October 15, 2026

← All updates

Agentic attack trace parity

3 new1 improved13 fixed

AIRT findings parquet enriched with reviewed state and project rollups.

New

• AIRT findings parquet enriched with reviewed state and project rollups. The findings parquet export now reflects the latest operator-reviewed severity and status, and includes new columns for audit trail, ASR, compliance tags, adversarial-ML metrics, and project-level rollups.
• Session pinning in Chat and Agents. You can now pin sessions from the ... menu in the Chat sidebar or Agents › Sessions; pinned sessions appear at the top of the list and are visible only to you.
• SLIP jailbreak attack in AI red-teaming. The AI red-teaming capability now includes a SLIP self-jailbreaking attack tool, letting you run tree-search-based prompt jailbreaks against a target model with configurable depth, branching, and judge models.

Improvements

• SDK stream drops are retried automatically. Hosted inference streams that drop mid-connection are now retried up to 3 times with exponential backoff (1s, 2s, 4s), reducing failures on unstable network paths.

Fixes

• Agentic attack authentication restored. Agentic red-teaming attacks now authenticate correctly against provisioned targets; previously all trials failed with empty responses, producing 0% attack success rate.
• ATLAS attacker default model fixed. The ATLAS attacker in AI red-teaming environments now defaults to dn/gpt-5.4-mini, resolving LiteLLM errors and 0% ASR results caused by the previous groq scout default.
• ATLAS topology finding severity now requires tool evidence. ATLAS topology findings no longer record as critical/jailbreak when a verbal-only response fires and campaign ASR is 0 — severity is gated on a privileged tool actually firing.
• Multistep tool attack severity uses replay-verified scores. Severity grading for multistep_tool_attack now uses the replay-verified score instead of the optimizer peak, so non-reproducible hits no longer produce false critical or jailbreak findings.
• Tool-call evidence now populated in agentic findings. Findings from multistep_tool_attack and custom-target agentic attacks now include the actual tool calls that triggered them, so traces show what the agent did rather than a placeholder or empty panel.
• SLIP and multistep attacks now materialize findings correctly. SLIP and multistep tool attacks now correctly compute ASR and appear in reports and parquet exports after completing.
• Multistep tool attack scores clamped to [0, 1]. Findings no longer show scores above 1.0 when a two-step objective returns a combined magnitude greater than 1.
• ATLAS findings now show Judge Reasoning. ATLAS findings scored via tool evidence now show reasoning in the Judge Reasoning panel instead of appearing blank.
• Text-evasion findings labeled with correct modality. Text-evasion attack findings (textfooler, textbugger, bae, pwws, deepwordbug, text) now export with input_modality="text" instead of the incorrect "tabular" default.
• Parquet executive summary trial count matches the platform UI. The parquet export’s executive summary now reports the same total trial count shown in the platform, rather than an under-counted value from per-finding sums.
• Multi-agent red-teaming guides use a working model. Multi-agent guides now reference a working dn/ proxy model for ATLAS runs, removing a decorator that caused errors and adding KeyError-safe tool_calls handling.
• Network-ops capability now provisions its full toolchain. The network-ops capability now installs nmap, smbclient, hashcat, john, impacket, certipy-ad, bloodyAD, and NetExec on local Docker sandboxes and loads correctly when optional assets are unavailable.
• SDK install script constrained to supported Python range. The install.sh script now constrains uv to Python >=3.11,<3.14, preventing install failures on Python 3.14+ where some dependencies lack pre-built wheels.