Skip to content
Dreadnode Dreadnode Dreadnode

July 9, 2026

End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces

← All updates

End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces

14 new 5 improved 14 fixed

  • Structured findings and assets in the platform. Agents can emit structured vulnerabilities, endpoints, and other typed items during runs — viewable in a new Structured Output page with per-type tables, detail panels, and provenance history. Web-security agents now produce WebVulnerability and WebEndpoint items visible in the Items UI for triage, filtering, and cross-session tracking.
  • Web chat — interactive/autonomous mode toggle, rewind, and session actions. Web chat sessions now support an interactive ↔ autonomous mode toggle with optional step cap, a “Rewind to here” control on any prior user message, and a full action menu (copy ID/link, export trajectory, archive/freeze/delete) directly from the session list.
  • Web chat — inline human-input prompts, live tool media, and reasoning-effort selector. The web chat transcript now surfaces ask_user prompts inline, renders live tool media during streaming, and exposes a reasoning-effort selector in the composer.
  • Chat UI promoted to main navigation. Web chat is now accessible from the main sidebar navigation instead of the previous beta route.
  • Session compaction rendered as a labeled divider in web chat. Compaction events now appear as a divider with an expandable summary of how many messages were summarized, instead of leaking raw XML into the transcript.
  • Agent sessions default to no grouping. The Sessions page now defaults to ungrouped; workflow grouping is still available in the selector.
  • Unified produces key for capability manifests. A single produces key now configures built-in item types, custom types, and disablement — replacing the older items key.
  • Chat sandbox no longer auto-pauses mid-session. A periodic keepalive extends the runtime’s expiry every 30 seconds while you’re actively working.

Full multimodal support lands in AI red teaming this week — probe vision, audio, and video targets end-to-end, with media rendering inline across findings, traces, and exports.

New

  • Multimodal AI red teaming — end-to-end. Probe LLMs with text, image, audio, and video inputs; apply per-modality transforms; score outputs (including generated media) with the new multimodal_judge scorer; view full message parts inline in findings, traces, and parquet exports (new schema v3 with base64 media columns). Includes a cross-product prompt_matrix mode (N prompts × M media items = N×M trials) and Nova Sonic speech-to-speech target support.

  • Custom HTTP targets for AI red teaming — any cloud, any auth. New build_target(TargetSpec) factory and custom_http target mode let you point TAP, PAIR, and other attacks at any endpoint (Azure, Vertex, SageMaker, Bedrock, OpenAI-compatible, arbitrary URLs) with declarative auth strategies (API key, Bearer, AWS SigV4, Azure AD, GCP).

  • Per-modality response scores in the platform. Findings and Assessment Findings tables now show independent scores per output modality (text, image, audio, video) with the highest-scoring modality emphasized.

  • Session groups and workflow hierarchies. Multi-session agent runs are now organized into collapsible workflow groups in the Sessions view instead of a flat list; the SDK exposes a new client.workflow() API.

  • Model reasoning as a first-class field in session transcripts and trajectory export. Native reasoning content (Anthropic thinking blocks, reasoning_content) now appears in the session transcript viewer and ATIF trajectory export as a typed field rather than being silently dropped.

  • SecurityContext MCP server for web-security agents. New MCP server lets agents mine commit history and CVE disclosures to generate hunting briefs, top risks, and ranked vulnerability leads before auditing a codebase — three tools: get_security_context, create_security_context, get_vulnerability_leads.

  • Three new web-security skills. Added git-integration-exploitation, http-query-method (RFC 10008 parser differentials), and dom-vulnerability-detection (postMessage IP normalization bypass).

  • Hub scope tabs — Mine · {org} · Public. Dataset, Model, Capability, and Environment browse pages now have scope tabs with live count pills and scope-aware empty states.

  • Bundle README surfaced in frontend, TUI, and CLI. Capability and task detail pages now include a README tab; the TUI exposes it with d; the CLI adds --readme / -R to dn capability info and dn task info.

  • Auth-setup-guide skill for AIRT. New skill walks you through authenticating target, attacker, and judge models from your own environment — covering Azure, AWS Bedrock, GCP Vertex, custom HTTP endpoints, and more.

  • multimodal_judge scorer. New scorer evaluates generated images, audio, and video using a vision/audio-capable model instead of stringifying media output.

  • dreadnode[nova-sonic] SDK extra. Install the new extra to get all required AWS deps for Nova Sonic speech-to-speech targets; missing deps now raise a clear error instead of an opaque import trace.

  • AIRT multimodal output capture and per-modality scoring. All output modalities (text, image, audio, video) are now captured from target models, with per-modality worst-case MAX score aggregation, and audio/video playback fixed in the trace viewer.

  • Nova Sonic S2S target support in the TUI and AIRT SDK. Nova Sonic speech-to-speech targets are now available in the TUI capability picker and the SDK’s build_target factory.

Improvements

  • Multimodal AIRT findings layout — Original → Transformed → Response. Findings now display a clean three-panel message layout with judge model, transformed prompt, and inline trace media shown correctly.

  • Model reasoning always visible inline in TUI and web session viewer. Reasoning now appears as always-visible inline prose; ^O controls tool-output verbosity only and no longer hides reasoning blocks.

  • AIRT findings ranked by severity. Critical findings now surface first in the findings list.

  • Improved dn update diagnostics. The CLI and TUI now show accurate resolver-failure details when dn update exits without changing the installed version.

  • Org, workspace, and project names enforce 100-character limit. Name inputs now validate length as you type, preventing overflow and submission errors.

Fixes

  • SDK installable again — MoviePy moved to dreadnode[video] extra. dreadnode 2.0.32+ is installable from PyPI; the Pillow/MoviePy conflict is resolved by making MoviePy optional.

  • spawn_agent no longer hangs indefinitely. Sub-agents now have a default 1-hour timeout (configurable); the undocumented run_in_background field has been removed.

  • Native reasoning now reaches the client on dn/ proxy routes. Thinking blocks and reasoning_content from Claude and other reasoning models were previously silently dropped on platform proxy routes.

  • Nova Sonic adapter no longer hangs on missing AWS credentials. The adapter now resolves credentials via the standard AWS chain (env, profile, SSO, IMDS) and fails fast with a clear error, eliminating the 9+ minute hang.

  • Multimodal AIRT findings show real errors instead of “(no response)”. When a target call fails (e.g. auth 401, bad model ID), the actual error is surfaced so failures are distinguishable from genuine model refusals.

  • AIRT trial counts, missing responses, score tooltips, and trace deep-links fixed. Trial counts display correctly, missing responses fall back to trial data, tooltips work on score columns, and silent refusals show a descriptive message.

  • Judge reasoning now appears in finding headlines and markdown exports. Previously blank even when trial-level reasoning was present; root cause was reading from the study-level span instead of the trial span.

  • Judge LLM field on assessment-detail header shows model name. Previously displayed ”—” for multimodal assessments.

  • AIRT compliance dashboards show correct denominators. OWASP LLM Top 10 now shows /10 and NIST AI RMF shows /4; multimodal media in trace spans renders inline instead of as raw JSON.

  • AIRT multimodal video, audio playback, and per-trial message blocks fixed. Video input, audio playback, and judge reasoning work correctly; findings tables show per-trial message blocks instead of a single best-trial view.

  • AIRT multimodal view shows correct attacker prompt on failed trials. Previously showed the wrong prompt; media downloads now save to disk instead of opening inline, and trial scores carry clearer “Overall Score” labeling.

  • TUI model picker cursor no longer jumps when filtering. Cursor now stays at the top of filtered results instead of jumping to the bottom.

  • TUI first-run defaults to a platform-hosted model. New users without a personal Anthropic API key no longer hit an immediate failure on TUI startup.

  • Network-ops tool wrapper bugs fixed. Four confirmed bugs resolved: smbclient preserves partial directory listings, netexec handles multiple groups in enumeration, SharpView correctly parses arguments with spaces, and Impacket script discovery works with bash wrapper scripts.