September 24, 2026

Approve or reject held tool calls in web chat

10 new14 improved14 fixed

Web chat now lets you approve or reject tool calls that policy has held for review — inline, with full arguments and the policy reason visible before you decide.

New

Tool call approvals in web chat. Held tool calls now appear inline in the conversation transcript with full arguments, the policy reason, and Approve / Reject buttons — replacing the previous generic input card.
New workbench at /beta. The new information architecture is live across four sections: the project shell (org · workspace · project breadcrumb, place switcher, per-section tabs), Hub catalogs (Capabilities, Environments, Datasets, Models), Agent Outputs, and Sessions — all replacing their previous placeholders.
Tool catalog and revision pages. A browsable Tool catalog is now available in Agent Policies, with searchable metadata, copyable IDs, schema fingerprints, and collapsible input schemas for every visible tool and its revision history.
Runtime logs in the TUI console. Press F5 then Tab in the TUI console to switch from local process logs to the connected runtime’s server logs, with full retained history (up to 2,000 entries), level filtering, copy, and save.
Package-relative capability imports. Capability tools, hooks, and workers can now import sibling modules using standard package-relative imports instead of relying on flat module names.
Capability workflow graph. The capability detail page now shows a workflow graph of how the capability’s steps connect.
Release notes unread badge. An unread badge on the sidebar account button shows how many release notes you haven’t seen yet, clearing automatically when you open Release Notes in Account Settings.
Agentic probes sandbox target. A new provisionable multiagent sandbox target — ‘agentic-probes-sandbox’ — is available for the 2026 agentic-probe evaluation families, replacing the prior local self-contained setup.
Agentic-probes 2026 attacks in ai-red-teaming. The ai-red-teaming agent can now generate agentic-probes 2026 attacks via generate_attack, including transforms for argument injection, deserialization payloads, RAG poisoning, covert channels, and more, plus matching evidence-gated scorers.
Agentic probe suite: evidence-gated tool-misuse, exfil, memory, MCP, and RAG probes. Eight new agentic red-teaming probe families are available in the SDK: evidence-gated scorers and transforms covering tool-misuse RCE, advanced exfiltration, MINJA memory poisoning, MCP line-jumping, RAG optimization attacks, and indirect prompt injection via the new IterInject attack loop.

Improvements

Agent cold-start is 93% faster. Heavy imports (pandas, numpy, pyarrow, Optuna) are now deferred until actually used, and the SDK tracing path no longer pulls them in on the first chat turn — cutting median agent construction from ~5 s to ~0.3 s and saving 3.5–3.8 s on the first turn.
E2B sandbox pre-warming. Server, LiteLLM, agent graph, and first-turn imports are now baked into the E2B runtime snapshot, eliminating the largest filesystem-load costs at startup.
Type your first message while the runtime starts. You can now compose and send your first prompt before the runtime finishes starting — the message queues and dispatches automatically once the session is ready, with a Cancel option.
Discrete runtime startup progress. Runtime startup and capability reload now stream real-time progress steps instead of showing a fixed time estimate; a timeout during capability install no longer reports a successful install as a failure.
Trace storage off the critical path. Trace storage uploads now run in a background pool, so the first chat turn no longer waits on storage credential fetching or object uploads before issuing the first model request.
Policy-blocked tool calls shown as stopped. Tool calls blocked by policy now appear as stopped — not failed — in session transcripts and web chat, with a distinct indicator and expandable decision details.
Tool policy state in transcript headers. Transcript headers now show the tool policy state (active, disabled, failed, awaiting approval, or not recorded) for both live and past sessions.
Workflow run page redesign. The workflow run page has a new header, node panel, transcript view, and graph direction controls; definition and execution nodes render with improved layout and status indicators.
Runs visible on the Workflows page. Associated runs now appear inline on the Workflows page with status, duration, and run ID — no need to navigate away to find them.
Auto-select loaded capability agent. When a runtime has exactly one capability loaded, the composer now starts on that capability’s agent automatically, with no manual picker switch needed.
SDK 2.0.47: capability health, terminal errors, runtime model selection. Agents can now inspect runtime capability health; terminal agent errors correctly fail turns instead of reporting success; and model selection is available for local workflow runs.
Explicit autonomy budgets. Unattended workflows (dn --auto, /auto, /background, --print, guard sessions, and web chat Auto/Background) default to 100 steps, and --print --max-steps N now works as documented.
Parallel scope validation. SDK scope validation now runs reads concurrently with exponential backoff and an 8-second shared deadline, reducing validation latency and improving recovery from transient failures.
Self-hosted resource presets updated. The small/medium/large resource presets now have higher CPU limits for the API and PostgreSQL, and the docs show updated user-count guidance and a full preset table including PostgreSQL.

Fixes

Durable runtimes renew model keys on resume. Runtimes that resume after a long pause no longer fail model requests with an expired API key — the LiteLLM key is renewed automatically before the sandbox resumes.
Tool-call normalization for non-OpenAI agent shapes. AI red-teaming scorers (any_tool_invoked, tool_selection_safety, dangerous_tool_args) and agentic probe scorers now correctly detect tool calls from agents that use non-OpenAI tool-call shapes or pass arguments as a dict, fixing silent false negatives across all agentic attack categories.
Valid request bodies for multi-line attack prompts. AI red-teaming attacks using multi-line or backslash-heavy prompts (GOAT, TAP, crescendo) now produce valid JSON request bodies, so trials no longer silently return empty responses against agent targets.
Gateway model metadata resolved correctly. Gateway models (e.g. dn/deepseek-v4-flash) now resolve context limits, pricing, and prompt-caching support from the gateway’s own metadata, eliminating mispriced turns, wrong context limits, and a redundant capability probe on every chat turn.
Private-CA trust across SDK transports. Capability bundle downloads, MCP connections, training clients, and artifact downloads on self-hosted installs now verify TLS against the operator CA, fixing silent sync failures and 409 “Unknown capability” errors at session creation.
Storage URL routing in self-hosted deployments. Storage downloads no longer time out when sandbox traffic was routed through the external load balancer instead of the internal cluster endpoint.
Training template imports restored. Training templates no longer fail to import dreadnode after installation due to dependency conflicts between the SDK and Tinker.
Attack loops tolerate non-string target output. GoAT v2, adversarial reasoning, MAPF, and four other attack loops no longer crash with a TypeError when the target agent returns a dict instead of a string.
AgentVigil and EVA surface metrics in trace analytics. AgentVigil and EVA attacks now correctly emit study and trial spans, so span counts, max scores, and jailbreak metrics appear in trace analytics instead of showing zero.
Trial spans inherit assessment context automatically. Trial spans now pick up the active Assessment context without explicit wiring, so assessment trace analytics correctly count trial spans.
ask_user question card placement. In web chat, an agent’s question card now appears directly under the ask_user row that asked it, not below all other tool calls in the message.
TaskEnvironment accepts Dreadnode or ApiClient. Passing the result of dn.configure() directly to TaskEnvironment no longer raises an AttributeError.
Model catalog card layout. Model catalog cards with tags no longer produce invalid HTML that breaks card layout when JavaScript is disabled or during server-side rendering.
best_score scale corrected in analytics-interpretation. The analytics-interpretation skill now correctly documents best_score as a 0.0–1.0 normalized value with a jailbreak threshold of ≥ 0.9, not the internal 1–10 judge rubric.