Release Notes

What’s new in the Dreadnode platform — features, improvements, and fixes, published weekly.

What’s new across the Dreadnode platform — features, improvements, and fixes, published weekly. Subscribe via RSS.

August 2026

August 6, 2026

Model deployment visibility control

5 improved 6 fixed

Model visibility is now an explicit hidden attribute set by operators

Improvements

Model deployment visibility control. Model visibility is now an explicit hidden attribute set by operators, replacing the previous name-prefix convention — hidden models are excluded from pickers, member grants, and SDK keys.
Agent output stat cards as filter toggles. The “Needs review” and “Critical + High” stat cards on the Agent Outputs page are now clickable filter toggles, and the items grid has a new sortable “Updated” column.
Self-hosting configuration docs overhauled. Self-hosting docs now provide consistent, copyable configuration guidance across the Helm, Admin Console, and KOTS ConfigValues install paths.
Media gallery color coding. Media preview and the session media gallery now use color coding by media kind and an improved layout.
Agents Charts subtab removed. The Agents Charts subtab has been retired; existing links redirect to the Sessions list, which already surfaces the same information accurately.

Fixes

E2B detached commands now run to completion. E2B sandboxed runtimes no longer terminate mid-generation after ~40–45 seconds; detached commands run to completion.
DataGrid no longer overwrites results with stale responses. Rapid filter, sort, or pagination changes no longer cause the table to flash back to outdated data — only the latest server response is applied.
Session Media tab no longer shows “No media” when media exists. A bad ClickHouse filter on an always-empty column was silently dropping all media results; the Media tab now returns correct results.
”+ New Workspace” stays pinned at the bottom of the workspace switcher. The entry no longer floats upward regardless of how many orgs or workspaces you belong to.
Webhook connection creation no longer returns a 422 error. Creating a webhook connection in Org Settings → Integrations now completes successfully.
Actionable hashcat error on GPU-less environments. The hashcat tool now returns a clear error directing agents to use john_the_ripper with the correct hash format instead of an opaque failure.

July 2026

July 30, 2026

Agent memory, triage, and session monitoring overhaul

9 new 14 improved 15 fixed

A new Memories UI, five data-integration connectors, session monitoring improvements, and a wave of Agent Output quality fixes make this a wide-ranging release.

New

Agent memory viewer. A new Memories page under Agents lets operators view, inspect, and manage project memory entries — including version history and diffs — directly in the UI.
Data-integration connectors. Five connectors — Atlassian, Azure DevOps, GitHub, GitLab, and Linear — are now available as capabilities on the platform.
Inactive session filter. Agent Sessions now has an ‘Inactive’ filter to isolate sessions that are idle (past 15 min) but not archived — previously these couldn’t be separated from active sessions.
TUI built-in bug reporter. The TUI now has a built-in bug reporter (/report-bug or r in console) that assembles a privacy-reviewed diagnostic bundle and submits it without losing logs after a crash.
Hub sync for air-gapped on-prem. New dn capability sync and dn task sync commands support pulling hub content from SaaS (or another on-prem) into a local directory and pushing it to a self-hosted instance, enabling air-gapped on-prem loading.
llm-wiki and analysis-ledger capabilities. Two new capabilities are now available: llm-wiki (compiles source material into linked wiki pages) and analysis-ledger (maintains a resumable code-analysis frontier with evidence-bearing claims).
AST-based JS/TS static analysis in web-security. The web-security runtime now includes ast-grep, enabling AST-based JS/TS static analysis without requiring semgrep, CodeQL, or a jxscout license.
Models and Datasets table view in Hub. Models and Datasets browse pages now support a table view alongside cards, and all four Hub browse pages share a unified toolbar with separate sort and filter controls.
Findings Can Now Be Triaged Directly in Agent Output. Reviewers can now set a finding’s status and add notes directly from its detail panel in Agent Output, so findings can be triaged in the same place they’re reviewed.

Improvements

Session monitoring redesigned. Session monitoring now shows a Last Msg column with relative activity time, highlights sessions active in the last 15 minutes, and adds forward/backward transcript pagination with tailing mode.
Unified tooltip system. Hover tooltips across the app are now faster, consistent, and keyboard-accessible — replacing unreliable native browser tooltips with a unified tooltip system.
Agent Output triage UX improvements. Stat cards for ‘Needs review’ and ‘Critical + High’ on the agent outputs page are now clickable filter toggles, and the items grid has a new sortable ‘Updated’ column.
Transcript message body legibility. Transcript message bodies in session views are easier to read, with improved layout and rendering for tool events and message content.
Sessions group-by available to all orgs. Sessions group-by control is now available to all orgs, with simplified options (None / Workflow / Capability / Agent / Source) and workflow runs collapsed by default.
New workspace dialog org picker. The ‘New Workspace’ dialog now includes an organization picker, so you can create a workspace in any org without switching context first.
Automatic Agent Output recovery at session freeze. Agent Output items from failed report_item POSTs are now automatically recovered from span backups when a session is frozen, without requiring manual operator intervention.
CLI skill task discovery and BYOK model resolution. The CLI skill agent can now discover tasks by name and resolve BYOK models by looking up stored API keys via dn secret list.
Hub filter and sort label consistency. Hub filter and sort labels are now consistent across Models, Datasets, Capabilities, and Tasks/Environments — e.g. ‘Keywords’ renamed to ‘Tags’, sort options formatted as ‘Name: A-Z’.
Agent Output documentation. Agent Output docs now cover CSV export (including the 10,000-row limit), the type selector UI, correct report_item call signatures, and the ref uniqueness constraint with a namespacing workaround.
Credit pricing documentation. The Credits documentation has been rewritten to clearly explain how hosted inference consumes credits, with a worked example and BYOK billing distinctions.
Self-hosting docs restructured with TLS guide. Self-hosting docs now include a dedicated TLS guide, focused configuration pages for external data stores, sandbox runtime, and auth/email, plus fixes for 15 verified inaccuracies; markdown tables now render correctly sitewide (previously broken on 109 pages).
Private-CA client trust documentation. Self-hosting docs now include copy-pasteable instructions for connecting the CLI, TUI, and SDK to private-CA or self-signed HTTPS deployments without disabling certificate verification.
Mermaid diagram rendering restored in docs. Mermaid diagrams on the self-hosting architecture and model-deployments docs pages now render correctly instead of showing raw flowchart source.

Fixes

Enterprise LiteLLM provisioning idempotent. On-prem enterprise deployments no longer lose access to all dn/* models after the first use — repeated LiteLLM key provisioning now succeeds reliably.
On-prem config combinations unblocked. On-prem installs combining external PostgreSQL with the bundled LiteLLM proxy now deploy successfully; previously 64 of 256 Admin Console config combinations failed at deploy time.
Triage reversible and notes-independent. Triage status on Agent Output findings can now be cleared (returning items to ‘needs review’), and adding notes no longer silently marks a finding as triaged.
Concurrent item writes no longer race. Concurrent writes to the same item no longer race on event sequence allocation, eliminating 500 errors and dropped audit events under load.
Custom capability item types accepted. Custom capability item types (e.g. from report_item) no longer get rejected with a 400 error after the capability has been pushed to your org.
Trace-backed item rebuild functional. POST /items/rebuild (trace-backed recovery for structured agent output) now works correctly — previously it 500’d before returning results due to multiple independent defects.
Runtime token recovery after cold-start timeout. Runtime tokens are no longer lost when start_runtime times out during a cold start — the SDK now reconnects and retrieves a valid token automatically.
Self-hosted resource preset respected. Self-hosted API pods now correctly inherit global.resourcesPreset; previously, a hardcoded ‘large’ preset overrode customer-selected sizing for every on-prem deployment.
Session URL params preserved across refresh. Refreshing or sharing the Agent Sessions view now preserves the selected session and report — the ?session and ?report URL params no longer get dropped on page load.
Resumed headless session transcripts update live. Resumed headless agent sessions now show the latest transcript data without requiring a full browser refresh.
Selected project retained when switching to Agent Output. Navigating from Agent Sessions to Agent Output now retains the selected project instead of resetting to default.
Column selector hides any column without resetting state. Column selector on Agent Output type tables now correctly hides columns like Severity and Status, and toggling columns no longer resets your sort or triggers an extra data fetch.
CSV exports named by workspace, project, and type. Agent Output CSV exports are now named agent-output-{workspace}-{project}-{type}-{date}.csv instead of a generic finding.csv, so downloads from different projects no longer collide.
Eval output excluded from Agent Output and Sessions views. Eval run output no longer appears in Agent Output or Sessions views; an empty Sessions list now explains when a project’s sessions were deleted or archived.
Admin Settings button persists after profile changes. Platform Admin Settings button no longer disappears after updating your profile name or username — no logout required.

July 23, 2026

Traditional-ML red teaming suite — evasion, extraction, membership inference, and model inversion in one platform

13 new 10 improved 18 fixed

Four traditional-ML attack families — evasion, extraction, membership inference, and model inversion — land in AIRT this week alongside a new CLI, five runnable demo notebooks, and a comprehensive Learning Guide.

New

Traditional-ML red teaming: evasion, extraction, and membership inference. Run 20+ named attacks (equation-solving, Jacobian, copycat, knockoff, PWWS, BAE, TextBugger, threshold, label-only, and more) against classifier APIs across tabular, image, and text modalities, with per-finding metrics, adversarial trajectory traces, and MITRE ATLAS/SAIF/NIST compliance mappings.
Agent Output Becomes a Severity-First Triage Workspace for Findings. Agent Output now searches, sorts, and filters an entire engagement’s findings, leading with severity so the most critical results surface first. Each finding renders from its capability’s own schema with labeled fields, and can be exported to CSV, deep-linked, or copied straight into a report.
A New Gallery Gathers a Session’s Captured Media in One Place. Images and other media logged by a session’s tools now appear together in a dedicated gallery, so reviewers can find visual evidence in one place instead of scrolling through the entire session.
Model inversion attacks (4th traditional-ML attack family). Reconstruct class-representative inputs via black-box queries to surface privacy risks — available now as the fourth traditional-ML attack category in AIRT.
Executive/CISO summary for traditional-ML assessments. A new summary panel on the assessment view shows attack-surface posture, query cost to compromise, risk score, and a plain-English headline for stakeholder reporting.
Richer privacy-attack metrics in findings. Extraction findings now include KL divergence and accuracy retention; membership inference includes attack accuracy, precision, and recall; model inversion includes reconstruction quality — all correctly persisted to the finding record.
dn airt run-classifier CLI command. Run classic-ML attacks (evasion, extraction, membership inference, model inversion) against a predict endpoint directly from the CLI without writing SDK code.
AIRT demo notebooks. Five self-contained notebooks cover model evasion, extraction, membership inference, jailbreaks, and multi-agent attacks — run on Dreadnode-managed models with just dn login, no provider keys or environment setup required.
AI Red Teaming Learning Guide. Eight new docs pages cover all four traditional-ML attack categories and generative AI attacks, with runnable SDK, TUI, and CLI examples throughout.
Evaluation runtime component health recording. Eval items now record the health of all runtime components (broken tools, skills, policies) at run time, so you can see after the fact whether a degraded capability affected results.
Eval agent selection via --agent. Specify which agent runs in an evaluation with dn evaluation create --agent <name>; eval output reports which agent actually ran.
Web-security initial-recon skill. Structured reconnaissance for domain, wildcard, ASN, IP-list, and CIDR entry points using the ProjectDiscovery toolchain is now available as a new initial-recon skill in the web-security capability.
Configurable project memory preload limit. Set the number of memories preloaded at session start (1–200) via --project-memory-preload-limit instead of accepting the hardcoded default of 20.

Improvements

AIRT assessment overview: charts and summary cards for all four attack families. The overview page now shows horizontal ASR bars (long attack names readable), Surrogate Fidelity, Membership AUC, Perturbation Distance, and Reconstruction Confidence by Inversion Attack charts; evasion and inversion summary cards match extraction and membership; the finding edit modal covers all traditional-ML finding types; and 0% ASR renders as neutral across charts and heatmaps.
AIRT finding detail: richer data across all attack categories. Membership findings show actual records with TP/FP/missed-member outcomes; text evasion reports Levenshtein edit distance; extraction findings clarify surrogate export status; per-category metrics (fidelity, query efficiency, AUC, inversion confidence) that were previously computed but not displayed are now visible.
Redesigned evaluation run header. The eval run header is rebuilt around an input-vs-measurement hierarchy — a three-band layout (Identity / Measurements / Configuration) with distinct visual weight makes run outcomes, scores, and configuration easier to read at a glance.
Web chat session list and session pages load faster. Covering indexes reduce shared buffer hits from 1008 to 14 on large session tables; parallel load paths, scoped invalidation, and memoized markdown rendering cut frontend latency; degraded-mode error handling prevents full failures when a transport connection drops.
Task-set member picker select-all. A “Select all N matches” control pages the full filtered catalog in one click, replacing the previous 25-item display limit.
Agent output descriptions render markdown. Descriptions and disposition notes in the Agent Output view now render markdown (code spans, bold, links) instead of showing raw source text.
TUI links to Agent Output in the web app. The TUI now shows a clickable “Open Agent Output in browser” link on each reported item and at the end of any turn that produced output.
Agent Output empty states. The Agent Output page shows “No results match these filters” with a Clear filters button when filters return nothing, and a retry button when item types fail to load — replacing the bare ag-grid “No Rows To Show” message.
Session and transcript header legibility. Session headers in the monitoring workspace are redesigned with cleaner layout and improved title display; transcript message headers get a new layout with per-message collapse and copy controls.
TUI model picker page scrolling. Ctrl+↑/↓ now scrolls by page in the model picker — the shortcut is shown in the bottom bar, and the previous freeze-until-modifier-released behavior is fixed.

Fixes

Capability Python dependencies now install on E2B sandboxes. Capabilities declaring dependencies.python were silently skipping all package installs on SaaS (E2B) sandboxes, causing every tool call importing those packages to fail at runtime — fixed and hardened.
Content-filtered and truncated generations surface a warning instead of hanging. When a model response is blocked by a content filter or truncated, the TUI, frontend, and SDK now show what happened rather than appearing to hang indefinitely.
On-prem interactive agent sessions are restored. The runtime image is now published to Docker Hub and included in airgap bundles — on-prem installs can start interactive agent sessions again.
Capability bindings re-resolve on every eval run, with race condition fixed. Unpinned refs now track the latest published capability version and explicit version pins are no longer silently ignored; a concurrent-run race condition that could execute the wrong capability version is also closed.
ATLAS correctly credits success when a dangerous tool executes. ATLAS now credits a successful attack when a dangerous tool actually fires, even if the judge scored low or errored — fixing false-negative ASR 0 results on real attacks.
Assessment summary tiles now match the findings table. Total Attacks, Actionable Findings, and ASR tiles are reconciled against actual findings, eliminating contradictory values (e.g., “Actionable Findings 0” alongside a visible MEDIUM finding).
Broken capability components now appear as degraded in runtime health. Hooks, tools, policies, skills, and MCP components that fail to load are recorded as degraded instead of silently disappearing, making it possible to diagnose why a hook never fires or a tool is missing.
GET /api/runtime no longer returns 500 for capabilities with a policies/ directory. Capabilities shipping a policies/ directory no longer cause the runtime health endpoint to error, restoring component health reporting across all such capabilities.
Bare attack.run() inside an Assessment now links trials and reports real scores. Previously, bare attack.run() inside an Assessment context produced 0 score and incorrect metadata even when a jailbreak was found — now correctly links trials and carries the best score.
Multimodal attack trials now report correct counts and analytics. Multimodal red-teaming attacks that previously always showed 0 finished trials now correctly collect results via assessment.run().
--resume restores the session’s model selection. Resuming a session with dn --resume <session-id> now correctly restores the model that was active in the original session instead of silently falling back to the app default.
Eval transcripts now appear for failed tasks. Messages were silently dropped when an agent raised an exception mid-turn; transcripts now flush correctly even when a chat turn fails.
Session search by ID now returns results. Searching agent sessions by session ID or 8-character prefix returns the matching session instead of no results.
Extraction attack fidelity is now accurate. Query pools are shuffled before the eval/train split so class-ordered inputs no longer produce unrepresentative eval sets; ActiveThief no longer crashes with surrogate=None when the eval probe exhausts the full query budget.
label_only_membership raises a clear error on text targets. Instead of crashing with ValueError: could not convert string to float, it now raises an actionable message explaining the incompatibility.
Transient 404s during task-environment provisioning no longer abort the session. The SDK now retries past transient 404s when polling task-environment status, fixing provisioning failures in multi-replica deployments.
dn airt run now displays correct transform names. The CLI was printing Transforms: Transform, Transform instead of the actual names passed by the user (e.g., base64, leetspeak).
Docs: traditional-ML guide fixes. Text {input} values in request templates must be quoted to avoid invalid JSON — this is now documented; the boundary-evasion image example also correctly shows how to fetch and pass a real image sample.

July 16, 2026

Agent Output available in beta for all orgs

13 new 10 improved 23 fixed

Slash-command palette in the web chat composer. Typing / opens a fuzzy-filtered overlay with built-in actions (/new, /clear, /rewind, /model, /agent, and more) plus dynamically-discovered skills.
@-mention agent picker in the chat composer. Type @ to open an inline agent picker navigable by keyboard or mouse; selecting an agent inserts it as a mention in your message.
/background launcher in the web chat composer. Type /background <task> (or /bg) to spin up a headless session without leaving your current conversation.
Chat session interface overhaul. New tool renderers (glob, grep, read, query, web search), an improved session header, capability picker, and read-only session notices ship in the web chat.
Improved model selector in chat. A ‘manage models’ button now lives inside the selector, model settings are consolidated into one table, and the add/remove flow has new tooltips and UX affordances.
“Agent Output” replaces “Structured Output” throughout the UI. The nav item, route (/agents/agent-outputs/), and all references are renamed; severity sorting is now case-insensitive so CRITICAL/Critical items rank correctly.

The web chat composer gets a full command surface this week: type / for a fuzzy-filtered slash-command palette and @ to pick an agent inline — matching the TUI experience in the browser.

New

Agent Output available in beta for all orgs. Agent Output is available in beta for all orgs including on-prem/enterprise, with beta labeling in the UI and new documentation.
ATLAS multi-agent attack framework. The SDK’s dreadnode.airt.atlas module runs multi-agent campaigns against deployed environments across eight attack modes using a MDP+Hedge router; executed tool calls are captured per-trial and surfaced in findings across the UI, API, and SDK.
Comprehensive multimodal transform library (170 image/audio/video). The SDK now ships 130+ image, audio, and video perturbations for red teaming vision and audio/video models, covering ImageNet-C corruptions, AugLy augmentations, SpecAugment, and published jailbreak techniques (FigStep, DolphinAttack).
AI red-teaming TUI exposes 131 multimodal transforms. Exposed media transforms grow from 26 to 131 (57 image, 52 audio, 22 video), including ImageNet-C corruptions, SpecAugment masking, and DolphinAttack-style audio attacks.
LiteLLM bundled for on-prem inference. Enterprise/self-hosted installs can enable LiteLLM via a new bundled Helm subchart, giving on-prem deployments access to dn/* models, TUI/chat inference, and the Admin Model Deployments surface.
E2B as a first-class on-prem sandbox provider. Self-hosted installs can now configure E2B via KOTS toggle — set your API key, pick the published template, and task-based evaluations work out of the box.
--max-steps budget on evaluation runs. dn evaluation create and evaluation.yaml now accept --max-steps / max_steps: for reproducible cost control independent of model latency.
AgentMail email inbox integration for web-security agents. Agents can now manage email inboxes via AgentMail — list/create inboxes and list, get, send, or reply to messages.
AWS SageMaker and Nova Sonic target docs. New docs cover probing AWS SageMaker (including SigV4 auth, multimodal attacks, raw audio endpoints) and AWS Nova Sonic (bidirectional speech-to-speech streaming). AWS/Nova Sonic deps are now bundled in core — no extras needed.
Azure AI Foundry multimodal target docs. New docs page covers probing Azure AI Foundry / Azure OpenAI multimodal deployments (text+image, text+audio) with the SDK and TUI.
Self-hosted architecture documentation. A new architecture page documents the Kubernetes/Helm topology, network requirements, trust boundaries, and optional external services for on-prem deployments.
Internal Network Engagements Now Run End-to-End Through Specialized Agents Automated internal-network and Active Directory engagements now run through a pipeline of specialized agents — from discovery through exploitation, credential harvesting, and reporting — with new lateral-movement and coercion tools for deeper attack paths.
Out-of-Band Vulnerability Testing Now Runs Without External Tooling Detecting blind vulnerabilities such as blind SSRF now works without any external tooling, with automatic provider fallback keeping tests reliable.

Improvements

Session sharing UX and deeplink. Agent session sharing now shows a popover with plain-language visibility state (Private / Shared with workspace) and a copyable deeplink.
Worker grouping headers enriched in Agent Sessions. Grouped session views now show live count, total, last activity, and a notice when grouping covers only the current page.
Assessment findings automatically carry target/judge model metadata. dreadnode.airt infers target and judge model info from configs so findings are populated without manual annotation; Nova Sonic raises a clear install hint immediately if streaming deps are missing.
DataGrid rows use border separation instead of zebra striping. Rows now separate via borders with a clearer active-row indicator and improved hover/selected states.
Caido SDK client preferred over MCP. Web-security agents now use the direct caido-sdk-client Python library when importable, reducing per-call overhead and improving routing accuracy.
Wordlists provisioned for password cracking at install time. The network-ops capability now ships rockyou.txt, SecLists 10k-most-common.txt, and OneRuleToRuleThemAll.rule at install time so hashcat and john_the_ripper work out of the box.
TUI agent picker shows locally installed capability version. The Ctrl+A agent picker now displays the locally installed version of each capability next to its name.
On-prem docs: first-model setup steps and platform-administration page. Install guides now include first-model setup steps, a new platform-administration page consolidates admin workflows, and stale SaaS-only model claims are corrected.
AI Red Teaming docs reorganized with a How-to guides section. Multimodal Red Teaming moves to the new section with a redirect from the old URL; Azure judge rubric tightened to avoid false-positive jailbreak scores on deflections.
Project metadata editor keyboard navigation and inline validation. The editor now supports keyboard navigation with revert/rollback on cancel.

Fixes

Filter popover no longer freezes the UI on large orgs. Filter rows are capped at 100 with search to find additional values; 3,000 facet values drop from 182 ms to 15 ms render time.
spawn_agent no longer hangs on sub-agent failures. Errors are now surfaced and a 900 s timeout prevents infinite waits.
Agent sessions no longer get stuck in an unrecoverable 400 state. Tool-call repair at the provider boundary handles compaction splits and orphaned tool messages from mid-run cancellations; duplicate or blank tool-call IDs are also sanitized.
No-arg tools now include the required parameters field. Fixes 400 errors on Together AI, DeepInfra, and other strict providers that require parameters even when empty.
llm_judge with dn/* models no longer silently scores 0.0. Routing now goes through the platform gateway correctly instead of raising a BadRequestError and returning a false-negative score.
pitch_shift transform no longer fails 100% of the time. An un-awaited coroutine caused every execution to fail with AttributeError; it now runs correctly.
SageMaker SigV4 multimodal targets work end-to-end. Three root-cause bugs (missing boto3, unresolved image paths, unsubstituted template placeholders) that silently produced zero real trials are fixed.
Web-security capability now emits structured findings. report_item is correctly offered to the agent so typed findings (web_vulnerability, web_endpoint) appear in the app instead of silently falling back to the generic report tool.
Impacket tools in network-ops install and resolve reliably. Multiple fixes address ModuleNotFoundError and FileNotFoundError across uv-managed runtimes, Python version mismatches, and false-positive script path detection; impacket_atexec and impacket_dcomexec drop the unsupported target_ip parameter for impacket 0.13.x compatibility.
Combined NTLM relay attack tool and certipy_find signature fix. New impacket_ntlmrelay_attack combines relay and coercion into a single call; certipy_find now takes structured params (breaking change for agents using the old args=[] form).
Generated ATLAS and agentic campaign scripts no longer crash with NameError: get_generator. Missing import is now included in both ATLAS and agentic-mode generated scripts.
atlas_attack objectives parameter is now optional. Omitting it defaults to one objective per OWASP-ASI category instead of raising a TypeError.
Sandbox provider unreachability no longer 500s all API endpoints. Non-sandbox endpoints stay online; sandbox-specific endpoints return 503; org/user endpoints are also correctly excluded from the degraded path.
Model deployment names without dn/ prefix now fail loudly. Admin API returns HTTP 400 instead of silently making the deployment invisible.
Task-based evaluations on unsupported providers return a clear error upfront. Providers that don’t support template builds (e.g. OpenSandbox) now return HTTP 400 at submission instead of failing silently mid-run.
Session exports record the correct model. Empty model strings from the agent definition no longer overwrite the user-configured model in trajectory exports.
TUI session browser placeholder and Ctrl+O deep-link fixed. Project filter shows a real example in the placeholder; Ctrl+O opens the correct URL instead of a 404.
TUI reasoning blocks truncate in compact mode and wrap correctly. Reasoning now truncates to 6 lines in compact mode (expand with ^O); wrapped lines no longer lose their gutter indent.
dn CLI no longer crashes on exit after /quit. Orphaned ThreadPoolExecutor threads are now drained on shutdown.
TUI no longer leaks reasoning traces from previous sessions. All conversation widgets are cleared on /new or session switch.
Agent session deep links load correctly instead of showing empty client data.
Oversized SVGs render correctly in the agent session view. Previously showed a broken image icon.
dn/ models tip in docs corrected. dn/ models are zero-setup and billed to your Dreadnode account — DREADNODE_LLM_BASE and DREADNODE_LLM_API_KEY are not required.

July 9, 2026

End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces

14 new 5 improved 14 fixed

Structured findings and assets in the platform. Agents can emit structured vulnerabilities, endpoints, and other typed items during runs — viewable in a new Structured Output page with per-type tables, detail panels, and provenance history. Web-security agents now produce WebVulnerability and WebEndpoint items visible in the Items UI for triage, filtering, and cross-session tracking.
Web chat — interactive/autonomous mode toggle, rewind, and session actions. Web chat sessions now support an interactive ↔ autonomous mode toggle with optional step cap, a “Rewind to here” control on any prior user message, and a full action menu (copy ID/link, export trajectory, archive/freeze/delete) directly from the session list.
Web chat — inline human-input prompts, live tool media, and reasoning-effort selector. The web chat transcript now surfaces ask_user prompts inline, renders live tool media during streaming, and exposes a reasoning-effort selector in the composer.
Chat UI promoted to main navigation. Web chat is now accessible from the main sidebar navigation instead of the previous beta route.
Session compaction rendered as a labeled divider in web chat. Compaction events now appear as a divider with an expandable summary of how many messages were summarized, instead of leaking raw XML into the transcript.
Agent sessions default to no grouping. The Sessions page now defaults to ungrouped; workflow grouping is still available in the selector.
Unified produces key for capability manifests. A single produces key now configures built-in item types, custom types, and disablement — replacing the older items key.
Chat sandbox no longer auto-pauses mid-session. A periodic keepalive extends the runtime’s expiry every 30 seconds while you’re actively working.

Full multimodal support lands in AI red teaming this week — probe vision, audio, and video targets end-to-end, with media rendering inline across findings, traces, and exports.

New

Multimodal AI red teaming — end-to-end. Probe LLMs with text, image, audio, and video inputs; apply per-modality transforms; score outputs (including generated media) with the new multimodal_judge scorer; view full message parts inline in findings, traces, and parquet exports (new schema v3 with base64 media columns). Includes a cross-product prompt_matrix mode (N prompts × M media items = N×M trials) and Nova Sonic speech-to-speech target support.
Custom HTTP targets for AI red teaming — any cloud, any auth. New build_target(TargetSpec) factory and custom_http target mode let you point TAP, PAIR, and other attacks at any endpoint (Azure, Vertex, SageMaker, Bedrock, OpenAI-compatible, arbitrary URLs) with declarative auth strategies (API key, Bearer, AWS SigV4, Azure AD, GCP).
Per-modality response scores in the platform. Findings and Assessment Findings tables now show independent scores per output modality (text, image, audio, video) with the highest-scoring modality emphasized.
Session groups and workflow hierarchies. Multi-session agent runs are now organized into collapsible workflow groups in the Sessions view instead of a flat list; the SDK exposes a new client.workflow() API.
Model reasoning as a first-class field in session transcripts and trajectory export. Native reasoning content (Anthropic thinking blocks, reasoning_content) now appears in the session transcript viewer and ATIF trajectory export as a typed field rather than being silently dropped.
SecurityContext MCP server for web-security agents. New MCP server lets agents mine commit history and CVE disclosures to generate hunting briefs, top risks, and ranked vulnerability leads before auditing a codebase — three tools: get_security_context, create_security_context, get_vulnerability_leads.
Three new web-security skills. Added git-integration-exploitation, http-query-method (RFC 10008 parser differentials), and dom-vulnerability-detection (postMessage IP normalization bypass).
Hub scope tabs — Mine · {org} · Public. Dataset, Model, Capability, and Environment browse pages now have scope tabs with live count pills and scope-aware empty states.
Bundle README surfaced in frontend, TUI, and CLI. Capability and task detail pages now include a README tab; the TUI exposes it with d; the CLI adds --readme / -R to dn capability info and dn task info.
Auth-setup-guide skill for AIRT. New skill walks you through authenticating target, attacker, and judge models from your own environment — covering Azure, AWS Bedrock, GCP Vertex, custom HTTP endpoints, and more.
multimodal_judge scorer. New scorer evaluates generated images, audio, and video using a vision/audio-capable model instead of stringifying media output.
dreadnode[nova-sonic] SDK extra. Install the new extra to get all required AWS deps for Nova Sonic speech-to-speech targets; missing deps now raise a clear error instead of an opaque import trace.
AIRT multimodal output capture and per-modality scoring. All output modalities (text, image, audio, video) are now captured from target models, with per-modality worst-case MAX score aggregation, and audio/video playback fixed in the trace viewer.
Nova Sonic S2S target support in the TUI and AIRT SDK. Nova Sonic speech-to-speech targets are now available in the TUI capability picker and the SDK’s build_target factory.

Improvements

Multimodal AIRT findings layout — Original → Transformed → Response. Findings now display a clean three-panel message layout with judge model, transformed prompt, and inline trace media shown correctly.
Model reasoning always visible inline in TUI and web session viewer. Reasoning now appears as always-visible inline prose; ^O controls tool-output verbosity only and no longer hides reasoning blocks.
AIRT findings ranked by severity. Critical findings now surface first in the findings list.
Improved dn update diagnostics. The CLI and TUI now show accurate resolver-failure details when dn update exits without changing the installed version.
Org, workspace, and project names enforce 100-character limit. Name inputs now validate length as you type, preventing overflow and submission errors.

Fixes

SDK installable again — MoviePy moved to dreadnode[video] extra. dreadnode 2.0.32+ is installable from PyPI; the Pillow/MoviePy conflict is resolved by making MoviePy optional.
spawn_agent no longer hangs indefinitely. Sub-agents now have a default 1-hour timeout (configurable); the undocumented run_in_background field has been removed.
Native reasoning now reaches the client on dn/ proxy routes. Thinking blocks and reasoning_content from Claude and other reasoning models were previously silently dropped on platform proxy routes.
Nova Sonic adapter no longer hangs on missing AWS credentials. The adapter now resolves credentials via the standard AWS chain (env, profile, SSO, IMDS) and fails fast with a clear error, eliminating the 9+ minute hang.
Multimodal AIRT findings show real errors instead of “(no response)”. When a target call fails (e.g. auth 401, bad model ID), the actual error is surfaced so failures are distinguishable from genuine model refusals.
AIRT trial counts, missing responses, score tooltips, and trace deep-links fixed. Trial counts display correctly, missing responses fall back to trial data, tooltips work on score columns, and silent refusals show a descriptive message.
Judge reasoning now appears in finding headlines and markdown exports. Previously blank even when trial-level reasoning was present; root cause was reading from the study-level span instead of the trial span.
Judge LLM field on assessment-detail header shows model name. Previously displayed ”—” for multimodal assessments.
AIRT compliance dashboards show correct denominators. OWASP LLM Top 10 now shows /10 and NIST AI RMF shows /4; multimodal media in trace spans renders inline instead of as raw JSON.
AIRT multimodal video, audio playback, and per-trial message blocks fixed. Video input, audio playback, and judge reasoning work correctly; findings tables show per-trial message blocks instead of a single best-trial view.
AIRT multimodal view shows correct attacker prompt on failed trials. Previously showed the wrong prompt; media downloads now save to disk instead of opening inline, and trial scores carry clearer “Overall Score” labeling.
TUI model picker cursor no longer jumps when filtering. Cursor now stays at the top of filtered results instead of jumping to the bottom.
TUI first-run defaults to a platform-hosted model. New users without a personal Anthropic API key no longer hit an immediate failure on TUI startup.
Network-ops tool wrapper bugs fixed. Four confirmed bugs resolved: smbclient preserves partial directory listings, netexec handles multiple groups in enumeration, SharpView correctly parses arguments with spaces, and Impacket script discovery works with bash wrapper scripts.

July 2, 2026

Claude Code engine — run Claude's agentic loop as a governed, session-backed agent

6 new 5 improved 14 fixed

Agents get a pluggable execution engine this week, with Claude Code shipping as the first built-in option alongside a full suite of transcript fidelity and eval reliability fixes that make it production-ready.

New

Pluggable agent engine + Claude Code harness. Agents now support swappable execution engines; the built-in Claude Code engine runs Claude’s agentic loop as a first-class, governed, session-backed agent with full trace viewer support.
Task Sets. Tasks can now be grouped into named, versioned collections and run as a single evaluation target via the API, dn task-set CLI commands, or the Environments UI.
User-controlled task-environment models. You can now choose which model a task’s environment (defender) uses per role via --env-model role=id in the CLI, model_overrides in evaluation.yaml, or the API — independently of the solver and judge models.
Evaluation sample search. You can now search across all samples in an evaluation by free text — matches are highlighted with per-sample counts, and a “Matches only” filter collapses non-matching samples.
Blind SQL injection extraction skill. A new blind SQLi extraction skill and tool in the web-security capability supports boolean/timing-based oracle identification, WAF bypass patterns, and automated char-by-char extraction.
Blind SSRF chains with attacker infrastructure provisioning. The blind-SSRF-chains skill now guides agents to detect available cloud CLIs and provision attacker infrastructure (S3 buckets, redirect servers) for SSRF proof-of-concept evidence.

Improvements

Task-set provenance on evaluation detail. Evaluation detail now shows the linked task-set org/name and a collapsible list of skipped members with reasons when an eval was run from a task set.
Usage summary in headless print mode. dn --print now outputs a model, tokens, tool calls, and cost summary to stderr after each run, matching the cost visibility available in the TUI.
Sub-agent costs in TUI footer. The TUI footer now shows sub-agent LLM costs as a separate “subagents $X.XX” segment so total spend is no longer understated when using spawned sub-agents.
Bare --resume opens session picker. dn --resume (or -r) with no argument now opens the session picker instead of erroring, matching the UX of Codex and Claude.
Chat runtime reliability overhaul. Sandbox state management is simplified and the chat page handles runtime lifecycle more reliably, reducing spurious disconnects and state loss.

Fixes

AIRT assessments no longer stuck in pending/running. Assessments stuck indefinitely are now automatically finalized after a configurable timeout (default 2h), and a one-time migration clears the existing backlog.
AIRT overview page 500 errors resolved. The AIRT project summary endpoint no longer intermittently 500s (~58/hr) due to a closed database transaction.
Eval task timeout now respects org ceiling. Evals no longer fail at provisioning when --task-timeout-sec is unset; the runtime is capped to your org’s ceiling, and an over-ceiling value returns a clear 400.
dn/* model IDs work in AIRT runs. All three AIRT model roles (attacker, judge, and target) now correctly route through the LiteLLM proxy instead of failing with “LLM Provider NOT provided.”
TUI conversation scrolling is smooth. The viewport no longer jumps when new messages arrive, and scroll performance is significantly improved for long conversations (~129 ms/step → ~47 ms).
TypeScript files no longer sent as video. The SDK read tool no longer crashes generation when reading .ts/.mts files — they’re now correctly identified as text.
Image content no longer fails text-only models. Text-only models (e.g. via OpenRouter) no longer fail with a 404 when a tool returns image content — the SDK substitutes a textual description and retries automatically.
MCP tool calls retry transient failures. MCP tool calls now retry once on dropped connections or subprocess crashes instead of immediately marking the server unavailable.
MCP shutdown no longer emits noisy warnings. The MCP client no longer logs “Task exception was never retrieved” on shutdown when the subprocess or remote server has already exited.
Unique browser session names required for web-security agents. Concurrent web-security agents no longer clobber each other’s browser state — the --session <name> flag is now required.
Agents page defaults to no session grouping. The sessions page now defaults to no grouping instead of grouping by workflow instance; workflow grouping remains available in the selector.
Claude Code engine transcript fidelity. Transcripts now show the initiating user message and correctly link tool call outputs to their calls; orphaned tool results and lost calls from burst-emit engines are fixed.
Engine-override eval sessions no longer hang. Evaluations using --engine claude-code no longer wait indefinitely for tool approval that never arrives.
Eval task timeout respects org ceiling. Evals with an unset --task-timeout-sec no longer fail at provisioning due to exceeding the org’s 6h ceiling.

June 2026

June 25, 2026

Analytics query and notebook UX overhaul

3 improved 1 fixed

A full web chat interface for project runtimes lands this week, alongside capability management and rich tool-call rendering.

Improvements

Analytics query and notebook UX overhaul. The analytics query and notebook pages now include empty states, a stats summary strip, loading skeletons, inline error banners, schema column insertion, and example query chips.
Web-security agent project memory. The web-security agent now persists reconnaissance findings, gadgets, leads, defense bypasses, and discoveries across sessions using structured project memory.
Hide revealed media in tool results. Revealed images in tool results and logged outputs can now be re-hidden — clicking Hide removes the image from view and frees the decoded blob from memory.

Fixes

AIRT project overview crash on non-finite values. The AIRT project overview no longer returns a 500 error for projects with a stale running assessment that produced NaN or Infinity values in its snapshot.

June 18, 2026

Tool media evidence in session transcript

6 new 7 improved 12 fixed

Agents can now persist and retrieve durable project-scoped memory across runs with the new ProjectMemory tools.

New

Tool media evidence in session transcript. Screenshots and other media logged via dn.log_output() inside tools now render inline in the session transcript next to the tool call that produced them.
Unified LiteLLM admin proxy and model browser. Admins can manage LiteLLM model deployments and credentials directly from the platform; platform models are now always org-allowlist-scoped, and Ctrl+K in the TUI opens the full model browser.
Release Notes page on docs site. A new page at docs.dreadnode.io/release-notes shows the full changelog with tier chips, month navigation, per-entry permalinks, and an RSS feed.
App-layer DoS skill for web-security. New app-layer-dos skill covers ReDoS, decompression bombs, server delay exploitation, and cross-protocol amplification for application-layer DoS testing.
Archive path-traversal skill. New archive-path-traversal skill covers Zip Slip, symlink attacks, polyglot MIME bypass, and Unicode path confusion via the archivealchemist tooling.
EXIF metadata manipulation tools. New exiftool capability adds exif_read, exif_write, exif_strip, and exif_copy methods for EXIF metadata manipulation in web-security agents.

Improvements

AIRT findings: newest-first, auto-refresh, and richer detail. All Findings now defaults to newest-first order, auto-surfaces new findings every 20 seconds with a notification pill, and the finding detail panel shows a structured Human Review table, a Metadata tile with Finding/Assessment IDs, a copy button on reasoning, and UUID-prefix search.
Web-security continuous scan status. The web-security agent now emits a STATUS update (including an Unexplored field) after every action, reducing silent drift and improving visibility into scan coverage.
Confidence trace IDs in web-security reports. Web-security vulnerability reports now include a trace ID linking each finding back to the confidence assessment that approved it.
CVSS score in confidence assessments. The web-security credence tool now accepts an optional CVSS score, echoes it as [cvss:N.N] in output, and flags mismatches such as low confidence paired with a high CVSS score.
Evaluations page shows capability and user detail. The evaluations list now surfaces who or what ran each sample alongside the capability reference, making it easier to identify the origin of a run.
Web-security interrupted tool result recovery. The web-security capability now automatically retries when the model emits an interrupted tool call result, replaying the last tool outcome up to a bounded retry budget.
Inject env vars into smoke tests via -e/--env. The new -e/--env flag on dn task validate --smoke lets you inject environment variables into the challenge service at smoke-test time without editing docker-compose.yaml.

Fixes

Evaluation reliability: deadlocks, sandbox provisioning, and circuit-breaker gaps. Evaluations no longer get stuck in queue for hours due to deadlocks, sandbox provisioning failures, or missing circuit-breaker coverage; transient infrastructure errors now retry automatically.
AIRT findings list restored: legacy compat and fast load. The findings list now correctly displays findings saved with legacy review-event field names and loads without the previous 6–10 second delay caused by a sequential scan.
Multi-attack campaigns no longer crash mid-run. All 12 attack types now accept airt_* span-linkage kwargs, fixing TypeError crashes that caused campaigns to partially complete and produce duplicate assessments.
Judge verification timeout extended. Trajectory-based task verifiers (outcome_judge, script_and_judge, flag_and_judge) no longer time out prematurely — the judge phase now has a 180-second minimum, preventing empty judgement results.
ASR formula consistent between detail and overview pages. Successful attack counts and ASR on the assessment detail page now use the same severity-based formula as the overview page.
Duplicate rows removed from ASR by Category chart. The chart no longer shows both jailbreak and jailbreak_general for runs using a single underscore-named category.
Video inputs work in eval model tasks. The SDK now serializes video content parts correctly for Gemini/Google/Vertex and OpenAI-compatible paths.
Failed assessments stay failed. Assessments that fail during finalization now correctly report status=failed in dn airt list --json instead of being overwritten to completed.
Workflow regeneration preserves hand-patched files. Re-running workflow generation no longer silently overwrites hand-edited files — existing files are kept and new versions are written as name_v2.py, name_v3.py, etc.
Anti-fabrication guard on report-writer trace IDs. The report-writer skill now marks missing confidence trace IDs as MISSING instead of allowing the agent to hallucinate a plausible-looking ID.
TUI /model command no longer overwrites profile default. Using /model or /models in a TUI session no longer persists the selection to your profile, so different sessions can use different models without interfering.
Activity feed status colors unified. Status badge colors on the home page activity feed now match the rest of the platform — e.g. AIRT “running” shows blue and World “cancelled” shows gray.

June 11, 2026

Session and Trace Views Now Display Agent-Captured Images, Audio, and Video

10 new 14 improved 13 fixed

Sandbox runtime limits now resolve through a four-level hierarchy configurable by platform admins, org owners, and individual users — alongside a concentrated push to eliminate evaluation sandbox timeouts that were causing widespread ‘sandbox was not found’ failures.

New

Session and Trace Views Now Display Agent-Captured Images, Audio, and Video Analysts can now view the images, audio, and video an agent logged during a run directly in the session transcript and trace details, rather than as raw base64. Each item stays behind an explicit Show media click, so potentially hostile artifacts are never decoded until an analyst chooses to open them.
Sandbox runtime limit hierarchy. Sandbox runtime limits now resolve through a four-level hierarchy (platform max → org max → org default → user-requested), configurable by platform admins, org owners, and individual users across the UI, API, SDK, and TUI.
Attack surface management capability. A new attack surface management capability combines BBOT scanning, Shodan enrichment, Neo4j graph analysis, screenshot triage, and a multi-agent ASM pipeline.
HTTP/2 WAF bypass skill. New h2-waf-bypass skill in the web-security capability covers 6 bypass classes including delayed DATA frame timing, body size truncation, Extended CONNECT, ForwardAuth body stripping, path normalization, and JSON content-type gaps.
GraphQL penetration testing skill. New graphql-pentest skill covers endpoint discovery, introspection mining, resource abuse (CWE-400, CWE-674), content-type CSRF, and capability matrix testing.
Vulnerability assessment methodology capability. A new standalone vuln-assessment-methodology capability provides a reusable severity matrix, disprove-first rules, and reporting standards that any security capability can load.
--judge-model override for evaluation creation. New --judge-model flag on dn evaluation create lets you override the task-level judge model at eval creation time without modifying task.yaml.
Pinned smoke solution image for dn task validate. dn task validate --smoke now runs solution and verify scripts in a pinned container that mirrors the production agent runtime, so smoke results match production behavior.
ProcessJudge prefix caching. ProcessJudge now supports prefix caching (opt-in cache flag), cutting LLM costs on long judge sessions by billing repeated calls at cache-read rates; GuardSessionPolicy enables it by default.
Automated Cloud Assessments Now Measure the Impact of Exposed AWS Credentials Security teams can now confirm how far an exposed AWS credential or instance-metadata finding could be taken, with the platform’s agents running authorized AWS exploitation checks to validate real-world impact.

Improvements

Secrets and chat models moved to Account Settings. Secrets and chat model settings have moved from org settings pages into the Account Settings modal, with deep-link support via URL hash (e.g. #account-settings/secrets).
Sandboxes view shows workload context. The sandboxes view now shows evaluation, task, and agent context for each sandbox, making it easier to trace which workload a sandbox belongs to.
Default agent timeout doubled to 1 hour. Default agent timeout for evaluations increased from 30 minutes to 1 hour, giving agents more time to complete complex multi-step tasks like Cybench challenges.
In-flight eval samples pinned to top. In-flight eval samples now stay pinned at the top of the samples pane during concurrent runs, so active samples no longer get buried in the list.
Actor chip in activity feed. The activity feed on the home page now shows an actor chip identifying who performed each action.
Session starter visibility in agent sessions. Agent sessions list now shows who or what started each session, making it easier to identify the origin of a run at a glance.
ASR by Category chart in Assessment Reporting. The ASR by Category card in Assessment Reporting now renders a bar chart in Charts mode, matching the ASR by Attack and ASR by Transform cards.
Job-status discs now have accessible labels. Job-status discs across evaluations, training, optimization, and worlds now show hover tooltips and ARIA labels so their color and animation meaning is clear to all users.
/agents TUI listing cleaned up. The /agents command in the TUI now groups agents under capability headings with aligned columns, an active-agent marker, and a footer hint — and correctly displays on the home screen.
‘Add Custom Secret’ button moved to top. The ‘Add Custom Secret’ button on the Secrets settings page now appears at the top of the section, so you no longer need to scroll past existing secrets to reach it.
Smoke test now validates multi-file task solutions. Smoke test runner stages the full task directory into the agent sandbox, so multi-file solutions referencing sibling scripts or assets validate correctly.
dn task validate --smoke covers judge-backed verification methods. dn task validate --smoke now runs the mechanical verification steps (solution + verify) for script_and_judge and flag_and_judge tasks instead of silently skipping them.
Project selector persists across navigation. The project selector now persists across pages — navigating from agent sessions to Charts or Analytics no longer resets your selected project.
Expired Verification Links Can Now Be Resent in One Click Users whose email verification link has expired can now request a fresh one in a single click, directly from the recovery page.

Fixes

Evaluation sandbox timeouts eliminated. A cluster of fixes ensures eval sandboxes now correctly honour their configured runtime limit: the rebalancer no longer resets timeouts to the org default, org ceiling validation is bypassed for eval-managed sandboxes, and explicit runtime limits are passed through from evaluation service to sandbox.
Cybench eval port connectivity fixed. Cybench evaluations no longer return 502 ‘port not open’ errors; sandbox timeout increased to 30 minutes and eval concurrency raised to 10; cold Docker Compose builds no longer expire the sandbox mid-run.
Evaluation queue starvation and sandbox provisioning failures fixed. Evaluation runs no longer queue-starve for hours behind large evals in the same org; env sandbox provisioning timeout raised to 300s to prevent ~30% of runs from failing.
OAuth buttons respond on first click. “Continue with Google” and “Continue with GitHub” buttons now respond on the first click, previously dead due to a hydration race on the sign-in/sign-up form.
Training runs honour the epochs parameter. The epochs parameter for Tinker SFT is no longer silently ignored — jobs previously always ran 100 steps regardless of dataset size or epoch setting.
Training run charts no longer show gaps in validation loss. The SDK no longer emits a None-padded val_loss series, and historical runs are handled gracefully.
Gemini models no longer fail with authentication errors. Models returning null cache usage fields from LiteLLM (e.g. gemini/gdm-eval-model-lis) no longer fail with a spurious authentication error.
read tool returns images as vision input. The read tool now returns image files as ContentImageUrl so VLMs receive proper vision input instead of a raw base64 text blob.
Catalog page filter buttons load immediately. Filter buttons on Environments, Capabilities, Datasets, and Models catalog pages now appear immediately instead of taking minutes to load.
Queued and running eval statuses now show distinct colors. Queued/pending returns to gray while running stays blue — previously both showed the same blue.
Cancelled evaluations no longer leave samples spinning. Cancelled evaluations no longer leave sample rows spinning indefinitely — statuses now correctly reflect the cancelled state.
Legacy runtime timeout no longer triggers ceiling errors. Evaluations no longer fail with ‘requested_runtime_limit_seconds exceeds platform ceiling’ when you didn’t explicitly set a runtime limit.
Unused runtime limit set silently respected by evaluations. The platform no longer incorrectly treated internal timeout values as explicit user runtime requests.

June 4, 2026

Binary analysis capability replaces windows-reversing with cross-platform PE/ELF/Mach-O support

7 new 5 improved 10 fixed

The binary-analysis capability lands this week with cross-platform support for PE, ELF, and Mach-O — replacing the older windows-reversing bundle.

New

Binary analysis capability (cross-platform). A new binary-analysis capability replaces windows-reversing with PE/ELF/Mach-O support, an expanded Ghidra MCP server, and a consolidated 8-phase analysis skill.
Bulk evaluation log download. You can now download all sample logs from an evaluation as a single ZIP bundle instead of exporting one sample at a time.
Dashboard workspace toggle. The dashboard now has a toggle to filter activity between your personal workspace and the full organization view.
Billing purchase receipt downloads. Org owners and admins can now download receipts for individual credit purchases from the billing settings page.
Conditional MCP header omission. MCP server headers can now be marked optional: true so unset env vars omit the header entirely, letting OAuth run as the default without a separate wrapper capability.
New end-to-end guides. Two structured guides — “Building a Capability” and “Red Teaming a Model” — replace several older scattered deep-dive docs.
Automated Web-Security Testing Now Covers Adobe Experience Manager and Apache Sling Security teams can now run automated assessments against Adobe Experience Manager and Apache Sling applications, surfacing the selector-abuse, dispatcher-bypass, and cross-site scripting weaknesses specific to those platforms. Existing coverage for blind SSRF chains and DOM-based vulnerabilities has also been sharpened for more reliable detection.

Improvements

Server-side transcript search. “Find in transcript” now searches all messages in a session server-side, so you can find matches in long sessions without paging through the entire transcript first.
Web-security skill quality pass. 28 web-security skills were updated with improved tooling, executable commands, and validation checkpoints — average skill score raised from 86% to 92% across all 58 skills.
Credits and pricing explained inline. Credits and pricing are now explained across the signup page, TUI status bar, TUI help panel, and docs Quickstart — each surface links to the canonical Credits docs.
Task verification method now visible in the UI. Task verification method (script, flag, judge, or compound) is now shown in both the environment task detail view and evaluation sample detail view.
Consistent activity awareness across views. Status indicators, severity tags, and activity awareness are now more consistent across assessments, evaluations, training, and optimization views.

Fixes

AI red-teaming attack workflows no longer fail with an SDK config error. Analytics results are now persisted correctly, and tool errors surface as clean messages instead of raw tracebacks.
Multi-study AIRT runs now export all traces. In multi-study workflows (transform comparisons, campaigns, category sweeps), all study traces are now exported — not just the first study’s. Applying a single transform no longer adds an unwanted baseline run.
TUI login no longer gets stuck in a LiteLLM key provisioning loop. Connecting to the platform no longer fails with a repeated “Failed to provision LiteLLM Key” error.
SDK and platform now enforce the same task-validation rules. Tasks that pass dn task validate locally will no longer be rejected with an opaque 400 error on upload.
generate_category_attack no longer fails with “Unknown attack: ‘t’” errors. All input formats for attack names — string, list, or comma-separated — now work correctly.
Session headers now show accurate message counts and reports. Active vs. total message counts are shown for compacted sessions, and the Reports tab correctly surfaces all reports from the full transcript.
TUI model browser now shows context and credit cost for hosted models. dn/* model rows no longer display - for context window size and price when catalog metadata is available.
Evaluation tool-use lists now show the actual skill name. The literal word skill no longer appears in place of the loaded skill name (e.g. agent-browser).
Running and failed status dots are now visually distinct. Running tasks in the evaluations view show a blue dot instead of orange-red, making them clearly distinguishable from failed (red) at a glance.
Selected items in sidebar panels now show a visible highlight. Evaluations, AIRT assessments, training runs, and trace-viewer runs now display a brand-tinted highlight on the active selection instead of blending into the background.

May 2026

May 28, 2026

Android APK research capability and issue-tracker connectors for web-security

7 new 3 improved 9 fixed

New capability bundles for Android APK research and issue-tracker integrations land alongside a full sweep of assistant-led CLI guides across the platform.

New

Android APK research capability. A new android-apk-research capability bundle ships with a 10-tool MCP server and four skills for static semantic vulnerability research on Android APKs.
Jira connector for web-security. Web-security agents can now export validated findings directly to Jira Cloud as remediation tickets via a new Jira MCP connector.
GitHub connector for web-security. A new GitHub MCP connector lets web-security agents file findings as GitHub issues and add follow-up comments without leaving the agent workflow.
Run artifact logging tools. Web-security agents can now attach screenshots, audio, video, and file artifacts directly to a run using four new path-based logging tools: log_image_output, log_audio_output, log_video_output, and log_file_artifact.
IDOR/BOLA judge scorer rubric. A new built-in IDOR/BOLA rubric is available for the SDK’s default LLM judge scorer, with graduated pentest-aligned cross-boundary access criteria; the web-security scorer-reference skill documents how to compose it in task.yaml and SDK configs.
Activity feed on the home page. The home page now shows a live activity feed with recent projects, sessions, evaluations, training jobs, and other workspace activity.
Administrators Can Now Control Which AI Models Members Use. Organization administrators can now grant each member access to a specific set of AI models, with the limits enforced automatically across the web app, API, and CLI.

Improvements

Assistant-led CLI guides across all surfaces. Every in-product CLI guide (capability, task/environment, dataset, model, evaluation, optimization, world manifest, trajectory, training) is rewritten into a two-tab layout with an ‘Ask an agent’ tab, accurate dn alias commands, and corrected flags.
CLI guide launcher button labels clarified. Launcher buttons across nine surfaces now use accurate action verbs (Create, Evaluate, Optimize, Train) instead of generic or incorrect labels.
AIRT and Traces visual language overhaul. The AIRT Traces view and shared TraceViewer now use consistent design-system primitives, unified span-category colors, and a redesigned trace control bar.

Fixes

Large-trajectory judge staging no longer fails. Outcome-judge staging no longer errors on large eval trajectories; the sandbox now fetches the trajectory directly via session ID instead of having it serialized and shipped by the API.
Session transcripts no longer truncated. Session transcripts now load all messages via cursor pagination — previously, sessions with more than 2,000 messages were silently truncated, dropping the most recent ones.
dn task validate accepts compound verification methods. dn task validate now accepts flag_and_judge and script_and_judge, fixing validation failures across 248 tasks.
TUI Ctrl+C now copies to clipboard. In the agent TUI, Ctrl+C copies selected text to clipboard (with fallback to pbcopy/xclip/xsel/wl-copy); use Ctrl+Q to quit.
TUI hosted model list no longer shrinks after restart. New platform model deployments now appear in the TUI without manually deleting ~/.dreadnode/proxy-models.json.
TUI /models screen respects admin model ordering. The TUI /models screen now displays models in the order configured by your admin instead of re-sorting alphabetically.
TUI no longer crashes on mid-load screen navigation. The TUI no longer throws a NoMatches exception when navigating away from a screen while a background worker is still loading data.
Image files render correctly in the environment file viewer. Image files in the environment file viewer now render as images instead of garbled binary content.
Linear MCP credentials now passed correctly. LINEAR_API_KEY, LINEAR_ACCESS_TOKEN, and LINEAR_API_URL are now correctly forwarded to the Linear MCP server in the web-security capability.

May 21, 2026

Compound eval verification — script_and_judge and flag_and_judge

6 new 6 improved 16 fixed

Eval tasks now support compound verification strategies that chain mechanical checks with an LLM judge to close reward-hacking gaps.

New

Compound eval verification: script_and_judge and flag_and_judge. Two new verification methods let eval task authors run a script or flag check first, then invoke an outcome judge as a second line of defense against reward hacking — no custom rubric required.
OutcomeJudge agentic verification. A new outcome_judge verification method lets eval tasks use an agentic LLM to inspect agent trajectories and emit pass/fail verdicts, alongside the existing script and flag methods; exposed via the new dn outcome-judge run CLI subcommand.
intent_plus_outputs_summary guard strategy. A new opt-in policy replaces raw tool outputs with LLM-generated summaries in judge prompts, reducing prompt-injection surface while preserving tool-call context.
Six new web app pentesting skills. ESI injection, gRPC-Web pentest, H2C/WebSocket smuggling, HTTP connection contamination, timing-attack recon, and XSLT injection are now available as knowledge distillations in the web-security capability.
waymore added to web-security capability runtime. Historical URL and response retrieval from Wayback Machine, CommonCrawl, OTX, URLScan, and VirusTotal is now available for recon and JS archaeology.
New setting for org admins re: model usage. Organization admins can now control which AI models each member is allowed to use, set right from the org members admin page

Improvements

TUI keystroke performance. Keystroke routing is now ~400× faster in long conversations — typing in the composer no longer slows down as conversation history grows.
TUI event loop and grep tool overhaul. The TUI no longer stalls when sync tools run blocking calls; grep gains output modes, context lines, and smarter filtering; tool result summaries now reflect actual output.
TUI session commands rationalized. /clear and /reset both now start a fresh session (preserving the old one), and the destructive in-place wipe is removed.
Assistant-led CLI guide modals. The in-product CLI guides for capabilities, tasks, environments, and models are rewritten with an assistant-led flow, accurate commands, and an ‘Ask an agent’ tab that generates a copyable dn --prompt launcher.
Consistent empty states across the platform. Empty states now distinguish ‘nothing here yet’ from ‘no filter matches’, include inline docs links, and show ghost visuals that hint at what each surface will contain.
Consistent browser tab titles. All pages now show titles in the format {Page} | Dreadnode, replacing a mix of inconsistent formats and blank tabs.

Fixes

Compound eval verification false negatives resolved. script_and_judge and flag_and_judge no longer report failed results when the agent successfully completes a task.
AIRT CLI assessment creation now surfaces in the UI. dn airt run and dn airt run-suite now correctly connect to the platform, so runs and results appear in the assessment UI instead of silently disappearing or showing Assessment: None.
Monitoring tab reports now display content. The Reports panel now shows the actual markdown report body instead of an S3 path pointer for reports over 10 KB.
Reports tab no longer stuck on ‘Loading report content…’. The Reports tab spinner no longer gets stuck after a deep-link reload when the report body was already cached.
Sandbox readiness timeout raised to 300 seconds. Capability-heavy sandboxes (e.g. web-security + zero-day-research) no longer time out during startup.
Cross-provider AIRT runs label the correct target model. The assessment UI now shows the target model instead of the attacker/orchestrator model for cross-provider runs.
Bundled capability disable state now persists. Toggling off bundled capabilities (e.g. self-improvement) in the TUI correctly disables them on reload instead of silently reverting to enabled.
Capability preflight checks now use the capability root as working directory. Checks referencing relative paths no longer fail with ‘No such file or directory’.
Invitation links show Sign In prompt for unauthenticated users. Invitation links no longer show ‘Invalid Invitation’ — unauthenticated visitors now see a Sign In / Create Account prompt instead.
BYOK OpenAI quota errors surface immediately. Agents using BYOK OpenAI no longer retry up to 8 times on insufficient_quota — the failure surfaces on the first attempt.
save_workflow now detects silent overwrites. The tool verifies file writes succeeded and warns when content is unchanged, preventing agents from operating on stale workflow scripts.
Hosted sandboxes page shows accurate active counts. Sandbox counts are now backed by a facets API that aggregates state correctly.
Errored evaluation statuses tracked correctly. Errored statuses are now included in eval phase summaries instead of being silently dropped.
TUI tool meta line no longer drops. Tool calls now display the ↳ <summary> meta line beneath the tool name instead of showing a blank gutter.
TUI spinner stays visible when Esc drains a queued message. The spinner no longer disappears while a queued message is still running.
TUI tool output wrapping stays within the gutter. Wrapped lines at narrow terminal widths now stay aligned under the gutter border instead of leaking to column 0.

May 14, 2026

Free-text search in evaluation trajectories

4 new 6 improved 12 fixed

Free-text search lands in hosted evaluation trajectories this week, alongside session rewind, cross-org capability share links, and sandbox dependency auto-install.

New

Free-text search in evaluation trajectories. Matches are highlighted inline in hosted evaluation trajectories and tool calls auto-expand when their content matches the search term.
Session rewind. Roll back a conversation to any prior user message via /rewind or double-Esc in the TUI — the full session history is preserved.
Cross-org capability share links. Capability hub links now work across orgs — recipients are automatically redirected to the right page regardless of their org slug.
Sandbox dependency auto-install. Sandbox runtimes can now automatically install Python packages and system dependencies declared in capability manifests at load time.

Improvements

AIRT auto-discovery with updated capability counts. The AIRT CLI now auto-discovers attacks, transforms, and scorers at runtime (61 attacks, 547 transforms, 141 scorers), and capability counts in the hub accurately reflect these results.
Simplified AIRT workspace layout. The AI red-teaming capability uses a cleaner ~/.dreadnode/airt/[org]/[workspace]/ workspace structure with improved error messages and input validation.
Settings sidebar grouped into Personal vs Organization. Secrets and Chat Models are now clearly labeled as Personal, separate from Organization settings.
AIRT assessments Details glossary consolidated. The Details section now shows a single glossary popover at the section header instead of three separate per-cell tooltips.
Optimization job sidebar shows author email. The optimization job sidebar now displays the author’s email instead of a raw user UUID, consistent with Evaluation and Training job lists.
Task name copy button. A copy-to-clipboard button next to the task name in the environment detail drawer makes it easier to grab long task names for CLI commands or evaluation setup.

Fixes

AIRT CLI runs now appear in the platform UI. Assessment creation was silently succeeding without connecting to the platform; AIRT CLI runs now correctly appear in the UI and analytics.
ModuleNotFoundError in UV tool and managed Python environments resolved. AI red-teaming workflows no longer fail with ModuleNotFoundError: No module named dreadnode in UV tool, container, and managed Python environments.
TUI tool output and XMLModel serialization fixed. TUI tool output no longer gets clipped after completion, and XMLModel serialization no longer crashes on NUL bytes or ANSI escape sequences.
ASR values display consistently as percentages. Attack Success Rate values now render as percentages across all AIRT views — no more mixed decimal/percentage formatting.
All 15 AIRT goal categories now surfaced. The AI red-teaming agent now offers all 15 goal categories (including reasoning_exploitation, supply_chain, and resource_exhaustion) instead of only 9.
Trace copy button restored on Safari. The trace copy button (rich and log views) now works correctly on Safari after breaking in v2.0.20.
AIRT report generation no longer floods UI with toasts. Generating a report no longer triggers an infinite loop of ‘Report build failed’ toasts that locked the UI.
Onboarding username now names the default workspace. Your chosen username during onboarding correctly names your default workspace instead of an autogenerated placeholder.
Deep links to evaluation samples no longer show ‘sample not found’. Navigating directly to a specific evaluation sample via deep link now loads correctly.
projects command in TUI scoped to current workspace. The projects TUI command now loads projects for the active workspace only.
ProcessJudge no longer crashes on rubrics mentioning .yaml. Plaintext rubrics that reference a .yaml filename no longer trigger OSError: File name too long.
Docs code blocks render -- flags with correct spacing. Geist Mono ligatures are disabled in docs code blocks, so dn --capability no longer renders as dn--capability.

May 7, 2026

AIRT Report Builder now generally available with templates, branding, and DOCX export

13 new 11 improved 18 fixed

The AIRT Report Builder graduates from feature-flagged preview to general availability this week, bringing saved templates, custom branding, DOCX export, and a live structural preview to all users.

New

AIRT Report Builder GA. The AIRT Reports tab is now visible to all users by default; the builder supports saved templates (load/save/rename/delete), custom branding (logo, company name, title, confidentiality footer), DOCX export, and a live structural preview panel.
Trace-analysis advisor skill. A new AI red teaming skill surfaces attack-effectiveness analysis, transform recommendations, and vulnerability pattern identification from historical run data directly inside the agent.
GuardSessionPolicy with LLM-judged tool gating. New GuardSessionPolicy gates every agent tool call through an LLM judge before execution, with a built-in safety rubric and optional custom rules.
Guard policy transcript strategies. GuardSessionPolicy now supports five transcript strategies (rubric_only, intent_only, intent_plus_calls, full, and more); the default is now intent_plus_calls for richer judge context.
ATIF v1.7 trajectory export and dn session CLI. A new export endpoint converts session transcripts to ATIF v1.7 or OpenAI Chat Completions format; dn session CLI command group and a download menu in the session UI let you browse, inspect, and export sessions.
Persistent TUI welcome panel and getting-started skill. The TUI welcome screen is now a persistent panel showing profile, runtime, and capability context; a new getting-started skill routes new users to the right capability or task automatically.
dn capability uninstall, session lifecycle actions, and rewritten session picker. New dn capability uninstall command, session archive/freeze/delete actions in the TUI, and a rewritten session picker with richer status columns and inline lifecycle controls.
CLI conventions overhaul. New dn inference-model (alias dn llm), dn secret list, and dn environment wait commands added; dn env renamed to dn environment with alias retained; destructive-action --yes/-y confirmation standardized across all commands.
dn update CLI command. You can now update the Dreadnode CLI directly from the terminal with dn update.
Admin-configurable featured catalog models. Platform admins can configure which models appear as featured in the catalog via a new admin UI, without code changes or redeployments. Manual entry of preview or unreleased model IDs is also supported.
TUI inline report rendering with web deep-link. The TUI now renders report tool calls inline with full markdown content, a smart title, and a clickable “View in web” link that opens the platform Reports tab for the active session.
Session tool count and cost stats. Agent session views and the TUI footer now show tool call count and estimated USD cost alongside message count and token usage.
Capability hooks documentation. New documentation covers lifecycle events, observers, and gating patterns for building agents with capability hooks.

Improvements

AIRT analytics performance. AIRT analytics pages now load in 4–5 seconds on first visit and under 1 second on repeat visits, replacing a previous infinite-loop hang; per-section error indicators surface when analytics data is malformed instead of silently rendering blank charts.
ask_user structured questions and cancel flow. The ask_user tool now supports structured multi-question bundles, explicit cancel flows (raising UserCancelled), and a new interactive TUI widget with tab navigation, multi-select, and Esc-to-cancel.
Artifact deep-linking. Datasets, environments, models, and capabilities now have dedicated URLs you can share or bookmark directly. Training job selections are also reflected in the URL (?job=<id>) for the same purpose.
ATIF trajectory source lineage. Exported ATIF trajectories now include an extra.dreadnode block with origin and {id, key} pairs for organization, workspace, and project, so downstream consumers can trace data back to its origin.
AIRT assessments page visual and UX refresh. The Assessments page now matches the Overview’s design system with shared UI primitives, semantic tokens, and URL-driven assessment selection (right-click to open in new tab works).
AIRT report template button labels clarified. Template save buttons now read “Save as template”, “Save as new template”, and “Update template” instead of the ambiguous “Save as new” / “Update”.
TUI session title in context bar. The TUI context bar now shows the session title (truncated at 40 chars) instead of the 8-character hex ID.
Legacy client-side PDF export removed. The “Export PDF Report” button on the AIRT overview page has been removed; the new Reports tab handles PDF and all other export formats.
Notification badges on login. Pending org invitation badges now appear in the nav bar and Account Settings immediately on login or page refresh.
AIRT guidance expanded in TUI and docs. TUI help text, CLI --help, and docs now surface all web app review paths — overview dashboard, per-assessment view, trace view, and custom report builder.
Brand accent color and notification badge component. Numeric notification badges (invitations, active filters, unread events) now use a consistent BadgeAlert component, and the brand accent color has been updated to #FF6B3D with improved WCAG AA contrast.

Fixes

AIRT analytics data accuracy. Attack success rates, transform usage, trial counts, and chart data now reflect accurate totals — a series of regressions caused rates to show as ~64% when the actual value was ~100%, and large projects (500+ assessments) to time out with empty dashboards.
SDK dependency conflict resolved (2.0.19). SDK versions 2.0.16–2.0.18 were uninstallable via uv tool install or pipx install due to a litellm/fastmcp dependency conflict; 2.0.19 resolves this.
AIRT PDF/DOCX report fidelity fixes. PDF reports now include ML metadata fields (transforms_applied, original_class, adversarial_class, distance_value) previously missing from exports; DOCX reports render in landscape layout with correct column widths; truncated-column footers point to CSV export and show the correct additional-column count.
TUI context gauge shows correct token count. The context gauge now shows last-generation input tokens (e.g. 800k/1M) instead of a cumulative sum that incorrectly exceeded the model’s context limit.
AIRT --project flag now scopes correctly. The AIRT CLI --project flag correctly scopes assessments and trace exports to the specified project instead of silently resolving to default.
AIRT compliance coverage table fixed. The Attacks Used and Trials columns now display real data; compliance framework rows expand and collapse correctly on every click; re-clicking the already-active project no longer flashes “not found”.
Self-improvement reflector hook restored. The self-improvement reflector hook now correctly calls Agent.run() instead of the removed Agent.chat(), restoring the feedback loop after failed agent turns.
TUI zero-balance error message. The TUI now shows “Insufficient credits — top up your org or switch to a BYOK model” instead of a misleading sign-in/provisioning error when the org has zero balance.
TUI model browser keyboard navigation. The TUI model browser now responds to arrow keys immediately on open — no mouse click required.
TUI /update false “version unchanged” warning fixed. The /update command no longer shows a false “version unchanged” warning after a successful update when multiple dn installations exist.
Cross-org public dataset access. Public datasets from other orgs now open and download correctly instead of returning 404 errors.
AIRT report download fallback for Safari iOS. The AIRT report toast now includes a Download link so users whose browser blocked the auto-download can retrieve their report without re-running generation.
AIRT “Total Findings” count corrected. The AIRT overview “Total Findings” card now shows the correct total count instead of the current page size (20).
Dataset pull command fixed. The dn dataset pull command now works correctly.
Members and Workspaces tables sort correctly. Clicking column headers in the Members and Workspaces settings tables now sorts rows as expected.
AIRT severity levels documented. The AIRT severity reference now documents all five levels (Critical, High, Medium, Low, Info) — previously only Critical and High were defined.
System prompts visible in session transcripts. Session transcripts now display system prompts in a collapsible disclosure panel.
Docs copy button alignment fixed. The copy button on terminal code blocks in the docs site now stays inside the code block.