfoo/promptfoo

by renovate

Anthropic SDK 0.134+ emits its own tracing spans alongside promptfoo's generation span, which changes stored traces and breaks existing span-count assertions. Instrumentation is now disabled for promptfoo's Anthropic client; promptfoo's own span, usage, error status, and trace linkage are retained, so anything asserting on SDK spans needs its counts adjusted.

FEAT: Detect Azure SAS, SharedAccessKey, and Databricks tokens in CredentialLeakScorer microsoft/PyRIT

by nithin42

CredentialLeakScorer gains Azure SAS tokens, SharedAccessKey, and Databricks token patterns in both its default and GARAK pattern sets. Leaked cloud credentials in model output now get caught without a custom pattern list.

FEAT: Add char_split attack technique in extra.py microsoft/PyRIT

by Absarahmedofficial

The char_split technique registers in extra.py, composing PromptTemplateConverter and SearchReplaceConverter on PromptSendingAttack to append output-format instructions and split the payload per character. It is available to any run that enumerates the extra techniques.

FEAT: Add context_wrap attack technique in extra.py microsoft/PyRIT

by Absarahmedofficial

context_wrap lands in the same module, wrapping the payload in surrounding context restricted to text prompt data types on both the request and response sides. Together with char_split, promptfoo and PyRIT users tuning evasion now have two more named techniques without writing converters.

FIX: Validate presence_penalty and frequency_penalty in OpenAI and LiteLLM prompt targets microsoft/PyRIT

by nithin42

OpenAIChatTarget, OpenAICompletionTarget, and LiteLLMChatTarget documented presence_penalty and frequency_penalty as taking -2.0 to 2.0 but never validated them; out-of-range and non-finite values now fail at construction rather than surfacing later. Configs that quietly passed bad values will start raising.

FIX GCG: only sum gradients of workers that share a vocabulary microsoft/PyRIT

by devangpratap

GCG now sums gradients only across workers that share a vocabulary, which corrects the aggregated gradients multi-worker runs produced. Runs that span heterogeneous models get a different, and correct, update signal.

$ ls ai-red-teaming/week/ # the briefings behind this review

Mon Oct 26 Promptfoo moves off vulnerable MSAL, PyRIT adds a char-split attack and cloud token detection Tue Oct 27 PyRIT validates penalty parameters, corrects GCG gradient aggregation Wed Oct 28 PyRIT adds tool role-play attacks, garak moves probe intents into reusable stubs Thu Oct 29 Anthropic SDK tracing collides with promptfoo spans, and PyRIT adds a new attack technique Fri Oct 30 PyRIT tidies its warning UI and pins down converter state across prompt restores Sat Oct 31 promptfoo enforces body deadlines, PyRIT adds a Cyrillic homoglyph source Sun Nov 1 PyRIT trims duplicate adversarial response format instructions

all ai-red-teaming reviews →

← previous week ai-red-teaming wire →