Release Notes

What’s new across the Dreadnode platform — features, improvements, and fixes, published weekly. Subscribe via RSS.

October 2026

October 22, 2026

New navigation now live for all users

6 new2 improved7 fixed

The new navigation is available to all users in beta for SaaS and Enterprise.

New

• New navigation now live for all users. The redesigned navigation is now the default for all users on SaaS and Enterprise
• White-box attack support in the AI red-teaming capability. White-box attacks (GCG family, embedding, generator, and activation methods) are now available in the ai-red-teaming capability; supply a local open-weight model as the surrogate to run them.
• New structural and long-context jailbreak attacks in the airt SDK. Three new 2026 jailbreak attack algorithms — metabreak (chat-template control-token manipulation), jhaystack (long-context attention dilution), and hauntattack (shadow-reasoning framing) — are now available in the airt SDK.
• Two new classifier-evasion attacks in the airt SDK. Greedy per-coordinate descent (greedypixel) and hard-label boundary search (rayopt) target image classifiers via the evasion harness.
• tool_call_attack_landed scorer for agentic red teaming. The new tool_call_attack_landed scorer measures whether an agent emitted a specific attacker-intended tool call (name and arguments), giving a deterministic, judge-free attack success rate signal.
• Third-party notices file for enterprise installs. Enterprise installs now include a third-party notices file downloadable from Account Settings, or at https://<domain>/third-party-notices; the file always matches the installed version and works air-gapped.

Improvements

• AI red-teaming docs reflect current attack and transform counts. Documentation now lists the full white-box attack family and shows accurate headline figures of 100+ attacks and 600+ transforms.
• Self-hosting docs: CA bundle rebuild guidance. Self-hosting docs now include instructions for rebuilding the CA bundle when a public CA is distrusted, with a command to verify the root is removed from the updated trust store.

Fixes

• Structured findings now appear in Agent Output after network-ops enumeration. The network-ops capability now surfaces hosts, users, credentials, shares, weaknesses, and other structured records in Agent Output after a completed enumeration; previously all structured records showed zero.
• Kerberos relay and coercion listeners no longer time out after 30 seconds. Relay and coercion listener tools in the network-ops capability now run as streaming listeners and stay up long enough to capture relayed authentications.
• certipy tools no longer hang silently on stdin prompts. All certipy_* tools now send a consistent stdin confirmation by default, preventing hangs until timeout when certipy prompts for input.
• AIRT errored studies now raise in all execution paths. StudyError is now surfaced from Assessment.run as well as run_suite, so generated attack scripts and the TUI no longer silently record failed runs as successful. Hosted AIRT runs also now reject white-box attacks with a 400 error upfront.
• /mcp screen renders immediately and auto-follow resumes after scrollback. The /mcp and /workers TUI screens now render immediately on open instead of appearing blank, and the transcript auto-follows new content again after you scroll back to the bottom.
• spawn_agent tool label shows the sub-agent’s task. The spawn_agent tool row in web chat now shows up to 60 characters of the sub-agent’s task so you can tell what the sub-agent is doing while it runs.
• AI red-teaming catalog counts corrected. Catalog counts for goals, transforms, and scorers now reflect accurate totals (279 goals, 429+ transforms, 146 scorers).

October 15, 2026

Agentic attack trace parity

3 new1 improved13 fixed

AIRT findings parquet enriched with reviewed state and project rollups.

New

• AIRT findings parquet enriched with reviewed state and project rollups. The findings parquet export now reflects the latest operator-reviewed severity and status, and includes new columns for audit trail, ASR, compliance tags, adversarial-ML metrics, and project-level rollups.
• Session pinning in Chat and Agents. You can now pin sessions from the ... menu in the Chat sidebar or Agents › Sessions; pinned sessions appear at the top of the list and are visible only to you.
• SLIP jailbreak attack in AI red-teaming. The AI red-teaming capability now includes a SLIP self-jailbreaking attack tool, letting you run tree-search-based prompt jailbreaks against a target model with configurable depth, branching, and judge models.

Improvements

• SDK stream drops are retried automatically. Hosted inference streams that drop mid-connection are now retried up to 3 times with exponential backoff (1s, 2s, 4s), reducing failures on unstable network paths.

Fixes

• Agentic attack authentication restored. Agentic red-teaming attacks now authenticate correctly against provisioned targets; previously all trials failed with empty responses, producing 0% attack success rate.
• ATLAS attacker default model fixed. The ATLAS attacker in AI red-teaming environments now defaults to dn/gpt-5.4-mini, resolving LiteLLM errors and 0% ASR results caused by the previous groq scout default.
• ATLAS topology finding severity now requires tool evidence. ATLAS topology findings no longer record as critical/jailbreak when a verbal-only response fires and campaign ASR is 0 — severity is gated on a privileged tool actually firing.
• Multistep tool attack severity uses replay-verified scores. Severity grading for multistep_tool_attack now uses the replay-verified score instead of the optimizer peak, so non-reproducible hits no longer produce false critical or jailbreak findings.
• Tool-call evidence now populated in agentic findings. Findings from multistep_tool_attack and custom-target agentic attacks now include the actual tool calls that triggered them, so traces show what the agent did rather than a placeholder or empty panel.
• SLIP and multistep attacks now materialize findings correctly. SLIP and multistep tool attacks now correctly compute ASR and appear in reports and parquet exports after completing.
• Multistep tool attack scores clamped to [0, 1]. Findings no longer show scores above 1.0 when a two-step objective returns a combined magnitude greater than 1.
• ATLAS findings now show Judge Reasoning. ATLAS findings scored via tool evidence now show reasoning in the Judge Reasoning panel instead of appearing blank.
• Text-evasion findings labeled with correct modality. Text-evasion attack findings (textfooler, textbugger, bae, pwws, deepwordbug, text) now export with input_modality="text" instead of the incorrect "tabular" default.
• Parquet executive summary trial count matches the platform UI. The parquet export’s executive summary now reports the same total trial count shown in the platform, rather than an under-counted value from per-finding sums.
• Multi-agent red-teaming guides use a working model. Multi-agent guides now reference a working dn/ proxy model for ATLAS runs, removing a decorator that caused errors and adding KeyError-safe tool_calls handling.
• Network-ops capability now provisions its full toolchain. The network-ops capability now installs nmap, smbclient, hashcat, john, impacket, certipy-ad, bloodyAD, and NetExec on local Docker sandboxes and loads correctly when optional assets are unavailable.
• SDK install script constrained to supported Python range. The install.sh script now constrains uv to Python >=3.11,<3.14, preventing install failures on Python 3.14+ where some dependencies lack pre-built wheels.

October 8, 2026

File and folder uploads in Web Chat

7 new6 improved8 fixed

You can now attach local files, folders, and pasted images directly in Web Chat.

New

• File and folder uploads in Web Chat. You can now attach local files, folders, and pasted images to Web Chat messages; uploads land in the runtime workspace so the agent can reference them directly.
• Natural-language severity policy for AI red-teaming. generate_attack now accepts a severity_policy parameter so you can define custom risk taxonomies — thresholds, matrices, and aliases — that the agent applies when classifying findings. Per-assessment overrides and broader agentic attack category coverage are also included.
• Worker sessions on eval sample detail. The eval sample detail page now lists worker sessions the agent started for that attempt, with links to each session in Agent Sessions.
• Jump from session media to its tool call. Artifacts logged by a tool call in the Media tab now have a “View in transcript” button that opens the Transcript tab scrolled and focused to that exact call, and the spot is linkable via ?tool_call=<id>.
• Session Memories tab. Sessions now have a Memories tab showing every memory the session created, updated, closed, or reopened, with links to the full memory detail view.
• Binary-analysis structured output. The binary-analysis capability now emits structured findings and assets — recovered keys, vulnerability root causes, malicious capabilities, extracted payloads, and embedded endpoints — trackable and filterable through the platform’s review-and-submit workflow.
• Share Chat sessions to your workspace. Chat’s session menus now include a Share action so you can make a private session visible to your workspace team without leaving Chat.

Improvements

• Workflow run progress on the graph. Workflow run graphs now show step-level progress at a glance: edges and cards are color-coded by status (running, succeeded, failed, not taken), with motion on active paths.
• Token and cost totals in the eval header. The evaluation detail header now shows total token usage and model cost for the full run, updating live while the evaluation is in progress.
• Capability versions and updates in Web Chat. The Web Chat capabilities picker now shows the installed version of each capability and offers an inline update when a newer version is available.
• Filter project memories by session. You can now filter project memories by session ID via the API, SDK tool, and ApiClient.list_project_memories, letting agents trace which memories a given session created, updated, or closed.
• AI red-teaming severity scoring improvements. Empty model responses are now correctly scored as 0.0, agentic attack categories have broader severity mapping coverage, and per-assessment severity policies with custom thresholds and category-to-severity overrides are supported.
• Optional web-security tools no longer block sandbox provisioning. Optional tools (Caido, Burp, exiftool, and others) no longer cause health errors or block provisioning when absent in sealed or offline deployments.

Fixes

• Hosted Tinker training unblocked. Hosted dn train sft / dn train rl jobs were failing at start with “Your Tinker SDK version is no longer supported”; the training image now uses a supported client version and the model catalog reflects current Tinker offerings (Qwen3-8B, Nemotron 3 Nano/Super/Ultra).
• Worlds agent-mode trajectories and dead-backend errors. Agent-mode trajectories no longer fail immediately with a silent import error, and dead-backend sandboxes now return a clear message to create a new manifest instead of a raw 502. Greedy sampling no longer OOM-kills the backend server, and agent errors now include the full traceback.
• Hosted optimization startup failures reported immediately. Hosted optimization jobs that fail during startup now report the real error within seconds instead of hanging for an hour before timing out.
• Org-qualified task refs resolve correctly. Refs like org/name@version in --task now resolve instead of returning 404.
• E2B sandbox tool PATH. Tools installed by capabilities in E2B sandboxes (such as uv and Go tools) are now found on PATH when an agent tries to use them; a new optional dependencies.path field in capability.yaml lets capabilities declare additional tool directories.
• Agent-mode trajectory jobs fail fast when no model is configured. Jobs now return a clear 400 error at creation time when the selected agent has no model, instead of failing ~12 seconds in with an opaque message.
• Self-hosted first-user setup. On self-hosted installs, the first user to sign up now goes through /setup to set their name, so the home page and default workspace no longer show a randomly generated username.
• Evaluation task ref 404 fixed. Org-qualified --task references now resolve correctly in evaluations.

October 1, 2026

Web Chat Interface Redesign

5 new6 improved14 fixed

Teams can now choose a sandbox’s capabilities, compute, secrets and idle timeout before it starts, then check its status, installed capabilities, health issues and logs in a panel beside their web chat session.

New

• Bulk triage for Agent Output findings. You can now select multiple findings on the Agent Output page and set their triage status in a single action, with per-row results and a confirmation toast.
• SDK Assessment.record_attack_result(). A new method lets custom-target attacks emit traces and materialize findings in the platform, so results from flows like multistep tool attacks and indirect injection are no longer invisible.
• AIRT dataset library documentation. The AI Red Teaming Datasets documentation now covers the full public dataset library: 497 curated, license-cleared datasets across 7 media types with OWASP LLM and Agentic coverage mapping.
• Dataset attribution metadata in SDK push. Datasets pushed via the SDK now carry license, tags, language, task categories, and source provenance, so the license badge, tag filters, and Source section populate correctly in the platform.
• Bulk close and reopen project memories. You can now select multiple memories on the Memories page and close or reopen them in one action via the bulk-action bar.

Improvements

• Web chat session view overhauled. Sandbox configuration, runtime status, and capability inspection are now surfaced directly in the sessions page with dedicated panels for sandbox setup, runtime health, and issues.
• Safe clickable links in agent content. Links in agent messages, tool results, memories, and item notes are now clickable — each opens a confirmation dialog showing the actual destination before navigating.
• Organization owner management from the org page. Organization owners can now be added and removed directly from the org detail page; adding an unrecognized email prompts confirmation before creating an account.
• No-model-deployments notice on self-hosted installs. Self-hosted installs with no model deployments now show an informational notice on the home page and in model-dependent CLI guides, directing platform admins to the deployment page and others to their admin.
• AI red-teaming reference docs reorganized per topic. The AI red-teaming reference docs are reorganized into per-topic pages — transforms, attacks, and multi-agent probing each have dedicated sections with clearer structure.
• Docs site support contact modal. The docs site header now has a help button that opens a support modal with contact addresses for general inquiries and technical issues.

Fixes

• Custom-target attacks now record spans and findings. Custom-target attacks (multistep, AgentVigil, EVA) now record spans and findings against the assessment, so results appear in the UI with the correct OWASP-Agentic category.
• OWASP Agentic categories correctly assigned to agentic findings. Agentic attack findings now map to the correct OWASP Agentic (ASI) categories instead of collapsing to generic LLM jailbreak categories.
• AIRT report generation and trace exports no longer fail. AIRT report generation and trace Parquet exports no longer fail with a “Report build failed” error after the request completes.
• Hosted evaluations with agent-side script verification no longer end as infra_error. Hosted evaluations using agent-side script verification no longer end as infra_error after the agent finishes normally.
• BYOK model evaluations with egress allowlists now provision correctly. Hosted evaluations using BYOK models (e.g. openrouter/…) with egress allowlists now provision correctly and surface configuration errors immediately instead of retrying until the circuit breaker trips.
• Long-running eval generations no longer drop mid-stream. Long-running eval generations no longer fail mid-stream with connection drop errors during extended model outputs.
• Session list sorts by most-recent activity. Session lists and the web-chat sidebar now sort by most-recent activity — messages, edits, and other writes correctly advance the session’s last-updated timestamp.
• MCP servers in E2B sandboxes no longer fail to start. MCP servers in E2B sandboxes no longer fail to start with a permission error when invoking uv run.
• Session transcript preserved through poll failures. The session transcript now stays visible through consecutive poll failures, retrying incrementally with exponential backoff instead of clearing the messages you were reading.
• TUI runtimes screen corrected. The TUI runtimes screen now shows paused runtimes correctly (no longer marked expired), names runtimes by key instead of a raw ID prefix, and lets you search by key or provider sandbox ID.
• Opening an archived session no longer resets the list scope. Opening a session from the Archived list no longer resets the list back to Active, so the session you clicked stays visible in the list beside it.
• Session expired mid-page now opens the sign-in modal. When your session expires mid-page, browser API calls now open the sign-in modal instead of silently showing empty tables or transient error toasts.
• Selected agent shown correctly in Web Chat response headers. Web Chat response headers now correctly identify the selected agent when you switch away from the default, both during a live session and after a page refresh.
• Trace viewer explains unpreviewable media files. The trace viewer now shows an explanatory message and a Download button when a media file can’t be previewed, instead of leaving a silent empty player.

September 2026

September 24, 2026

Approve or reject held tool calls in web chat

10 new14 improved14 fixed

Web chat now lets you approve or reject tool calls that policy has held for review — inline, with full arguments and the policy reason visible before you decide.

New

• Tool call approvals in web chat. Held tool calls now appear inline in the conversation transcript with full arguments, the policy reason, and Approve / Reject buttons — replacing the previous generic input card.
• New workbench at /beta. The new information architecture is live across four sections: the project shell (org · workspace · project breadcrumb, place switcher, per-section tabs), Hub catalogs (Capabilities, Environments, Datasets, Models), Agent Outputs, and Sessions — all replacing their previous placeholders.
• Tool catalog and revision pages. A browsable Tool catalog is now available in Agent Policies, with searchable metadata, copyable IDs, schema fingerprints, and collapsible input schemas for every visible tool and its revision history.
• Runtime logs in the TUI console. Press F5 then Tab in the TUI console to switch from local process logs to the connected runtime’s server logs, with full retained history (up to 2,000 entries), level filtering, copy, and save.
• Package-relative capability imports. Capability tools, hooks, and workers can now import sibling modules using standard package-relative imports instead of relying on flat module names.
• Capability workflow graph. The capability detail page now shows a workflow graph of how the capability’s steps connect.
• Release notes unread badge. An unread badge on the sidebar account button shows how many release notes you haven’t seen yet, clearing automatically when you open Release Notes in Account Settings.
• Agentic probes sandbox target. A new provisionable multiagent sandbox target — ‘agentic-probes-sandbox’ — is available for the 2026 agentic-probe evaluation families, replacing the prior local self-contained setup.
• Agentic-probes 2026 attacks in ai-red-teaming. The ai-red-teaming agent can now generate agentic-probes 2026 attacks via generate_attack, including transforms for argument injection, deserialization payloads, RAG poisoning, covert channels, and more, plus matching evidence-gated scorers.
• Agentic probe suite: evidence-gated tool-misuse, exfil, memory, MCP, and RAG probes. Eight new agentic red-teaming probe families are available in the SDK: evidence-gated scorers and transforms covering tool-misuse RCE, advanced exfiltration, MINJA memory poisoning, MCP line-jumping, RAG optimization attacks, and indirect prompt injection via the new IterInject attack loop.

Improvements

• Agent cold-start is 93% faster. Heavy imports (pandas, numpy, pyarrow, Optuna) are now deferred until actually used, and the SDK tracing path no longer pulls them in on the first chat turn — cutting median agent construction from ~5 s to ~0.3 s and saving 3.5–3.8 s on the first turn.
• E2B sandbox pre-warming. Server, LiteLLM, agent graph, and first-turn imports are now baked into the E2B runtime snapshot, eliminating the largest filesystem-load costs at startup.
• Type your first message while the runtime starts. You can now compose and send your first prompt before the runtime finishes starting — the message queues and dispatches automatically once the session is ready, with a Cancel option.
• Discrete runtime startup progress. Runtime startup and capability reload now stream real-time progress steps instead of showing a fixed time estimate; a timeout during capability install no longer reports a successful install as a failure.
• Trace storage off the critical path. Trace storage uploads now run in a background pool, so the first chat turn no longer waits on storage credential fetching or object uploads before issuing the first model request.
• Policy-blocked tool calls shown as stopped. Tool calls blocked by policy now appear as stopped — not failed — in session transcripts and web chat, with a distinct indicator and expandable decision details.
• Tool policy state in transcript headers. Transcript headers now show the tool policy state (active, disabled, failed, awaiting approval, or not recorded) for both live and past sessions.
• Workflow run page redesign. The workflow run page has a new header, node panel, transcript view, and graph direction controls; definition and execution nodes render with improved layout and status indicators.
• Runs visible on the Workflows page. Associated runs now appear inline on the Workflows page with status, duration, and run ID — no need to navigate away to find them.
• Auto-select loaded capability agent. When a runtime has exactly one capability loaded, the composer now starts on that capability’s agent automatically, with no manual picker switch needed.
• SDK 2.0.47: capability health, terminal errors, runtime model selection. Agents can now inspect runtime capability health; terminal agent errors correctly fail turns instead of reporting success; and model selection is available for local workflow runs.
• Explicit autonomy budgets. Unattended workflows (dn --auto, /auto, /background, --print, guard sessions, and web chat Auto/Background) default to 100 steps, and --print --max-steps N now works as documented.
• Parallel scope validation. SDK scope validation now runs reads concurrently with exponential backoff and an 8-second shared deadline, reducing validation latency and improving recovery from transient failures.
• Self-hosted resource presets updated. The small/medium/large resource presets now have higher CPU limits for the API and PostgreSQL, and the docs show updated user-count guidance and a full preset table including PostgreSQL.

Fixes

• Durable runtimes renew model keys on resume. Runtimes that resume after a long pause no longer fail model requests with an expired API key — the LiteLLM key is renewed automatically before the sandbox resumes.
• Tool-call normalization for non-OpenAI agent shapes. AI red-teaming scorers (any_tool_invoked, tool_selection_safety, dangerous_tool_args) and agentic probe scorers now correctly detect tool calls from agents that use non-OpenAI tool-call shapes or pass arguments as a dict, fixing silent false negatives across all agentic attack categories.
• Valid request bodies for multi-line attack prompts. AI red-teaming attacks using multi-line or backslash-heavy prompts (GOAT, TAP, crescendo) now produce valid JSON request bodies, so trials no longer silently return empty responses against agent targets.
• Gateway model metadata resolved correctly. Gateway models (e.g. dn/deepseek-v4-flash) now resolve context limits, pricing, and prompt-caching support from the gateway’s own metadata, eliminating mispriced turns, wrong context limits, and a redundant capability probe on every chat turn.
• Private-CA trust across SDK transports. Capability bundle downloads, MCP connections, training clients, and artifact downloads on self-hosted installs now verify TLS against the operator CA, fixing silent sync failures and 409 “Unknown capability” errors at session creation.
• Storage URL routing in self-hosted deployments. Storage downloads no longer time out when sandbox traffic was routed through the external load balancer instead of the internal cluster endpoint.
• Training template imports restored. Training templates no longer fail to import dreadnode after installation due to dependency conflicts between the SDK and Tinker.
• Attack loops tolerate non-string target output. GoAT v2, adversarial reasoning, MAPF, and four other attack loops no longer crash with a TypeError when the target agent returns a dict instead of a string.
• AgentVigil and EVA surface metrics in trace analytics. AgentVigil and EVA attacks now correctly emit study and trial spans, so span counts, max scores, and jailbreak metrics appear in trace analytics instead of showing zero.
• Trial spans inherit assessment context automatically. Trial spans now pick up the active Assessment context without explicit wiring, so assessment trace analytics correctly count trial spans.
• ask_user question card placement. In web chat, an agent’s question card now appears directly under the ask_user row that asked it, not below all other tool calls in the message.
• TaskEnvironment accepts Dreadnode or ApiClient. Passing the result of dn.configure() directly to TaskEnvironment no longer raises an AttributeError.
• Model catalog card layout. Model catalog cards with tags no longer produce invalid HTML that breaks card layout when JavaScript is disabled or during server-side rendering.
• best_score scale corrected in analytics-interpretation. The analytics-interpretation skill now correctly documents best_score as a 0.0–1.0 normalized value with a jailbreak threshold of ≥ 0.9, not the internal 1–10 judge rubric.

September 17, 2026

Workflows are now in open beta

6 new5 improved11 fixed

Workflows enter open beta this week, bringing multi-step agent pipelines to the CLI, SDK, and UI — alongside Slack integration, a runtime capability health tool for agents, and a redesigned org navigation shell.

New

• Workflows. Define, run, and inspect multi-step agent pipelines from the CLI, SDK, and a new Workflows section in the UI — now open to all organizations in beta, with project-scoped catalog, stable graphs, inline CLI guide, and model selection at run time.
• Slack integration. Org owners connect a workspace via Settings → Integrations, then @mention the agent to stream a full session in-thread — with stop support and a direct link back to the session in Agents → Sessions.
• Agent runtime capability health tool. Agents can now call a built-in runtime_info tool to inspect which capabilities are loaded, enabled, and healthy in their runtime — including failed loads and component health — without raw config or credentials exposed.
• Memory creation from the UI. You can now create memories directly from the Memories page using a new creation panel and form.
• AI red-teaming targets documentation restructured. Custom HTTP targets, AWS SageMaker, and Azure AI Foundry pages are rewritten with verified examples, and the AWS and Azure multi-agent pages are consolidated into a single cloud-agnostic guide.
• Organization avatars. Organization owners can now set an avatar in Settings — choose one of five color presets, upload a PNG, JPEG, or SVG, or fall back to the org name initial. The avatar appears everywhere the organization is shown.

Improvements

• Chat runtime health inspector. Chat now shows a dedicated runtime health panel with grouped failures, per-component recovery actions, and copyable diagnostics — separate from the capability picker — with stable status updates that no longer flicker or lose expanded state.
• Agent Output empty and error states. Agent Output now shows clear empty and error states for new projects, empty types, empty sessions, and load failures — each with a concrete next action instead of a dead end.
• Platform version in account settings. The platform version is now visible in your account settings.
• Workflows catalog empty state and onboarding. The Workflows catalog page has a consistent empty state, loading and error handling, an inline CLI guide, and a copyable run command on the definition page that includes the required project ID.
• Hub browse order stabilized. Hub browse pages (Capabilities, Models, Datasets, Environments) now sort by creation date consistently, and pagination no longer skips or duplicates items when multiple artifacts share a sort value.

Fixes

• Runtime resolved by owner, not list position. Runtimes are now resolved by owner across all project surfaces, so you always connect to your own runtime rather than a teammate’s.
• Agent terminal errors now reported as failures. Agent turns that end with an error — including finish_task(success=False) and give_up_on_task — are now correctly reported as failures instead of successful completions in chat, workflows, and evaluations.
• AIRT tools correctly registered. The provision_environment and generate_agentic_suite_attack tools are now correctly registered in the ai-red-teaming capability, resolving hard blocks on hosted-target runs like model-extraction and mesh playbooks.
• AIRT agent guardrail for CLI provisioning. The ai-red-teaming capability now enforces a guardrail that prevents the agent from falling back to CLI environment provisioning, ensuring it always routes through the provision_environment tool.
• Dev runtime sandboxes no longer fail after Workflows launch. The missing workflow module is now correctly bundled into E2B SDK templates, fixing sandbox start failures introduced by the Workflows feature.
• Workflows catalog scoped to selected project. The Workflows catalog now filters by the selected project, and workflow graphs stay stable through polling, tab switches, and zoom changes without blinking or resetting.
• SDK websockets floor raised. The SDK now requires websockets 15.0.1 or later, preventing runtime failures when fastmcp initializes in environments with websockets 14.x installed.
• Org member suspension status accurate. Platform-suspended users now appear as “suspended” (not “active”) in org member tables, giving admins an accurate view of who can log in.
• Org owner and member removal now requires confirmation. Removing an org owner or member in the admin panel now shows a confirmation dialog explaining what will happen before making any irreversible changes.
• Form validation errors shown inline. Form validation errors now appear next to the relevant field instead of as generic toasts with no context.
• Data grids show load failures with a Retry option. Data grids now show an error panel with a Retry option when a fetch fails, instead of displaying stale rows or a false empty state.

September 10, 2026

Traditional ML attack targets now available across all organizations

6 new10 improved10 fixed

Three traditional ML attack targets ship this week alongside a full set of capability and TUI fixes that bring extraction, membership inference, and model inversion attacks to parity across the SDK and TUI.

New

• Traditional ML attack targets. Three public targets — fraud tabular, MNIST image, and IMDB text — are now available across all organizations covering extraction, membership inference, evasion, and inversion attack types, provisionable by name via the SDK or TUI.
• In-app Release Notes. A Release Notes section in Account Settings lists the ten most recent changelog entries with links to the full docs, on both SaaS and self-hosted installs.
• Capability credential requirements shown before install. The capability detail view and install picker now display which credentials a capability requires before you commit to installing it.
• TUI light theme. Set DREADNODE_TUI_THEME=light to switch the TUI from its default dark palette to a light theme.
• /reload slash command in chat. A /reload command is now available in chat sessions to reload the current agent without leaving the session.
• Status page link in account settings. The Support tab in Account Settings now includes a direct link to the system status page on SaaS deployments.

Improvements

• Runtime cold start cut by more than 60%. A combination of lock scope reduction, litellm pre-warming, and template bytecode precompilation drops runtime time-to-ready from 18.8 s to 6.6 s and eliminates the serialization bottleneck that affected concurrent cold starts.
• AIRT assessments and findings show who ran them. AI red-teaming assessments and findings now display the workspace member who ran each assessment, matching the attribution already visible on evaluations.
• /transcript command in the TUI. A new /transcript command lets you toggle between compact and full agent transcript views, matching what the web UI shows.
• Bulk workspace member addition. You can now select and add multiple members to a workspace at once from the workspace settings page.
• AI red-teaming agent resolves bare task names. The agent now resolves bare task names (e.g. ml-extraction-fraud-tabular) across all orgs you have access to, eliminating 404s when provisioning environments from the public catalog.
• Session sharing attribution. Session responses now include who shared a session with the workspace and when, covering all share paths including bulk promotion and creation-time visibility.
• AI red-teaming docs refreshed. The getting-started guide and reference docs have been updated with corrected model strings, an expanded attack reference, and a rewritten first-campaign walkthrough.
• Invite member dialog improved. The invite member flow has been updated with a cleaner, more reliable UI for adding members to your organization.
• Message count labels in chat session list. Each session in the chat session list now displays a message count.
• workspace_mount runtime option deprecated. The workspace_mount option is now a no-op; /home/user/workspace is ordinary sandbox-local storage, and object-storage access continues through the SDK as before.

Fixes

• TUI transcript scrolling is smooth. Trackpad flicks on Ghostty, Kitty, and WezTerm no longer produce multi-viewport jumps or stalls — worst-frame jump drops 20x and is bounded to under one viewport.
• Transcript copying works in the TUI. Selecting and dragging over assistant messages and tool output now copies the visible text correctly, with command output rejoining wrapped lines and preserving indentation.
• Traditional ML attack dashboards show correct metrics. Evasion, extraction, membership inference, and inversion attack runs now report accurate trial counts and per-target goal totals instead of zero trials and collapsed goal counts.
• Sandbox WebSocket disconnection fixed. Chat turns no longer fail with “Runtime websocket closed (1006)” after a pause longer than ~60 seconds between messages.
• dn --resume no longer crashes for out-of-scope sessions. Resuming a session that belongs to a project outside the active scope now works correctly instead of raising a traceback.
• Extraction, membership inference, and model inversion attacks work in the TUI. These attack types now behave consistently between the TUI agent and the SDK, including a new model inversion tool and correct handling of empty data pools.
• Sandbox environments torn down on assessment completion. Provisioned sandbox environments are now stopped automatically when an AI red-teaming assessment finishes, preventing billable sandbox time from running until the platform TTL.
• dreadnode env provision alias and bare task name resolution. provision is now accepted as an alias for create, and bare public task names resolve without requiring an org prefix.
• TUI paste placeholder identity preserved across undo and edits. Undoing a deleted paste placeholder restores the correct pasted content, and selection-deleting one of two identical placeholders no longer corrupts the surviving one.
• Organization member count no longer shows zero. Organization pages now display the correct active member count.

September 3, 2026

Offline SDK and CLI install for air-gapped deployments

16 new11 improved17 fixed

Self-hosted and air-gapped deployments get a major quality-of-life upgrade this week: the SDK and CLI are now available as offline bundles, docs ship inside every deployment, and a round of egress, startup, and TLS fixes make disconnected installs substantially more reliable.

New

• Offline SDK and CLI install for air-gapped deployments. Self-hosted deployments now serve the SDK and CLI as self-contained offline bundles, so machines inside a network enclave can install the client without reaching PyPI or any external host.
• Documentation bundled in every deployment. Docs are served at /docs inside every deployment, giving air-gapped and on-prem operators full documentation access without an internet connection.
• Global Tool Registry. Published capability Python tools and declared command wrappers now have stable, organization-scoped identities with immutable revision history, queryable via GET /api/v1/tools and GET /api/v1/tools/{tool_id}.
• Organization member credit cap. Organization owners can set a lifetime credit cap per non-owner member; capped members see their own remaining allowance on Settings → Billing rather than the shared org balance.
• Bulk share-with-workspace for agent sessions. You can now select multiple agent sessions and share them all with your workspace in a single action from the floating action bar.
• Wrangler (Cloudflare Workers) in web-security. The web-security capability now includes Cloudflare Workers via wrangler, letting agents deploy programmable OAST endpoints for blind XSS payload hosting, callback logging, and SSRF chain redirection.
• Signup IP allow-list mode. Admins can now configure signup IP policy in allow-list mode, restricting new account creation to explicitly approved IPv4/IPv6 CIDR ranges with deny rules taking precedence.
• Multi-agent red-teaming mesh tasks. 12 multi-agent AI red-teaming tasks — covering access-control bypass, indirect injection, memory poisoning, MCP poisoning, reasoning hijack, supply-chain, data exfiltration, DevOps RCE, and sector-specific meshes — are now publicly available in the task catalog under the airt-generative-ai set.
• Indirect prompt injection web task. A new indirect prompt injection task environment is available, where agents fetch a public web page hiding instructions via five concealment techniques (HTML comments, hidden CSS, off-screen ARIA, white-on-white text, Unicode tags) and any triggered collection request proves the injection succeeded.
• Agentic CI/CD secret-exfil task. A new multiagent task simulates a CI/CD secret-exfiltration scenario where an agent must detect or exploit hidden instructions in untrusted repo content that cause a CI assistant to leak its deploy secret.
• Multi-step tool attack sandbox task. A new multi-step tool attack task environment is available: an over-permissioned tool-using agent with file, database, email, and HTTP tools where success requires chaining a sensitive data source to an external exfiltration sink.
• Honeytoken tools for ai-red-teaming. The ai-red-teaming capability gains two honeytoken tools: mint canary tokens (exfil or RCE variants) and check whether a target agent leaked them across an output boundary.
• Multi-step tool-attack search for AI red teaming. The AI red-teaming agent can now run algorithmic multi-step tool-attack searches against HTTP agents, finding replay-stable read-then-exfiltrate causal paths across tool call chains.
• Agentic red-teaming suite: OWASP-ASI runner + honeytoken harness. The SDK now includes a turnkey OWASP-ASI agentic attack suite runner, argument-aware tool-evidence scoring, and a honeytoken harness for black-box exfil and RCE detection against any HTTP agent.
• Environment-agnostic agent attack-success detection. The airt SDK now includes environment-agnostic attack-success detection across any agent, using canary exfiltration, OAST beacons, dataflow taint, LLM judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.
• Agentic exfil transforms and browser-attack scorers. New SDK transforms and scorers cover two agentic exfiltration channels (search-query and trusted-domain image exfil) plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.

Improvements

• Runtime cold-start timing breakdown. dn runtime start and GET /runtimes/{id} now report a full timing breakdown — total, platform overhead, provider provisioning, boot, installs, and the slowest step — so slow starts can be attributed rather than guessed at.
• Richer support bundle diagnostics for on-prem installs. Support bundles now collect product-level diagnostics — pod scheduling, proxy auth, TLS, and runtime connectivity — so failures surface with actionable detail instead of generic timeouts.
• Redesigned chat session transcript. The session transcript view has been rebuilt with improved message grouping, tool event display, and reasoning row rendering.
• Chat project picker and session search. The chat interface gains a project picker, a session search dialog, and an improved session list panel with better layout and navigation.
• Custom CA trust for the Node frontend on self-hosted installs. Self-hosted deployments can now inject a custom CA bundle into the Node frontend via caBundle, completing CA trust support across all workloads (API, LiteLLM, and frontend).
• East-west network trust boundary documentation. Self-hosting docs now describe the platform’s two security zones — platform services and sandbox pods — and the cluster-level segmentation that operators are responsible for providing.
• Air-gap upgrade docs cover registry drift. Air-gap upgrade docs now explain what happens when a release adds new images, the CLI upgrade path, post-upgrade version checks, and how to recover a missing ECR repository inside a sealed enclave.
• Air-gap install prerequisite docs. Air-gap and Helm install docs now cover ECR repository pre-creation, StorageClass default requirements, and the platform readiness endpoint.
• Support-bundle binary staging for offline use. Air-gap installation docs explain how to stage the support-bundle binary before going offline, covering both KOTS existing-cluster and Helm CLI paths.
• TUI guard policy documentation. A new docs page covers the TUI guard policy in full: rubric configuration, transcript strategies, scope editor, deny behavior, judge model selection, and prompt caching.
• AI red-teaming getting-started docs refresh. The TUI and SDK getting-started pages are rewritten to use hosted dn/ models (no API keys required), with corrected commands, accurate UI labels, and runnable examples.

Fixes

• Evaluation claim deadlocks eliminated. Concurrent evaluation workers no longer deadlock when claiming items, preventing stalled evaluation runs under load.
• Self-hosted sandbox runtimes now start reliably under cluster-assigned UIDs. Sandbox runtimes start correctly when a cluster assigns an arbitrary UID, include CA trust for on-prem model proxy calls, and bind before accepting connections to avoid false-ready signals.
• Sandbox egress scope now takes effect on real deployments. Three blocking defects are resolved: air-gapped installs now carry correct allow-list entries for the model gateway and object store; the global.sandbox.egressExtraAllow chart value now takes effect; and dn evaluation create --egress targets are no longer silently dropped.
• Air-gapped deployments stop making outbound connections. Platform services no longer attempt connections to MinIO SUBNET, MinIO release checks, Prisma checkpoint, or GitHub on sandbox runtime start; Traefik version-check and usage-statistics callhome requests are also disabled and the chart version is pinned.
• Sandbox pause now refused on unsupported providers. Pausing a sandbox on a provider that doesn’t support pause returns an error immediately instead of silently recording the sandbox as paused while it continued running and accruing compute charges.
• On-prem agent generation via OpenSandbox now works. Model calls from OpenSandbox runtimes on Embedded Cluster deployments are routed through the in-cluster model proxy instead of an unreachable public endpoint.
• Self-hosted installs no longer show SaaS consent surfaces. Registration and account settings on self-hosted installs no longer display the marketing email opt-in, Dreadnode Terms of Service, or Privacy Policy.
• Web search no longer falls through to a public backend on air-gapped installs. When the hosted search backend is unavailable, the cascade stops cleanly and reports a clear error instead of falling back to DuckDuckGo.
• Outbound CA Secret setup guide fixed. The outbound TLS trust setup guide now uses server-side apply for the CA Secret, fixing a Kubernetes annotation size limit that caused the documented commands to fail on any standard distribution.
• Multiagent mesh tasks route model calls through the platform LiteLLM proxy. Five multiagent mesh tasks now correctly route model overrides through the platform proxy when no Groq API key is present, so model_overrides with platform models work as expected.
• Inference-key provisioning timeout extended. dn/ model resolution in notebooks and scripts no longer fails with a misleading proxy configuration error when inference-key provisioning takes longer than 30 seconds.
• dn --resume now finds sessions across workspaces. dn --resume <session> searches all workspaces in your org rather than only the current workspace.
• dn --resume fails safely on missing or ambiguous sessions. Running dn --resume with a missing or ambiguous session now shows a connection-failed state instead of silently starting a new session.
• TUI composer preserves unsent drafts during arrow-key navigation. Pressing Up/Down no longer clears an unsent draft — cursor navigation stays within the text area until the draft is empty.
• Pasted content in the TUI composer deletes in one keypress. Pressing Backspace or Delete now removes an entire pasted-content placeholder in a single keypress instead of deleting it character by character.
• Typing ‘r’ in TUI workspace search now appends to the query. Previously, pressing ‘r’ triggered a refresh instead of adding the character to the search input.
• Selecting the active project in the workspace browser now dismisses the panel. Previously, picking the already-active project showed an ‘Already active’ notice instead of closing the browser.

August 2026

August 27, 2026

Web Chat open to all users

12 new9 improved16 fixed

Web Chat is now open to all users this week, alongside a full air-gap deployment story for self-hosted installs and a wave of runtime, session, and capability fixes.

New

• Web Chat open to all users. Web Chat is now available to all users (marked beta), with session search, correct session scoping, mismatched project URL correction, and recoverable transcript and runtime errors all landing together.
• Web Chat documentation. Six new documentation pages cover the web Chat UI: overview, quickstart, sessions, runtimes, agents and models, and slash commands.
• Air-gap mode for disconnected installs. A new airgapped configuration brings all front end resources local and API from making outbound requests to public hosts — fonts are vendored locally, the analytics notebook is hidden, model pricing is served from a bundled catalog, and capability dependencies are pre-baked into the runtime image so sandbox boot requires no network access.
• Helm chart hardening for private-CA clusters. Self-hosted Helm charts now support non-root container execution and custom CA bundle mounts for outbound TLS trust, enabling deployment in hardened enterprise environments with private certificate authorities.
• Bulk archive and unarchive for agent sessions. You can now select multiple agent sessions and bulk archive or unarchive them from the Sessions tab, with context-aware actions depending on whether the selection is active, archived, or mixed.
• TUI /status command. The TUI now has a /status command that displays your current session, model, user, org, workspace, and project at a glance.
• Offline-clean capability installs in air-gapped deployments. Air-gapped and offline deployments are pre-baked into the runtime image and install steps are skipped or run offline-only when egress is unavailable.
• Guard invocations highlighted in session transcripts. The session view now highlights guard invocations and their policy decisions inline within the conversation transcript.
• IP rotation via Cloudflare Workers in web-security. A new IP rotation tool in the web-security capability deploys Cloudflare Worker proxies on demand, enabling round-robin request routing through rotating egress IPs during engagements.
• HTTP desync and request-smuggling tooling. HTTP desync and request-smuggling detection is now available in the web-security capability, covering 11 smuggling families with fingerprinting, payload construction, cache-poisoning detection, and victim-response classification.
• Geo-distributed DNS resolution in web-security. The web-security capability can now resolve target hostnames through open DNS resolvers in multiple countries (via Shodan or Censys) to detect geo-fenced infrastructure, GSLB routing, and region-locked DNS responses.
• LSB steganography in web-security capability. The web-security capability can now perform LSB steganography on PNG images, enabling payload smuggling tests and upload pipeline inspection via the built-in Python tool.

Improvements

• Chat session list pagination and search. The chat session list now supports pagination and full-text search by title, model, agent, and label — no more 100-session cap cutting off older history.
• Sandbox detail page redesign. The sandbox detail page now shows resolved workload context, and the sandbox list and detail views have been substantially redesigned with search, navigation, and richer runtime information.
• dn runtime ls ownership awareness. dn runtime ls now marks runtimes you don’t own and accepts --mine to filter to only your runtimes.
• Air-gap install documentation. Air-gap installation now has a complete procedure covering all three install paths, with corrected claims about outbound endpoints and bundle availability.
• Vendored model catalog for air-gapped deployments. Air-gapped deployments no longer silently lose model pricing: the model catalog is now vendored locally and outbound connections are enforced by server-side policy.
• On-prem runtime image pinning. On-prem deployments now pin the sandbox runtime to the exact release version, ensuring Helm charts, Replicated manifests, and air-gap bundles all resolve the same immutable image.
• Helm CLI air-gap egress switch. Helm CLI air-gap installs can now set replicated.isAirgap=true to prevent the Replicated SDK pod from attempting outbound connections to replicated.app.
• postMessage handler detection expanded. The web-security capability’s DOM analysis skills now detect postMessage handlers registered via window.onmessage, MessagePort/MessageChannel, and monitoring-shim wrappers, and flag additional origin-validation bypasses including unescaped-dot and missing-anchor regex bugs.
• Failed capability preflight checks surfaced to agents and operators. When required tools (e.g. dnsx, katana) fail preflight checks, the agent now receives an explicit warning in its system prompt and operators see a log warning — instead of silently proceeding and burning tokens on a broken run.

Fixes

• Long LLM generations will not time out on SaaS. The SDK now streams and reassembles responses internally to stay within gateway limits.
• Admin-provisioned owner account setup. Admin-provisioned organization owners now receive the correct setup email and see an actionable account-setup form instead of a blank screen.
• Runtime private-CA TLS on self-hosted installs. Remote runtimes on self-hosted installs with a private CA now connect successfully; connection failures report the actual cause instead of a generic message.
• Self-hosted sandbox reconciliation. Self-hosted sandboxes (Docker and OpenSandbox) now reconcile correctly — stuck “running” rows are cleaned up and runtime credentials are cleared when a sandbox is confirmed dead.
• Chat session URL project mismatch corrected. Opening a chat session URL with the wrong project key now redirects to the correct project instead of rendering the session under the wrong project’s header, capability count, and runtime — preventing compute from being billed to the wrong project.
• Chat session list scoped to your own sessions. The chat session list now shows only your own sessions — foreign sessions from workspace colleagues no longer appear as dead-end “Untitled session” entries in the sidebar.
• Session list search matches displayed text. Session list search now matches the text each row actually displays, including preview text for untitled sessions.
• Returning users land in their last-used project. Returning to the app now lands you in the project you last used, instead of an empty default project or a 404.
• Capability picker shows full installed list. The capability picker no longer hides already-installed capabilities, so you can see and select the full list.
• Capability installer no longer hangs in Web Chat. The capability installer in Web Chat no longer hangs indefinitely — installs that succeed but time out on confirmation now resolve correctly, and the picker shows capability descriptions instead of bare slugs.
• Transcript load failures show a readable error. Transcript load failures now show the HTTP status and a readable reason in the error panel, instead of a generic message with no detail.
• Agent session confirmation dialogs accept paste. You can now paste the challenge string (e.g. DELETE-1, FREEZE-3) into agent session confirmation dialogs instead of typing it by hand.
• Web chat message ordering fixed. Messages in the web chat session now appear in the correct order.
• Agent selection in web chat no longer behaves confusingly. Agent selection in the web chat session view no longer behaves confusingly when switching between agents.
• Caido web-security capability aligned to 0.57. The Caido web-security capability now works correctly with Caido 0.57+: the replay API, SDK version pins, and MCP server are all aligned to the 0.57 schema.
• Web-security capability installs in air-gapped environments. The web-security capability now installs successfully in air-gapped and disconnected environments, skipping downloads for tools already present.

August 20, 2026

Kubernetes Gateway API support for on-prem installs

5 new3 improved8 fixed

On-prem deployments gain Kubernetes Gateway API routing this week, alongside a new Caido TypeScript SDK skill, expanded web-security attack skills, bulk session freeze, and media previews in the output panel, with a cluster of reliability fixes across the TUI, sandbox provisioning, and AIRT findings.

New

• Caido TypeScript SDK skill. A new caido-mode skill in the web-security capability exposes the full Caido TypeScript SDK, enabling Match & Replace rules, replay sessions, HTTPQL history search, findings management, and curl-through-Caido testing from within an agent.
• Media previews in the output panel. The output panel now embeds image, audio, and video previews directly in agent outputs alongside existing field data.
• Kubernetes Gateway API support for on-prem installs. On-prem deployments can now route traffic through Kubernetes Gateway API (HTTPRoute) instead of Ingress, enabling installations on Istio, Envoy Gateway, and Cilium stacks.
• New web-security skills: SQLi-to-RCE, math-rendering injection, XS-Leak. SQL-injection-to-RCE escalation, MathJax/KaTeX macro injection, and an updated browser side-channel (ORB/XS-Leak via service-worker fetch proxy) are now available as web-security skills.
• Bulk freeze for agent sessions. You can now select multiple agent sessions and freeze them in bulk from the Agent Sessions tab, with a confirmation dialog before any sessions are affected.

Improvements

• Typed confirmation for session deletes. Bulk and single-row session deletes now require typing a DELETE-{count} challenge before the action is confirmed, guarding against accidental permanent deletion.
• ATIF dataset and replay downloads in the Worlds UI. Download the complete ATIF dataset for a trajectory-generation job from Worlds → Jobs, or export the normalized replay payload as JSON from the Trajectories page.
• Webhook.site API key support in the callback tool. The web-security callback tool now accepts a WEBHOOK_SITE_API_KEY environment variable so you can use a paid webhook.site account to avoid rate limits; anonymous and interactsh fallback behavior is unchanged.

Fixes

• AIRT findings table on large projects. The findings table now loads correctly on projects with many assessments instead of showing “No findings match the current filters” due to a request timeout.
• OpenSandbox provisioning errors. On-prem OpenSandbox provisioning now surfaces actionable errors for scheduling failures, image-pull authentication issues, and capacity constraints instead of timing out silently.
• Sandbox command arguments preserved. Command arguments passed as a list are no longer flattened into a single string, fixing runtime token rotation in hosted and on-prem sandbox environments.
• TUI no longer crashes on Rich markup in reasoning. The TUI handles bracketed text and Rich markup sequences in model reasoning output without crashing, including on dn --resume.
• TUI console shortcut no longer crashes on Runtimes screen. Pressing F5 to open the console while on the Runtimes screen (or 9 other TUI screens) no longer terminates the app.
• Multiple active runtimes per project. Starting more than one runtime in the same project no longer returns a 500 database error.
• ScopeGuard sessions continue after denied tool calls. ScopeGuard sessions in local mode no longer terminate when a tool call is denied — denied calls are recorded with the judge’s reason and the agent continues running.
• Orphaned users see a clear state instead of an error. Users with no active organization memberships now see a dedicated screen rather than hitting an error or blank page.

August 13, 2026

Versioned item type registry for structured agent output

5 new10 improved6 fixed

A new versioned item type registry backs structured agent output this week, giving platform admins explicit control over the schemas that capabilities write against.

New

• Structured agent output registry. A versioned item type registry now backs Agent Output — platform admins can define, publish, and manage structured output contracts (findings, assets, and custom types) via Operations → Objects, while capabilities bind to approved registry versions and all item writes are validated against the canonical schema.
• ScopeGuard in remote and headless sessions (experimental). ScopeGuard policy is now usable in remote and headless sessions via the SDK, and the session UI renders tool-call policy decisions when ScopeGuard metadata is present — the policy stays opt-in, with no workspace setting or picker entry yet.
• Caido MCP server in web-security. The web-security capability now includes the full Caido MCP server (66 tools, 6 resources) as a second MCP server alongside the existing Python wrapper, both targeting the same Caido instance.
• Bulk session delete. You can now select multiple agent sessions and delete them in bulk; deleted sessions also disappear from the list immediately without requiring a page refresh.
• Response queue poisoning skill. A new response-queue-poisoning skill is available in the web-security capability, covering CRLF-powered desync attacks including response queue poisoning and request tunnelling via HTTP header injection.

Improvements

• Capabilities UI redesign. The capabilities UI has been significantly redesigned with improved navigation, richer detail views for agents, skills, and MCP servers, and a new file browser for capability contents.
• Model slug visible by default. The model slug is now visible by default in session metadata, so you can identify the exact model used without extra clicks.
• Reader-only orgs disabled in workspace picker. Reader-role orgs are now visibly marked and disabled in the New Workspace dialog, preventing the 403 error that occurred when a reader submitted the form.
• Evaluation creation progress in the CLI. Running dn evaluation create now shows a spinner (or plain status line in non-interactive output) while the evaluation is being submitted, so you can tell it’s working.
• Output details panel clarity. The output details panel now labels provenance as “Recorded by,” renames “Origin” to “Session,” restores the session link’s brand color, and aligns severity badge colors with the main outputs page.
• Agent outputs project fallback. The agent outputs page now falls back to a sensible default project when no project is explicitly selected, reducing dead-end states.
• Sandbox isolation reference. A new sandbox isolation reference page covers Firecracker compute isolation, application authentication, public sandbox routing, outbound internet access, credential scope, and shared responsibility.
• TLS troubleshooting runbook. The self-hosted TLS troubleshooting guide is now a step-by-step runbook covering endpoint selection, certificate chain validation, hostname mismatches, and certificate/key pairing.
• Hub scope tabs documented. Hub browse pages (Datasets, Models, Capabilities, Environments) now document the Mine / org / Public scope tabs and clarify how the CLI’s --include-public flag differs from the Public tab.
• Secret naming conventions explained. Secrets docs now explain how secret names map to sandbox environment variables, with concrete examples for LiteLLM providers like OpenRouter.

Fixes

• E2B runtime stability on long generations. E2B-backed runtimes no longer stop responding partway through a long generation turn, so long-running evaluations no longer fail with an infrastructure error.
• Large capability sets on OpenAI models. Agents whose capabilities exceed OpenAI’s 128-tool limit no longer fail with a 400 error on every turn; capability sync now preserves executable bits on scripts.
• False dn judge failure on large tool output. dn judge outcome no longer falsely fails a successful flag_and_judge evaluation when the judge emits a tool result larger than the offload threshold.
• Screenshots in trace transcripts. Trace transcripts now display screenshots returned as bare remote URLs, rather than showing nothing.
• Web-security preflight tool guard. The web-security agent now checks for required tools at startup and prompts you to confirm scope or wait before running, rather than silently proceeding with a partial scan when tools like dnsx or katana are unavailable.
• Project filter alphabetized on Agent Sessions. The Project filter list on the Agent Sessions page is now sorted alphabetically by display name.

August 6, 2026

Model deployment visibility control

5 improved6 fixed

Model visibility is now an explicit hidden attribute set by operators

Improvements

• Model deployment visibility control. Model visibility is now an explicit hidden attribute set by operators, replacing the previous name-prefix convention — hidden models are excluded from pickers, member grants, and SDK keys.
• Agent output stat cards as filter toggles. The “Needs review” and “Critical + High” stat cards on the Agent Outputs page are now clickable filter toggles, and the items grid has a new sortable “Updated” column.
• Self-hosting configuration docs overhauled. Self-hosting docs now provide consistent, copyable configuration guidance across the Helm, Admin Console, and KOTS ConfigValues install paths.
• Media gallery color coding. Media preview and the session media gallery now use color coding by media kind and an improved layout.
• Agents Charts subtab removed. The Agents Charts subtab has been retired; existing links redirect to the Sessions list, which already surfaces the same information accurately.

Fixes

• E2B detached commands now run to completion. E2B sandboxed runtimes no longer terminate mid-generation after ~40–45 seconds; detached commands run to completion.
• DataGrid no longer overwrites results with stale responses. Rapid filter, sort, or pagination changes no longer cause the table to flash back to outdated data — only the latest server response is applied.
• Session Media tab no longer shows “No media” when media exists. A bad ClickHouse filter on an always-empty column was silently dropping all media results; the Media tab now returns correct results.
• ”+ New Workspace” stays pinned at the bottom of the workspace switcher. The entry no longer floats upward regardless of how many orgs or workspaces you belong to.
• Webhook connection creation no longer returns a 422 error. Creating a webhook connection in Org Settings → Integrations now completes successfully.
• Actionable hashcat error on GPU-less environments. The hashcat tool now returns a clear error directing agents to use john_the_ripper with the correct hash format instead of an opaque failure.

July 2026

July 30, 2026

Agent memory, triage, and session monitoring overhaul

9 new14 improved15 fixed

A new Memories UI, five data-integration connectors, session monitoring improvements, and a wave of Agent Output quality fixes make this a wide-ranging release.

New

• Agent memory viewer. A new Memories page under Agents lets operators view, inspect, and manage project memory entries — including version history and diffs — directly in the UI.
• Data-integration connectors. Five connectors — Atlassian, Azure DevOps, GitHub, GitLab, and Linear — are now available as capabilities on the platform.
• Inactive session filter. Agent Sessions now has an ‘Inactive’ filter to isolate sessions that are idle (past 15 min) but not archived — previously these couldn’t be separated from active sessions.
• TUI built-in bug reporter. The TUI now has a built-in bug reporter (/report-bug or r in console) that assembles a privacy-reviewed diagnostic bundle and submits it without losing logs after a crash.
• Hub sync for air-gapped on-prem. New dn capability sync and dn task sync commands support pulling hub content from SaaS (or another on-prem) into a local directory and pushing it to a self-hosted instance, enabling air-gapped on-prem loading.
• llm-wiki and analysis-ledger capabilities. Two new capabilities are now available: llm-wiki (compiles source material into linked wiki pages) and analysis-ledger (maintains a resumable code-analysis frontier with evidence-bearing claims).
• AST-based JS/TS static analysis in web-security. The web-security runtime now includes ast-grep, enabling AST-based JS/TS static analysis without requiring semgrep, CodeQL, or a jxscout license.
• Models and Datasets table view in Hub. Models and Datasets browse pages now support a table view alongside cards, and all four Hub browse pages share a unified toolbar with separate sort and filter controls.
• Findings Can Now Be Triaged Directly in Agent Output. Reviewers can now set a finding’s status and add notes directly from its detail panel in Agent Output, so findings can be triaged in the same place they’re reviewed.

Improvements

• Session monitoring redesigned. Session monitoring now shows a Last Msg column with relative activity time, highlights sessions active in the last 15 minutes, and adds forward/backward transcript pagination with tailing mode.
• Unified tooltip system. Hover tooltips across the app are now faster, consistent, and keyboard-accessible — replacing unreliable native browser tooltips with a unified tooltip system.
• Agent Output triage UX improvements. Stat cards for ‘Needs review’ and ‘Critical + High’ on the agent outputs page are now clickable filter toggles, and the items grid has a new sortable ‘Updated’ column.
• Transcript message body legibility. Transcript message bodies in session views are easier to read, with improved layout and rendering for tool events and message content.
• Sessions group-by available to all orgs. Sessions group-by control is now available to all orgs, with simplified options (None / Workflow / Capability / Agent / Source) and workflow runs collapsed by default.
• New workspace dialog org picker. The ‘New Workspace’ dialog now includes an organization picker, so you can create a workspace in any org without switching context first.
• Automatic Agent Output recovery at session freeze. Agent Output items from failed report_item POSTs are now automatically recovered from span backups when a session is frozen, without requiring manual operator intervention.
• CLI skill task discovery and BYOK model resolution. The CLI skill agent can now discover tasks by name and resolve BYOK models by looking up stored API keys via dn secret list.
• Hub filter and sort label consistency. Hub filter and sort labels are now consistent across Models, Datasets, Capabilities, and Tasks/Environments — e.g. ‘Keywords’ renamed to ‘Tags’, sort options formatted as ‘Name: A-Z’.
• Agent Output documentation. Agent Output docs now cover CSV export (including the 10,000-row limit), the type selector UI, correct report_item call signatures, and the ref uniqueness constraint with a namespacing workaround.
• Credit pricing documentation. The Credits documentation has been rewritten to clearly explain how hosted inference consumes credits, with a worked example and BYOK billing distinctions.
• Self-hosting docs restructured with TLS guide. Self-hosting docs now include a dedicated TLS guide, focused configuration pages for external data stores, sandbox runtime, and auth/email, plus fixes for 15 verified inaccuracies; markdown tables now render correctly sitewide (previously broken on 109 pages).
• Private-CA client trust documentation. Self-hosting docs now include copy-pasteable instructions for connecting the CLI, TUI, and SDK to private-CA or self-signed HTTPS deployments without disabling certificate verification.
• Mermaid diagram rendering restored in docs. Mermaid diagrams on the self-hosting architecture and model-deployments docs pages now render correctly instead of showing raw flowchart source.

Fixes

• Enterprise LiteLLM provisioning idempotent. On-prem enterprise deployments no longer lose access to all dn/* models after the first use — repeated LiteLLM key provisioning now succeeds reliably.
• On-prem config combinations unblocked. On-prem installs combining external PostgreSQL with the bundled LiteLLM proxy now deploy successfully; previously 64 of 256 Admin Console config combinations failed at deploy time.
• Triage reversible and notes-independent. Triage status on Agent Output findings can now be cleared (returning items to ‘needs review’), and adding notes no longer silently marks a finding as triaged.
• Concurrent item writes no longer race. Concurrent writes to the same item no longer race on event sequence allocation, eliminating 500 errors and dropped audit events under load.
• Custom capability item types accepted. Custom capability item types (e.g. from report_item) no longer get rejected with a 400 error after the capability has been pushed to your org.
• Trace-backed item rebuild functional. POST /items/rebuild (trace-backed recovery for structured agent output) now works correctly — previously it 500’d before returning results due to multiple independent defects.
• Runtime token recovery after cold-start timeout. Runtime tokens are no longer lost when start_runtime times out during a cold start — the SDK now reconnects and retrieves a valid token automatically.
• Self-hosted resource preset respected. Self-hosted API pods now correctly inherit global.resourcesPreset; previously, a hardcoded ‘large’ preset overrode customer-selected sizing for every on-prem deployment.
• Session URL params preserved across refresh. Refreshing or sharing the Agent Sessions view now preserves the selected session and report — the ?session and ?report URL params no longer get dropped on page load.
• Resumed headless session transcripts update live. Resumed headless agent sessions now show the latest transcript data without requiring a full browser refresh.
• Selected project retained when switching to Agent Output. Navigating from Agent Sessions to Agent Output now retains the selected project instead of resetting to default.
• Column selector hides any column without resetting state. Column selector on Agent Output type tables now correctly hides columns like Severity and Status, and toggling columns no longer resets your sort or triggers an extra data fetch.
• CSV exports named by workspace, project, and type. Agent Output CSV exports are now named agent-output-{workspace}-{project}-{type}-{date}.csv instead of a generic finding.csv, so downloads from different projects no longer collide.
• Eval output excluded from Agent Output and Sessions views. Eval run output no longer appears in Agent Output or Sessions views; an empty Sessions list now explains when a project’s sessions were deleted or archived.
• Admin Settings button persists after profile changes. Platform Admin Settings button no longer disappears after updating your profile name or username — no logout required.

July 23, 2026

Traditional-ML red teaming suite — evasion, extraction, membership inference, and model inversion in one platform

13 new10 improved18 fixed

Four traditional-ML attack families — evasion, extraction, membership inference, and model inversion — land in AIRT this week alongside a new CLI, five runnable demo notebooks, and a comprehensive Learning Guide.

New

• Traditional-ML red teaming: evasion, extraction, and membership inference. Run 20+ named attacks (equation-solving, Jacobian, copycat, knockoff, PWWS, BAE, TextBugger, threshold, label-only, and more) against classifier APIs across tabular, image, and text modalities, with per-finding metrics, adversarial trajectory traces, and MITRE ATLAS/SAIF/NIST compliance mappings.
• Agent Output Becomes a Severity-First Triage Workspace for Findings. Agent Output now searches, sorts, and filters an entire engagement’s findings, leading with severity so the most critical results surface first. Each finding renders from its capability’s own schema with labeled fields, and can be exported to CSV, deep-linked, or copied straight into a report.
• A New Gallery Gathers a Session’s Captured Media in One Place. Images and other media logged by a session’s tools now appear together in a dedicated gallery, so reviewers can find visual evidence in one place instead of scrolling through the entire session.
• Model inversion attacks (4th traditional-ML attack family). Reconstruct class-representative inputs via black-box queries to surface privacy risks — available now as the fourth traditional-ML attack category in AIRT.
• Executive/CISO summary for traditional-ML assessments. A new summary panel on the assessment view shows attack-surface posture, query cost to compromise, risk score, and a plain-English headline for stakeholder reporting.
• Richer privacy-attack metrics in findings. Extraction findings now include KL divergence and accuracy retention; membership inference includes attack accuracy, precision, and recall; model inversion includes reconstruction quality — all correctly persisted to the finding record.
• dn airt run-classifier CLI command. Run classic-ML attacks (evasion, extraction, membership inference, model inversion) against a predict endpoint directly from the CLI without writing SDK code.
• AIRT demo notebooks. Five self-contained notebooks cover model evasion, extraction, membership inference, jailbreaks, and multi-agent attacks — run on Dreadnode-managed models with just dn login, no provider keys or environment setup required.
• AI Red Teaming Learning Guide. Eight new docs pages cover all four traditional-ML attack categories and generative AI attacks, with runnable SDK, TUI, and CLI examples throughout.
• Evaluation runtime component health recording. Eval items now record the health of all runtime components (broken tools, skills, policies) at run time, so you can see after the fact whether a degraded capability affected results.
• Eval agent selection via --agent. Specify which agent runs in an evaluation with dn evaluation create --agent <name>; eval output reports which agent actually ran.
• Web-security initial-recon skill. Structured reconnaissance for domain, wildcard, ASN, IP-list, and CIDR entry points using the ProjectDiscovery toolchain is now available as a new initial-recon skill in the web-security capability.
• Configurable project memory preload limit. Set the number of memories preloaded at session start (1–200) via --project-memory-preload-limit instead of accepting the hardcoded default of 20.

Improvements

• AIRT assessment overview: charts and summary cards for all four attack families. The overview page now shows horizontal ASR bars (long attack names readable), Surrogate Fidelity, Membership AUC, Perturbation Distance, and Reconstruction Confidence by Inversion Attack charts; evasion and inversion summary cards match extraction and membership; the finding edit modal covers all traditional-ML finding types; and 0% ASR renders as neutral across charts and heatmaps.
• AIRT finding detail: richer data across all attack categories. Membership findings show actual records with TP/FP/missed-member outcomes; text evasion reports Levenshtein edit distance; extraction findings clarify surrogate export status; per-category metrics (fidelity, query efficiency, AUC, inversion confidence) that were previously computed but not displayed are now visible.
• Redesigned evaluation run header. The eval run header is rebuilt around an input-vs-measurement hierarchy — a three-band layout (Identity / Measurements / Configuration) with distinct visual weight makes run outcomes, scores, and configuration easier to read at a glance.
• Web chat session list and session pages load faster. Covering indexes reduce shared buffer hits from 1008 to 14 on large session tables; parallel load paths, scoped invalidation, and memoized markdown rendering cut frontend latency; degraded-mode error handling prevents full failures when a transport connection drops.
• Task-set member picker select-all. A “Select all N matches” control pages the full filtered catalog in one click, replacing the previous 25-item display limit.
• Agent output descriptions render markdown. Descriptions and disposition notes in the Agent Output view now render markdown (code spans, bold, links) instead of showing raw source text.
• TUI links to Agent Output in the web app. The TUI now shows a clickable “Open Agent Output in browser” link on each reported item and at the end of any turn that produced output.
• Agent Output empty states. The Agent Output page shows “No results match these filters” with a Clear filters button when filters return nothing, and a retry button when item types fail to load — replacing the bare ag-grid “No Rows To Show” message.
• Session and transcript header legibility. Session headers in the monitoring workspace are redesigned with cleaner layout and improved title display; transcript message headers get a new layout with per-message collapse and copy controls.
• TUI model picker page scrolling. Ctrl+↑/↓ now scrolls by page in the model picker — the shortcut is shown in the bottom bar, and the previous freeze-until-modifier-released behavior is fixed.

Fixes

• Capability Python dependencies now install on E2B sandboxes. Capabilities declaring dependencies.python were silently skipping all package installs on SaaS (E2B) sandboxes, causing every tool call importing those packages to fail at runtime — fixed and hardened.
• Content-filtered and truncated generations surface a warning instead of hanging. When a model response is blocked by a content filter or truncated, the TUI, frontend, and SDK now show what happened rather than appearing to hang indefinitely.
• On-prem interactive agent sessions are restored. The runtime image is now published to Docker Hub and included in airgap bundles — on-prem installs can start interactive agent sessions again.
• Capability bindings re-resolve on every eval run, with race condition fixed. Unpinned refs now track the latest published capability version and explicit version pins are no longer silently ignored; a concurrent-run race condition that could execute the wrong capability version is also closed.
• ATLAS correctly credits success when a dangerous tool executes. ATLAS now credits a successful attack when a dangerous tool actually fires, even if the judge scored low or errored — fixing false-negative ASR 0 results on real attacks.
• Assessment summary tiles now match the findings table. Total Attacks, Actionable Findings, and ASR tiles are reconciled against actual findings, eliminating contradictory values (e.g., “Actionable Findings 0” alongside a visible MEDIUM finding).
• Broken capability components now appear as degraded in runtime health. Hooks, tools, policies, skills, and MCP components that fail to load are recorded as degraded instead of silently disappearing, making it possible to diagnose why a hook never fires or a tool is missing.
• GET /api/runtime no longer returns 500 for capabilities with a policies/ directory. Capabilities shipping a policies/ directory no longer cause the runtime health endpoint to error, restoring component health reporting across all such capabilities.
• Bare attack.run() inside an Assessment now links trials and reports real scores. Previously, bare attack.run() inside an Assessment context produced 0 score and incorrect metadata even when a jailbreak was found — now correctly links trials and carries the best score.
• Multimodal attack trials now report correct counts and analytics. Multimodal red-teaming attacks that previously always showed 0 finished trials now correctly collect results via assessment.run().
• --resume restores the session’s model selection. Resuming a session with dn --resume <session-id> now correctly restores the model that was active in the original session instead of silently falling back to the app default.
• Eval transcripts now appear for failed tasks. Messages were silently dropped when an agent raised an exception mid-turn; transcripts now flush correctly even when a chat turn fails.
• Session search by ID now returns results. Searching agent sessions by session ID or 8-character prefix returns the matching session instead of no results.
• Extraction attack fidelity is now accurate. Query pools are shuffled before the eval/train split so class-ordered inputs no longer produce unrepresentative eval sets; ActiveThief no longer crashes with surrogate=None when the eval probe exhausts the full query budget.
• label_only_membership raises a clear error on text targets. Instead of crashing with ValueError: could not convert string to float, it now raises an actionable message explaining the incompatibility.
• Transient 404s during task-environment provisioning no longer abort the session. The SDK now retries past transient 404s when polling task-environment status, fixing provisioning failures in multi-replica deployments.
• dn airt run now displays correct transform names. The CLI was printing Transforms: Transform, Transform instead of the actual names passed by the user (e.g., base64, leetspeak).
• Docs: traditional-ML guide fixes. Text {input} values in request templates must be quoted to avoid invalid JSON — this is now documented; the boundary-evasion image example also correctly shows how to fetch and pass a real image sample.

July 16, 2026

Agent Output available in beta for all orgs

13 new10 improved23 fixed

• Slash-command palette in the web chat composer. Typing / opens a fuzzy-filtered overlay with built-in actions (/new, /clear, /rewind, /model, /agent, and more) plus dynamically-discovered skills.
• @-mention agent picker in the chat composer. Type @ to open an inline agent picker navigable by keyboard or mouse; selecting an agent inserts it as a mention in your message.
• /background launcher in the web chat composer. Type /background <task> (or /bg) to spin up a headless session without leaving your current conversation.
• Chat session interface overhaul. New tool renderers (glob, grep, read, query, web search), an improved session header, capability picker, and read-only session notices ship in the web chat.
• Improved model selector in chat. A ‘manage models’ button now lives inside the selector, model settings are consolidated into one table, and the add/remove flow has new tooltips and UX affordances.
• “Agent Output” replaces “Structured Output” throughout the UI. The nav item, route (/agents/agent-outputs/), and all references are renamed; severity sorting is now case-insensitive so CRITICAL/Critical items rank correctly.

---

The web chat composer gets a full command surface this week: type / for a fuzzy-filtered slash-command palette and @ to pick an agent inline — matching the TUI experience in the browser.

New

• Agent Output available in beta for all orgs. Agent Output is available in beta for all orgs including on-prem/enterprise, with beta labeling in the UI and new documentation.
• ATLAS multi-agent attack framework. The SDK’s dreadnode.airt.atlas module runs multi-agent campaigns against deployed environments across eight attack modes using a MDP+Hedge router; executed tool calls are captured per-trial and surfaced in findings across the UI, API, and SDK.
• Comprehensive multimodal transform library (170 image/audio/video). The SDK now ships 130+ image, audio, and video perturbations for red teaming vision and audio/video models, covering ImageNet-C corruptions, AugLy augmentations, SpecAugment, and published jailbreak techniques (FigStep, DolphinAttack).
• AI red-teaming TUI exposes 131 multimodal transforms. Exposed media transforms grow from 26 to 131 (57 image, 52 audio, 22 video), including ImageNet-C corruptions, SpecAugment masking, and DolphinAttack-style audio attacks.
• LiteLLM bundled for on-prem inference. Enterprise/self-hosted installs can enable LiteLLM via a new bundled Helm subchart, giving on-prem deployments access to dn/* models, TUI/chat inference, and the Admin Model Deployments surface.
• E2B as a first-class on-prem sandbox provider. Self-hosted installs can now configure E2B via KOTS toggle — set your API key, pick the published template, and task-based evaluations work out of the box.
• --max-steps budget on evaluation runs. dn evaluation create and evaluation.yaml now accept --max-steps / max_steps: for reproducible cost control independent of model latency.
• AgentMail email inbox integration for web-security agents. Agents can now manage email inboxes via AgentMail — list/create inboxes and list, get, send, or reply to messages.
• AWS SageMaker and Nova Sonic target docs. New docs cover probing AWS SageMaker (including SigV4 auth, multimodal attacks, raw audio endpoints) and AWS Nova Sonic (bidirectional speech-to-speech streaming). AWS/Nova Sonic deps are now bundled in core — no extras needed.
• Azure AI Foundry multimodal target docs. New docs page covers probing Azure AI Foundry / Azure OpenAI multimodal deployments (text+image, text+audio) with the SDK and TUI.
• Self-hosted architecture documentation. A new architecture page documents the Kubernetes/Helm topology, network requirements, trust boundaries, and optional external services for on-prem deployments.
• Internal Network Engagements Now Run End-to-End Through Specialized Agents Automated internal-network and Active Directory engagements now run through a pipeline of specialized agents — from discovery through exploitation, credential harvesting, and reporting — with new lateral-movement and coercion tools for deeper attack paths.
• Out-of-Band Vulnerability Testing Now Runs Without External Tooling Detecting blind vulnerabilities such as blind SSRF now works without any external tooling, with automatic provider fallback keeping tests reliable.

Improvements

• Session sharing UX and deeplink. Agent session sharing now shows a popover with plain-language visibility state (Private / Shared with workspace) and a copyable deeplink.
• Worker grouping headers enriched in Agent Sessions. Grouped session views now show live count, total, last activity, and a notice when grouping covers only the current page.
• Assessment findings automatically carry target/judge model metadata. dreadnode.airt infers target and judge model info from configs so findings are populated without manual annotation; Nova Sonic raises a clear install hint immediately if streaming deps are missing.
• DataGrid rows use border separation instead of zebra striping. Rows now separate via borders with a clearer active-row indicator and improved hover/selected states.
• Caido SDK client preferred over MCP. Web-security agents now use the direct caido-sdk-client Python library when importable, reducing per-call overhead and improving routing accuracy.
• Wordlists provisioned for password cracking at install time. The network-ops capability now ships rockyou.txt, SecLists 10k-most-common.txt, and OneRuleToRuleThemAll.rule at install time so hashcat and john_the_ripper work out of the box.
• TUI agent picker shows locally installed capability version. The Ctrl+A agent picker now displays the locally installed version of each capability next to its name.
• On-prem docs: first-model setup steps and platform-administration page. Install guides now include first-model setup steps, a new platform-administration page consolidates admin workflows, and stale SaaS-only model claims are corrected.
• AI Red Teaming docs reorganized with a How-to guides section. Multimodal Red Teaming moves to the new section with a redirect from the old URL; Azure judge rubric tightened to avoid false-positive jailbreak scores on deflections.
• Project metadata editor keyboard navigation and inline validation. The editor now supports keyboard navigation with revert/rollback on cancel.

Fixes

• Filter popover no longer freezes the UI on large orgs. Filter rows are capped at 100 with search to find additional values; 3,000 facet values drop from 182 ms to 15 ms render time.
• spawn_agent no longer hangs on sub-agent failures. Errors are now surfaced and a 900 s timeout prevents infinite waits.
• Agent sessions no longer get stuck in an unrecoverable 400 state. Tool-call repair at the provider boundary handles compaction splits and orphaned tool messages from mid-run cancellations; duplicate or blank tool-call IDs are also sanitized.
• No-arg tools now include the required parameters field. Fixes 400 errors on Together AI, DeepInfra, and other strict providers that require parameters even when empty.
• llm_judge with dn/* models no longer silently scores 0.0. Routing now goes through the platform gateway correctly instead of raising a BadRequestError and returning a false-negative score.
• pitch_shift transform no longer fails 100% of the time. An un-awaited coroutine caused every execution to fail with AttributeError; it now runs correctly.
• SageMaker SigV4 multimodal targets work end-to-end. Three root-cause bugs (missing boto3, unresolved image paths, unsubstituted template placeholders) that silently produced zero real trials are fixed.
• Web-security capability now emits structured findings. report_item is correctly offered to the agent so typed findings (web_vulnerability, web_endpoint) appear in the app instead of silently falling back to the generic report tool.
• Impacket tools in network-ops install and resolve reliably. Multiple fixes address ModuleNotFoundError and FileNotFoundError across uv-managed runtimes, Python version mismatches, and false-positive script path detection; impacket_atexec and impacket_dcomexec drop the unsupported target_ip parameter for impacket 0.13.x compatibility.
• Combined NTLM relay attack tool and certipy_find signature fix. New impacket_ntlmrelay_attack combines relay and coercion into a single call; certipy_find now takes structured params (breaking change for agents using the old args=[] form).
• Generated ATLAS and agentic campaign scripts no longer crash with NameError: get_generator. Missing import is now included in both ATLAS and agentic-mode generated scripts.
• atlas_attack objectives parameter is now optional. Omitting it defaults to one objective per OWASP-ASI category instead of raising a TypeError.
• Sandbox provider unreachability no longer 500s all API endpoints. Non-sandbox endpoints stay online; sandbox-specific endpoints return 503; org/user endpoints are also correctly excluded from the degraded path.
• Model deployment names without dn/ prefix now fail loudly. Admin API returns HTTP 400 instead of silently making the deployment invisible.
• Task-based evaluations on unsupported providers return a clear error upfront. Providers that don’t support template builds (e.g. OpenSandbox) now return HTTP 400 at submission instead of failing silently mid-run.
• Session exports record the correct model. Empty model strings from the agent definition no longer overwrite the user-configured model in trajectory exports.
• TUI session browser placeholder and Ctrl+O deep-link fixed. Project filter shows a real example in the placeholder; Ctrl+O opens the correct URL instead of a 404.
• TUI reasoning blocks truncate in compact mode and wrap correctly. Reasoning now truncates to 6 lines in compact mode (expand with ^O); wrapped lines no longer lose their gutter indent.
• dn CLI no longer crashes on exit after /quit. Orphaned ThreadPoolExecutor threads are now drained on shutdown.
• TUI no longer leaks reasoning traces from previous sessions. All conversation widgets are cleared on /new or session switch.
• Agent session deep links load correctly instead of showing empty client data.
• Oversized SVGs render correctly in the agent session view. Previously showed a broken image icon.
• dn/ models tip in docs corrected. dn/ models are zero-setup and billed to your Dreadnode account — DREADNODE_LLM_BASE and DREADNODE_LLM_API_KEY are not required.

July 9, 2026

End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces

14 new5 improved14 fixed

• Structured findings and assets in the platform. Agents can emit structured vulnerabilities, endpoints, and other typed items during runs — viewable in a new Structured Output page with per-type tables, detail panels, and provenance history. Web-security agents now produce WebVulnerability and WebEndpoint items visible in the Items UI for triage, filtering, and cross-session tracking.
• Web chat — interactive/autonomous mode toggle, rewind, and session actions. Web chat sessions now support an interactive ↔ autonomous mode toggle with optional step cap, a “Rewind to here” control on any prior user message, and a full action menu (copy ID/link, export trajectory, archive/freeze/delete) directly from the session list.
• Web chat — inline human-input prompts, live tool media, and reasoning-effort selector. The web chat transcript now surfaces ask_user prompts inline, renders live tool media during streaming, and exposes a reasoning-effort selector in the composer.
• Chat UI promoted to main navigation. Web chat is now accessible from the main sidebar navigation instead of the previous beta route.
• Session compaction rendered as a labeled divider in web chat. Compaction events now appear as a divider with an expandable summary of how many messages were summarized, instead of leaking raw XML into the transcript.
• Agent sessions default to no grouping. The Sessions page now defaults to ungrouped; workflow grouping is still available in the selector.
• Unified produces key for capability manifests. A single produces key now configures built-in item types, custom types, and disablement — replacing the older items key.
• Chat sandbox no longer auto-pauses mid-session. A periodic keepalive extends the runtime’s expiry every 30 seconds while you’re actively working.

---

Full multimodal support lands in AI red teaming this week — probe vision, audio, and video targets end-to-end, with media rendering inline across findings, traces, and exports.

New

• Multimodal AI red teaming — end-to-end. Probe LLMs with text, image, audio, and video inputs; apply per-modality transforms; score outputs (including generated media) with the new multimodal_judge scorer; view full message parts inline in findings, traces, and parquet exports (new schema v3 with base64 media columns). Includes a cross-product prompt_matrix mode (N prompts × M media items = N×M trials) and Nova Sonic speech-to-speech target support.

• Custom HTTP targets for AI red teaming — any cloud, any auth. New build_target(TargetSpec) factory and custom_http target mode let you point TAP, PAIR, and other attacks at any endpoint (Azure, Vertex, SageMaker, Bedrock, OpenAI-compatible, arbitrary URLs) with declarative auth strategies (API key, Bearer, AWS SigV4, Azure AD, GCP).

• Per-modality response scores in the platform. Findings and Assessment Findings tables now show independent scores per output modality (text, image, audio, video) with the highest-scoring modality emphasized.

• Session groups and workflow hierarchies. Multi-session agent runs are now organized into collapsible workflow groups in the Sessions view instead of a flat list; the SDK exposes a new client.workflow() API.

• Model reasoning as a first-class field in session transcripts and trajectory export. Native reasoning content (Anthropic thinking blocks, reasoning_content) now appears in the session transcript viewer and ATIF trajectory export as a typed field rather than being silently dropped.

• SecurityContext MCP server for web-security agents. New MCP server lets agents mine commit history and CVE disclosures to generate hunting briefs, top risks, and ranked vulnerability leads before auditing a codebase — three tools: get_security_context, create_security_context, get_vulnerability_leads.

• Three new web-security skills. Added git-integration-exploitation, http-query-method (RFC 10008 parser differentials), and dom-vulnerability-detection (postMessage IP normalization bypass).

• Hub scope tabs — Mine · {org} · Public. Dataset, Model, Capability, and Environment browse pages now have scope tabs with live count pills and scope-aware empty states.

• Bundle README surfaced in frontend, TUI, and CLI. Capability and task detail pages now include a README tab; the TUI exposes it with d; the CLI adds --readme / -R to dn capability info and dn task info.

• Auth-setup-guide skill for AIRT. New skill walks you through authenticating target, attacker, and judge models from your own environment — covering Azure, AWS Bedrock, GCP Vertex, custom HTTP endpoints, and more.

• multimodal_judge scorer. New scorer evaluates generated images, audio, and video using a vision/audio-capable model instead of stringifying media output.

• dreadnode[nova-sonic] SDK extra. Install the new extra to get all required AWS deps for Nova Sonic speech-to-speech targets; missing deps now raise a clear error instead of an opaque import trace.

• AIRT multimodal output capture and per-modality scoring. All output modalities (text, image, audio, video) are now captured from target models, with per-modality worst-case MAX score aggregation, and audio/video playback fixed in the trace viewer.

• Nova Sonic S2S target support in the TUI and AIRT SDK. Nova Sonic speech-to-speech targets are now available in the TUI capability picker and the SDK’s build_target factory.

Improvements

• Multimodal AIRT findings layout — Original → Transformed → Response. Findings now display a clean three-panel message layout with judge model, transformed prompt, and inline trace media shown correctly.

• Model reasoning always visible inline in TUI and web session viewer. Reasoning now appears as always-visible inline prose; ^O controls tool-output verbosity only and no longer hides reasoning blocks.

• AIRT findings ranked by severity. Critical findings now surface first in the findings list.

• Improved dn update diagnostics. The CLI and TUI now show accurate resolver-failure details when dn update exits without changing the installed version.

• Org, workspace, and project names enforce 100-character limit. Name inputs now validate length as you type, preventing overflow and submission errors.

Fixes

• SDK installable again — MoviePy moved to dreadnode[video] extra. dreadnode 2.0.32+ is installable from PyPI; the Pillow/MoviePy conflict is resolved by making MoviePy optional.

• spawn_agent no longer hangs indefinitely. Sub-agents now have a default 1-hour timeout (configurable); the undocumented run_in_background field has been removed.

• Native reasoning now reaches the client on dn/ proxy routes. Thinking blocks and reasoning_content from Claude and other reasoning models were previously silently dropped on platform proxy routes.

• Nova Sonic adapter no longer hangs on missing AWS credentials. The adapter now resolves credentials via the standard AWS chain (env, profile, SSO, IMDS) and fails fast with a clear error, eliminating the 9+ minute hang.

• Multimodal AIRT findings show real errors instead of “(no response)”. When a target call fails (e.g. auth 401, bad model ID), the actual error is surfaced so failures are distinguishable from genuine model refusals.

• AIRT trial counts, missing responses, score tooltips, and trace deep-links fixed. Trial counts display correctly, missing responses fall back to trial data, tooltips work on score columns, and silent refusals show a descriptive message.

• Judge reasoning now appears in finding headlines and markdown exports. Previously blank even when trial-level reasoning was present; root cause was reading from the study-level span instead of the trial span.

• Judge LLM field on assessment-detail header shows model name. Previously displayed ”—” for multimodal assessments.

• AIRT compliance dashboards show correct denominators. OWASP LLM Top 10 now shows /10 and NIST AI RMF shows /4; multimodal media in trace spans renders inline instead of as raw JSON.

• AIRT multimodal video, audio playback, and per-trial message blocks fixed. Video input, audio playback, and judge reasoning work correctly; findings tables show per-trial message blocks instead of a single best-trial view.

• AIRT multimodal view shows correct attacker prompt on failed trials. Previously showed the wrong prompt; media downloads now save to disk instead of opening inline, and trial scores carry clearer “Overall Score” labeling.

• TUI model picker cursor no longer jumps when filtering. Cursor now stays at the top of filtered results instead of jumping to the bottom.

• TUI first-run defaults to a platform-hosted model. New users without a personal Anthropic API key no longer hit an immediate failure on TUI startup.

• Network-ops tool wrapper bugs fixed. Four confirmed bugs resolved: smbclient preserves partial directory listings, netexec handles multiple groups in enumeration, SharpView correctly parses arguments with spaces, and Impacket script discovery works with bash wrapper scripts.

July 2, 2026

Claude Code engine — run Claude's agentic loop as a governed, session-backed agent

6 new5 improved14 fixed

Agents get a pluggable execution engine this week, with Claude Code shipping as the first built-in option alongside a full suite of transcript fidelity and eval reliability fixes that make it production-ready.

New

• Pluggable agent engine + Claude Code harness. Agents now support swappable execution engines; the built-in Claude Code engine runs Claude’s agentic loop as a first-class, governed, session-backed agent with full trace viewer support.

• Task Sets. Tasks can now be grouped into named, versioned collections and run as a single evaluation target via the API, dn task-set CLI commands, or the Environments UI.

• User-controlled task-environment models. You can now choose which model a task’s environment (defender) uses per role via --env-model role=id in the CLI, model_overrides in evaluation.yaml, or the API — independently of the solver and judge models.

• Evaluation sample search. You can now search across all samples in an evaluation by free text — matches are highlighted with per-sample counts, and a “Matches only” filter collapses non-matching samples.

• Blind SQL injection extraction skill. A new blind SQLi extraction skill and tool in the web-security capability supports boolean/timing-based oracle identification, WAF bypass patterns, and automated char-by-char extraction.

• Blind SSRF chains with attacker infrastructure provisioning. The blind-SSRF-chains skill now guides agents to detect available cloud CLIs and provision attacker infrastructure (S3 buckets, redirect servers) for SSRF proof-of-concept evidence.

Improvements

• Task-set provenance on evaluation detail. Evaluation detail now shows the linked task-set org/name and a collapsible list of skipped members with reasons when an eval was run from a task set.

• Usage summary in headless print mode. dn --print now outputs a model, tokens, tool calls, and cost summary to stderr after each run, matching the cost visibility available in the TUI.

• Sub-agent costs in TUI footer. The TUI footer now shows sub-agent LLM costs as a separate “subagents $X.XX” segment so total spend is no longer understated when using spawned sub-agents.

• Bare --resume opens session picker. dn --resume (or -r) with no argument now opens the session picker instead of erroring, matching the UX of Codex and Claude.

• Chat runtime reliability overhaul. Sandbox state management is simplified and the chat page handles runtime lifecycle more reliably, reducing spurious disconnects and state loss.

Fixes

• AIRT assessments no longer stuck in pending/running. Assessments stuck indefinitely are now automatically finalized after a configurable timeout (default 2h), and a one-time migration clears the existing backlog.

• AIRT overview page 500 errors resolved. The AIRT project summary endpoint no longer intermittently 500s (~58/hr) due to a closed database transaction.

• Eval task timeout now respects org ceiling. Evals no longer fail at provisioning when --task-timeout-sec is unset; the runtime is capped to your org’s ceiling, and an over-ceiling value returns a clear 400.

• dn/* model IDs work in AIRT runs. All three AIRT model roles (attacker, judge, and target) now correctly route through the LiteLLM proxy instead of failing with “LLM Provider NOT provided.”

• TUI conversation scrolling is smooth. The viewport no longer jumps when new messages arrive, and scroll performance is significantly improved for long conversations (~129 ms/step → ~47 ms).

• TypeScript files no longer sent as video. The SDK read tool no longer crashes generation when reading .ts/.mts files — they’re now correctly identified as text.

• Image content no longer fails text-only models. Text-only models (e.g. via OpenRouter) no longer fail with a 404 when a tool returns image content — the SDK substitutes a textual description and retries automatically.

• MCP tool calls retry transient failures. MCP tool calls now retry once on dropped connections or subprocess crashes instead of immediately marking the server unavailable.

• MCP shutdown no longer emits noisy warnings. The MCP client no longer logs “Task exception was never retrieved” on shutdown when the subprocess or remote server has already exited.

• Unique browser session names required for web-security agents. Concurrent web-security agents no longer clobber each other’s browser state — the --session <name> flag is now required.

• Agents page defaults to no session grouping. The sessions page now defaults to no grouping instead of grouping by workflow instance; workflow grouping remains available in the selector.

• Claude Code engine transcript fidelity. Transcripts now show the initiating user message and correctly link tool call outputs to their calls; orphaned tool results and lost calls from burst-emit engines are fixed.

• Engine-override eval sessions no longer hang. Evaluations using --engine claude-code no longer wait indefinitely for tool approval that never arrives.

• Eval task timeout respects org ceiling. Evals with an unset --task-timeout-sec no longer fail at provisioning due to exceeding the org’s 6h ceiling.

June 2026

June 25, 2026

Analytics query and notebook UX overhaul

3 improved1 fixed

A full web chat interface for project runtimes lands this week, alongside capability management and rich tool-call rendering.

Improvements

• Analytics query and notebook UX overhaul. The analytics query and notebook pages now include empty states, a stats summary strip, loading skeletons, inline error banners, schema column insertion, and example query chips.
• Web-security agent project memory. The web-security agent now persists reconnaissance findings, gadgets, leads, defense bypasses, and discoveries across sessions using structured project memory.
• Hide revealed media in tool results. Revealed images in tool results and logged outputs can now be re-hidden — clicking Hide removes the image from view and frees the decoded blob from memory.

Fixes

• AIRT project overview crash on non-finite values. The AIRT project overview no longer returns a 500 error for projects with a stale running assessment that produced NaN or Infinity values in its snapshot.

June 18, 2026

Tool media evidence in session transcript

6 new7 improved12 fixed

Agents can now persist and retrieve durable project-scoped memory across runs with the new ProjectMemory tools.

New

• Tool media evidence in session transcript. Screenshots and other media logged via dn.log_output() inside tools now render inline in the session transcript next to the tool call that produced them.
• Unified LiteLLM admin proxy and model browser. Admins can manage LiteLLM model deployments and credentials directly from the platform; platform models are now always org-allowlist-scoped, and Ctrl+K in the TUI opens the full model browser.
• Release Notes page on docs site. A new page at docs.dreadnode.io/release-notes shows the full changelog with tier chips, month navigation, per-entry permalinks, and an RSS feed.
• App-layer DoS skill for web-security. New app-layer-dos skill covers ReDoS, decompression bombs, server delay exploitation, and cross-protocol amplification for application-layer DoS testing.
• Archive path-traversal skill. New archive-path-traversal skill covers Zip Slip, symlink attacks, polyglot MIME bypass, and Unicode path confusion via the archivealchemist tooling.
• EXIF metadata manipulation tools. New exiftool capability adds exif_read, exif_write, exif_strip, and exif_copy methods for EXIF metadata manipulation in web-security agents.

Improvements

• AIRT findings: newest-first, auto-refresh, and richer detail. All Findings now defaults to newest-first order, auto-surfaces new findings every 20 seconds with a notification pill, and the finding detail panel shows a structured Human Review table, a Metadata tile with Finding/Assessment IDs, a copy button on reasoning, and UUID-prefix search.
• Web-security continuous scan status. The web-security agent now emits a STATUS update (including an Unexplored field) after every action, reducing silent drift and improving visibility into scan coverage.
• Confidence trace IDs in web-security reports. Web-security vulnerability reports now include a trace ID linking each finding back to the confidence assessment that approved it.
• CVSS score in confidence assessments. The web-security credence tool now accepts an optional CVSS score, echoes it as [cvss:N.N] in output, and flags mismatches such as low confidence paired with a high CVSS score.
• Evaluations page shows capability and user detail. The evaluations list now surfaces who or what ran each sample alongside the capability reference, making it easier to identify the origin of a run.
• Web-security interrupted tool result recovery. The web-security capability now automatically retries when the model emits an interrupted tool call result, replaying the last tool outcome up to a bounded retry budget.
• Inject env vars into smoke tests via -e/--env. The new -e/--env flag on dn task validate --smoke lets you inject environment variables into the challenge service at smoke-test time without editing docker-compose.yaml.

Fixes

• Evaluation reliability: deadlocks, sandbox provisioning, and circuit-breaker gaps. Evaluations no longer get stuck in queue for hours due to deadlocks, sandbox provisioning failures, or missing circuit-breaker coverage; transient infrastructure errors now retry automatically.
• AIRT findings list restored: legacy compat and fast load. The findings list now correctly displays findings saved with legacy review-event field names and loads without the previous 6–10 second delay caused by a sequential scan.
• Multi-attack campaigns no longer crash mid-run. All 12 attack types now accept airt_* span-linkage kwargs, fixing TypeError crashes that caused campaigns to partially complete and produce duplicate assessments.
• Judge verification timeout extended. Trajectory-based task verifiers (outcome_judge, script_and_judge, flag_and_judge) no longer time out prematurely — the judge phase now has a 180-second minimum, preventing empty judgement results.
• ASR formula consistent between detail and overview pages. Successful attack counts and ASR on the assessment detail page now use the same severity-based formula as the overview page.
• Duplicate rows removed from ASR by Category chart. The chart no longer shows both jailbreak and jailbreak_general for runs using a single underscore-named category.
• Video inputs work in eval model tasks. The SDK now serializes video content parts correctly for Gemini/Google/Vertex and OpenAI-compatible paths.
• Failed assessments stay failed. Assessments that fail during finalization now correctly report status=failed in dn airt list --json instead of being overwritten to completed.
• Workflow regeneration preserves hand-patched files. Re-running workflow generation no longer silently overwrites hand-edited files — existing files are kept and new versions are written as name_v2.py, name_v3.py, etc.
• Anti-fabrication guard on report-writer trace IDs. The report-writer skill now marks missing confidence trace IDs as MISSING instead of allowing the agent to hallucinate a plausible-looking ID.
• TUI /model command no longer overwrites profile default. Using /model or /models in a TUI session no longer persists the selection to your profile, so different sessions can use different models without interfering.
• Activity feed status colors unified. Status badge colors on the home page activity feed now match the rest of the platform — e.g. AIRT “running” shows blue and World “cancelled” shows gray.

June 11, 2026

Session and Trace Views Now Display Agent-Captured Images, Audio, and Video

10 new14 improved13 fixed

Sandbox runtime limits now resolve through a four-level hierarchy configurable by platform admins, org owners, and individual users — alongside a concentrated push to eliminate evaluation sandbox timeouts that were causing widespread ‘sandbox was not found’ failures.

New

• Session and Trace Views Now Display Agent-Captured Images, Audio, and Video Analysts can now view the images, audio, and video an agent logged during a run directly in the session transcript and trace details, rather than as raw base64. Each item stays behind an explicit Show media click, so potentially hostile artifacts are never decoded until an analyst chooses to open them.
• Sandbox runtime limit hierarchy. Sandbox runtime limits now resolve through a four-level hierarchy (platform max → org max → org default → user-requested), configurable by platform admins, org owners, and individual users across the UI, API, SDK, and TUI.
• Attack surface management capability. A new attack surface management capability combines BBOT scanning, Shodan enrichment, Neo4j graph analysis, screenshot triage, and a multi-agent ASM pipeline.
• HTTP/2 WAF bypass skill. New h2-waf-bypass skill in the web-security capability covers 6 bypass classes including delayed DATA frame timing, body size truncation, Extended CONNECT, ForwardAuth body stripping, path normalization, and JSON content-type gaps.
• GraphQL penetration testing skill. New graphql-pentest skill covers endpoint discovery, introspection mining, resource abuse (CWE-400, CWE-674), content-type CSRF, and capability matrix testing.
• Vulnerability assessment methodology capability. A new standalone vuln-assessment-methodology capability provides a reusable severity matrix, disprove-first rules, and reporting standards that any security capability can load.
• --judge-model override for evaluation creation. New --judge-model flag on dn evaluation create lets you override the task-level judge model at eval creation time without modifying task.yaml.
• Pinned smoke solution image for dn task validate. dn task validate --smoke now runs solution and verify scripts in a pinned container that mirrors the production agent runtime, so smoke results match production behavior.
• ProcessJudge prefix caching. ProcessJudge now supports prefix caching (opt-in cache flag), cutting LLM costs on long judge sessions by billing repeated calls at cache-read rates; GuardSessionPolicy enables it by default.
• Automated Cloud Assessments Now Measure the Impact of Exposed AWS Credentials Security teams can now confirm how far an exposed AWS credential or instance-metadata finding could be taken, with the platform’s agents running authorized AWS exploitation checks to validate real-world impact.

Improvements

• Secrets and chat models moved to Account Settings. Secrets and chat model settings have moved from org settings pages into the Account Settings modal, with deep-link support via URL hash (e.g. #account-settings/secrets).
• Sandboxes view shows workload context. The sandboxes view now shows evaluation, task, and agent context for each sandbox, making it easier to trace which workload a sandbox belongs to.
• Default agent timeout doubled to 1 hour. Default agent timeout for evaluations increased from 30 minutes to 1 hour, giving agents more time to complete complex multi-step tasks like Cybench challenges.
• In-flight eval samples pinned to top. In-flight eval samples now stay pinned at the top of the samples pane during concurrent runs, so active samples no longer get buried in the list.
• Actor chip in activity feed. The activity feed on the home page now shows an actor chip identifying who performed each action.
• Session starter visibility in agent sessions. Agent sessions list now shows who or what started each session, making it easier to identify the origin of a run at a glance.
• ASR by Category chart in Assessment Reporting. The ASR by Category card in Assessment Reporting now renders a bar chart in Charts mode, matching the ASR by Attack and ASR by Transform cards.
• Job-status discs now have accessible labels. Job-status discs across evaluations, training, optimization, and worlds now show hover tooltips and ARIA labels so their color and animation meaning is clear to all users.
• /agents TUI listing cleaned up. The /agents command in the TUI now groups agents under capability headings with aligned columns, an active-agent marker, and a footer hint — and correctly displays on the home screen.
• ‘Add Custom Secret’ button moved to top. The ‘Add Custom Secret’ button on the Secrets settings page now appears at the top of the section, so you no longer need to scroll past existing secrets to reach it.
• Smoke test now validates multi-file task solutions. Smoke test runner stages the full task directory into the agent sandbox, so multi-file solutions referencing sibling scripts or assets validate correctly.
• dn task validate --smoke covers judge-backed verification methods. dn task validate --smoke now runs the mechanical verification steps (solution + verify) for script_and_judge and flag_and_judge tasks instead of silently skipping them.
• Project selector persists across navigation. The project selector now persists across pages — navigating from agent sessions to Charts or Analytics no longer resets your selected project.
• Expired Verification Links Can Now Be Resent in One Click Users whose email verification link has expired can now request a fresh one in a single click, directly from the recovery page.

Fixes

• Evaluation sandbox timeouts eliminated. A cluster of fixes ensures eval sandboxes now correctly honour their configured runtime limit: the rebalancer no longer resets timeouts to the org default, org ceiling validation is bypassed for eval-managed sandboxes, and explicit runtime limits are passed through from evaluation service to sandbox.
• Cybench eval port connectivity fixed. Cybench evaluations no longer return 502 ‘port not open’ errors; sandbox timeout increased to 30 minutes and eval concurrency raised to 10; cold Docker Compose builds no longer expire the sandbox mid-run.
• Evaluation queue starvation and sandbox provisioning failures fixed. Evaluation runs no longer queue-starve for hours behind large evals in the same org; env sandbox provisioning timeout raised to 300s to prevent ~30% of runs from failing.
• OAuth buttons respond on first click. “Continue with Google” and “Continue with GitHub” buttons now respond on the first click, previously dead due to a hydration race on the sign-in/sign-up form.
• Training runs honour the epochs parameter. The epochs parameter for Tinker SFT is no longer silently ignored — jobs previously always ran 100 steps regardless of dataset size or epoch setting.
• Training run charts no longer show gaps in validation loss. The SDK no longer emits a None-padded val_loss series, and historical runs are handled gracefully.
• Gemini models no longer fail with authentication errors. Models returning null cache usage fields from LiteLLM (e.g. gemini/gdm-eval-model-lis) no longer fail with a spurious authentication error.
• read tool returns images as vision input. The read tool now returns image files as ContentImageUrl so VLMs receive proper vision input instead of a raw base64 text blob.
• Catalog page filter buttons load immediately. Filter buttons on Environments, Capabilities, Datasets, and Models catalog pages now appear immediately instead of taking minutes to load.
• Queued and running eval statuses now show distinct colors. Queued/pending returns to gray while running stays blue — previously both showed the same blue.
• Cancelled evaluations no longer leave samples spinning. Cancelled evaluations no longer leave sample rows spinning indefinitely — statuses now correctly reflect the cancelled state.
• Legacy runtime timeout no longer triggers ceiling errors. Evaluations no longer fail with ‘requested_runtime_limit_seconds exceeds platform ceiling’ when you didn’t explicitly set a runtime limit.
• Unused runtime limit set silently respected by evaluations. The platform no longer incorrectly treated internal timeout values as explicit user runtime requests.

June 4, 2026

Binary analysis capability replaces windows-reversing with cross-platform PE/ELF/Mach-O support

7 new5 improved10 fixed

The binary-analysis capability lands this week with cross-platform support for PE, ELF, and Mach-O — replacing the older windows-reversing bundle.

New

• Binary analysis capability (cross-platform). A new binary-analysis capability replaces windows-reversing with PE/ELF/Mach-O support, an expanded Ghidra MCP server, and a consolidated 8-phase analysis skill.
• Bulk evaluation log download. You can now download all sample logs from an evaluation as a single ZIP bundle instead of exporting one sample at a time.
• Dashboard workspace toggle. The dashboard now has a toggle to filter activity between your personal workspace and the full organization view.
• Billing purchase receipt downloads. Org owners and admins can now download receipts for individual credit purchases from the billing settings page.
• Conditional MCP header omission. MCP server headers can now be marked optional: true so unset env vars omit the header entirely, letting OAuth run as the default without a separate wrapper capability.
• New end-to-end guides. Two structured guides — “Building a Capability” and “Red Teaming a Model” — replace several older scattered deep-dive docs.
• Automated Web-Security Testing Now Covers Adobe Experience Manager and Apache Sling Security teams can now run automated assessments against Adobe Experience Manager and Apache Sling applications, surfacing the selector-abuse, dispatcher-bypass, and cross-site scripting weaknesses specific to those platforms. Existing coverage for blind SSRF chains and DOM-based vulnerabilities has also been sharpened for more reliable detection.

Improvements

• Server-side transcript search. “Find in transcript” now searches all messages in a session server-side, so you can find matches in long sessions without paging through the entire transcript first.
• Web-security skill quality pass. 28 web-security skills were updated with improved tooling, executable commands, and validation checkpoints — average skill score raised from 86% to 92% across all 58 skills.
• Credits and pricing explained inline. Credits and pricing are now explained across the signup page, TUI status bar, TUI help panel, and docs Quickstart — each surface links to the canonical Credits docs.
• Task verification method now visible in the UI. Task verification method (script, flag, judge, or compound) is now shown in both the environment task detail view and evaluation sample detail view.
• Consistent activity awareness across views. Status indicators, severity tags, and activity awareness are now more consistent across assessments, evaluations, training, and optimization views.

Fixes

• AI red-teaming attack workflows no longer fail with an SDK config error. Analytics results are now persisted correctly, and tool errors surface as clean messages instead of raw tracebacks.
• Multi-study AIRT runs now export all traces. In multi-study workflows (transform comparisons, campaigns, category sweeps), all study traces are now exported — not just the first study’s. Applying a single transform no longer adds an unwanted baseline run.
• TUI login no longer gets stuck in a LiteLLM key provisioning loop. Connecting to the platform no longer fails with a repeated “Failed to provision LiteLLM Key” error.
• SDK and platform now enforce the same task-validation rules. Tasks that pass dn task validate locally will no longer be rejected with an opaque 400 error on upload.
• generate_category_attack no longer fails with “Unknown attack: ‘t’” errors. All input formats for attack names — string, list, or comma-separated — now work correctly.
• Session headers now show accurate message counts and reports. Active vs. total message counts are shown for compacted sessions, and the Reports tab correctly surfaces all reports from the full transcript.
• TUI model browser now shows context and credit cost for hosted models. dn/* model rows no longer display - for context window size and price when catalog metadata is available.
• Evaluation tool-use lists now show the actual skill name. The literal word skill no longer appears in place of the loaded skill name (e.g. agent-browser).
• Running and failed status dots are now visually distinct. Running tasks in the evaluations view show a blue dot instead of orange-red, making them clearly distinguishable from failed (red) at a glance.
• Selected items in sidebar panels now show a visible highlight. Evaluations, AIRT assessments, training runs, and trace-viewer runs now display a brand-tinted highlight on the active selection instead of blending into the background.

May 2026

May 28, 2026

Android APK research capability and issue-tracker connectors for web-security

7 new3 improved9 fixed

New capability bundles for Android APK research and issue-tracker integrations land alongside a full sweep of assistant-led CLI guides across the platform.

New

• Android APK research capability. A new android-apk-research capability bundle ships with a 10-tool MCP server and four skills for static semantic vulnerability research on Android APKs.
• Jira connector for web-security. Web-security agents can now export validated findings directly to Jira Cloud as remediation tickets via a new Jira MCP connector.
• GitHub connector for web-security. A new GitHub MCP connector lets web-security agents file findings as GitHub issues and add follow-up comments without leaving the agent workflow.
• Run artifact logging tools. Web-security agents can now attach screenshots, audio, video, and file artifacts directly to a run using four new path-based logging tools: log_image_output, log_audio_output, log_video_output, and log_file_artifact.
• IDOR/BOLA judge scorer rubric. A new built-in IDOR/BOLA rubric is available for the SDK’s default LLM judge scorer, with graduated pentest-aligned cross-boundary access criteria; the web-security scorer-reference skill documents how to compose it in task.yaml and SDK configs.
• Activity feed on the home page. The home page now shows a live activity feed with recent projects, sessions, evaluations, training jobs, and other workspace activity.
• Administrators Can Now Control Which AI Models Members Use. Organization administrators can now grant each member access to a specific set of AI models, with the limits enforced automatically across the web app, API, and CLI.

Improvements

• Assistant-led CLI guides across all surfaces. Every in-product CLI guide (capability, task/environment, dataset, model, evaluation, optimization, world manifest, trajectory, training) is rewritten into a two-tab layout with an ‘Ask an agent’ tab, accurate dn alias commands, and corrected flags.
• CLI guide launcher button labels clarified. Launcher buttons across nine surfaces now use accurate action verbs (Create, Evaluate, Optimize, Train) instead of generic or incorrect labels.
• AIRT and Traces visual language overhaul. The AIRT Traces view and shared TraceViewer now use consistent design-system primitives, unified span-category colors, and a redesigned trace control bar.

Fixes

• Large-trajectory judge staging no longer fails. Outcome-judge staging no longer errors on large eval trajectories; the sandbox now fetches the trajectory directly via session ID instead of having it serialized and shipped by the API.
• Session transcripts no longer truncated. Session transcripts now load all messages via cursor pagination — previously, sessions with more than 2,000 messages were silently truncated, dropping the most recent ones.
• dn task validate accepts compound verification methods. dn task validate now accepts flag_and_judge and script_and_judge, fixing validation failures across 248 tasks.
• TUI Ctrl+C now copies to clipboard. In the agent TUI, Ctrl+C copies selected text to clipboard (with fallback to pbcopy/xclip/xsel/wl-copy); use Ctrl+Q to quit.
• TUI hosted model list no longer shrinks after restart. New platform model deployments now appear in the TUI without manually deleting ~/.dreadnode/proxy-models.json.
• TUI /models screen respects admin model ordering. The TUI /models screen now displays models in the order configured by your admin instead of re-sorting alphabetically.
• TUI no longer crashes on mid-load screen navigation. The TUI no longer throws a NoMatches exception when navigating away from a screen while a background worker is still loading data.
• Image files render correctly in the environment file viewer. Image files in the environment file viewer now render as images instead of garbled binary content.
• Linear MCP credentials now passed correctly. LINEAR_API_KEY, LINEAR_ACCESS_TOKEN, and LINEAR_API_URL are now correctly forwarded to the Linear MCP server in the web-security capability.

May 21, 2026

Compound eval verification — script_and_judge and flag_and_judge

6 new6 improved16 fixed

Eval tasks now support compound verification strategies that chain mechanical checks with an LLM judge to close reward-hacking gaps.

New

• Compound eval verification: script_and_judge and flag_and_judge. Two new verification methods let eval task authors run a script or flag check first, then invoke an outcome judge as a second line of defense against reward hacking — no custom rubric required.
• OutcomeJudge agentic verification. A new outcome_judge verification method lets eval tasks use an agentic LLM to inspect agent trajectories and emit pass/fail verdicts, alongside the existing script and flag methods; exposed via the new dn outcome-judge run CLI subcommand.
• intent_plus_outputs_summary guard strategy. A new opt-in policy replaces raw tool outputs with LLM-generated summaries in judge prompts, reducing prompt-injection surface while preserving tool-call context.
• Six new web app pentesting skills. ESI injection, gRPC-Web pentest, H2C/WebSocket smuggling, HTTP connection contamination, timing-attack recon, and XSLT injection are now available as knowledge distillations in the web-security capability.
• waymore added to web-security capability runtime. Historical URL and response retrieval from Wayback Machine, CommonCrawl, OTX, URLScan, and VirusTotal is now available for recon and JS archaeology.
• New setting for org admins re: model usage. Organization admins can now control which AI models each member is allowed to use, set right from the org members admin page

Improvements

• TUI keystroke performance. Keystroke routing is now ~400× faster in long conversations — typing in the composer no longer slows down as conversation history grows.
• TUI event loop and grep tool overhaul. The TUI no longer stalls when sync tools run blocking calls; grep gains output modes, context lines, and smarter filtering; tool result summaries now reflect actual output.
• TUI session commands rationalized. /clear and /reset both now start a fresh session (preserving the old one), and the destructive in-place wipe is removed.
• Assistant-led CLI guide modals. The in-product CLI guides for capabilities, tasks, environments, and models are rewritten with an assistant-led flow, accurate commands, and an ‘Ask an agent’ tab that generates a copyable dn --prompt launcher.
• Consistent empty states across the platform. Empty states now distinguish ‘nothing here yet’ from ‘no filter matches’, include inline docs links, and show ghost visuals that hint at what each surface will contain.
• Consistent browser tab titles. All pages now show titles in the format {Page} | Dreadnode, replacing a mix of inconsistent formats and blank tabs.

Fixes

• Compound eval verification false negatives resolved. script_and_judge and flag_and_judge no longer report failed results when the agent successfully completes a task.
• AIRT CLI assessment creation now surfaces in the UI. dn airt run and dn airt run-suite now correctly connect to the platform, so runs and results appear in the assessment UI instead of silently disappearing or showing Assessment: None.
• Monitoring tab reports now display content. The Reports panel now shows the actual markdown report body instead of an S3 path pointer for reports over 10 KB.
• Reports tab no longer stuck on ‘Loading report content…’. The Reports tab spinner no longer gets stuck after a deep-link reload when the report body was already cached.
• Sandbox readiness timeout raised to 300 seconds. Capability-heavy sandboxes (e.g. web-security + zero-day-research) no longer time out during startup.
• Cross-provider AIRT runs label the correct target model. The assessment UI now shows the target model instead of the attacker/orchestrator model for cross-provider runs.
• Bundled capability disable state now persists. Toggling off bundled capabilities (e.g. self-improvement) in the TUI correctly disables them on reload instead of silently reverting to enabled.
• Capability preflight checks now use the capability root as working directory. Checks referencing relative paths no longer fail with ‘No such file or directory’.
• Invitation links show Sign In prompt for unauthenticated users. Invitation links no longer show ‘Invalid Invitation’ — unauthenticated visitors now see a Sign In / Create Account prompt instead.
• BYOK OpenAI quota errors surface immediately. Agents using BYOK OpenAI no longer retry up to 8 times on insufficient_quota — the failure surfaces on the first attempt.
• save_workflow now detects silent overwrites. The tool verifies file writes succeeded and warns when content is unchanged, preventing agents from operating on stale workflow scripts.
• Hosted sandboxes page shows accurate active counts. Sandbox counts are now backed by a facets API that aggregates state correctly.
• Errored evaluation statuses tracked correctly. Errored statuses are now included in eval phase summaries instead of being silently dropped.
• TUI tool meta line no longer drops. Tool calls now display the ↳ <summary> meta line beneath the tool name instead of showing a blank gutter.
• TUI spinner stays visible when Esc drains a queued message. The spinner no longer disappears while a queued message is still running.
• TUI tool output wrapping stays within the gutter. Wrapped lines at narrow terminal widths now stay aligned under the gutter border instead of leaking to column 0.

May 14, 2026

Free-text search in evaluation trajectories

4 new6 improved12 fixed

Free-text search lands in hosted evaluation trajectories this week, alongside session rewind, cross-org capability share links, and sandbox dependency auto-install.

New

• Free-text search in evaluation trajectories. Matches are highlighted inline in hosted evaluation trajectories and tool calls auto-expand when their content matches the search term.
• Session rewind. Roll back a conversation to any prior user message via /rewind or double-Esc in the TUI — the full session history is preserved.
• Cross-org capability share links. Capability hub links now work across orgs — recipients are automatically redirected to the right page regardless of their org slug.
• Sandbox dependency auto-install. Sandbox runtimes can now automatically install Python packages and system dependencies declared in capability manifests at load time.

Improvements

• AIRT auto-discovery with updated capability counts. The AIRT CLI now auto-discovers attacks, transforms, and scorers at runtime (61 attacks, 547 transforms, 141 scorers), and capability counts in the hub accurately reflect these results.
• Simplified AIRT workspace layout. The AI red-teaming capability uses a cleaner ~/.dreadnode/airt/[org]/[workspace]/ workspace structure with improved error messages and input validation.
• Settings sidebar grouped into Personal vs Organization. Secrets and Chat Models are now clearly labeled as Personal, separate from Organization settings.
• AIRT assessments Details glossary consolidated. The Details section now shows a single glossary popover at the section header instead of three separate per-cell tooltips.
• Optimization job sidebar shows author email. The optimization job sidebar now displays the author’s email instead of a raw user UUID, consistent with Evaluation and Training job lists.
• Task name copy button. A copy-to-clipboard button next to the task name in the environment detail drawer makes it easier to grab long task names for CLI commands or evaluation setup.

Fixes

• AIRT CLI runs now appear in the platform UI. Assessment creation was silently succeeding without connecting to the platform; AIRT CLI runs now correctly appear in the UI and analytics.
• ModuleNotFoundError in UV tool and managed Python environments resolved. AI red-teaming workflows no longer fail with ModuleNotFoundError: No module named dreadnode in UV tool, container, and managed Python environments.
• TUI tool output and XMLModel serialization fixed. TUI tool output no longer gets clipped after completion, and XMLModel serialization no longer crashes on NUL bytes or ANSI escape sequences.
• ASR values display consistently as percentages. Attack Success Rate values now render as percentages across all AIRT views — no more mixed decimal/percentage formatting.
• All 15 AIRT goal categories now surfaced. The AI red-teaming agent now offers all 15 goal categories (including reasoning_exploitation, supply_chain, and resource_exhaustion) instead of only 9.
• Trace copy button restored on Safari. The trace copy button (rich and log views) now works correctly on Safari after breaking in v2.0.20.
• AIRT report generation no longer floods UI with toasts. Generating a report no longer triggers an infinite loop of ‘Report build failed’ toasts that locked the UI.
• Onboarding username now names the default workspace. Your chosen username during onboarding correctly names your default workspace instead of an autogenerated placeholder.
• Deep links to evaluation samples no longer show ‘sample not found’. Navigating directly to a specific evaluation sample via deep link now loads correctly.
• projects command in TUI scoped to current workspace. The projects TUI command now loads projects for the active workspace only.
• ProcessJudge no longer crashes on rubrics mentioning .yaml. Plaintext rubrics that reference a .yaml filename no longer trigger OSError: File name too long.
• Docs code blocks render -- flags with correct spacing. Geist Mono ligatures are disabled in docs code blocks, so dn --capability no longer renders as dn--capability.

Earlier updates

• May 7, 2026 — AIRT Report Builder now generally available with templates, branding, and DOCX export