Dreadnode

No entries match these filters. Clear filters

1. changelog Oct 29, 2026 · issue 124

   Dreadnode: Access enriched findings parquet exports with reviewed severity and status, audit trail, ASR, compliance tags, adversarial-ML metrics, and project rollups.

   └──▷ HOW TO FIND IT
   Run a white-box GCG attack against a local open-weight model as the surrogate for an AI red-teaming assessment.
   📍# supply a local open-weight model as the surrogate in the ai-red-teaming capability # select a GCG-family white-box attack from the attack catalog when configuring the run
   Score an agentic red-team run for exact tool-call landings rather than relying on a judge model.
   📍# add tool_call_attack_landed to the scorer list in your airt SDK study configuration
   • Pin sessions in Chat or Agents › Sessions from the menu in the Chat sidebar so pinned sessions appear at the top of the list.
   • Retry dropped hosted inference streams automatically up to 3 times with exponential backoff (1 s, 2 s, 4 s) on unstable network paths.
   • Improves the network-ops capability with a full toolchain now installed on local Docker sandboxes — nmap, smbclient, hashcat, john, impacket, certipy-ad, bloodyAD, and NetExec — and structured findings (hosts, users, credentials, shares, and weaknesses) viewable in Agent Output after network-ops enumeration.
   • Pin sessions in Chat or Agents › Sessions from the menu in the Chat sidebar so pinned sessions appear at the top of the list.
   • Retry dropped hosted inference streams automatically up to 3 times with exponential backoff (1 s, 2 s, 4 s) on unstable network paths.

   1 more in Everything

2. New navigation now live for all users Oct 22, 2026 · issue 123

   Dreadnode adds a tool_call_attack_landed scorer for judge-free agentic red teaming and ships a third-party notices file for air-gapped Enterprise installs.

   • New detectionAdds tool_call_attack_landed scorer for agentic red teaming — measures whether an agent emitted a specific attacker-intended tool call (name and arguments), providing a deterministic, judge-free attack success rate signal.
   • Enterprise installs now include a third-party notices file downloadable from Account Settings or at https://<domain>/third-party-notices, air-gap compatible and version-matched.
   • Redesigned navigation is now the default for all users on SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and Enterprise.

   3 details in Everything

   • New detection New structural and long-context jailbreak attacks in the airt SDK
   • New detection New classifier-evasion attacks in the airt SDK
3. New navigation now live for all users Oct 22, 2026 · issue 018

   Dreadnode adds a tool_call_attack_landed scorer for judge-free agentic red teaming and ships a third-party notices file for air-gapped Enterprise installs.

   • New detectionAdds tool_call_attack_landed scorer for agentic red teaming — measures whether an agent emitted a specific attacker-intended tool call (name and arguments), providing a deterministic, judge-free attack success rate signal.
   • Enterprise installs now include a third-party notices file downloadable from Account Settings or at https://<domain>/third-party-notices, air-gap compatible and version-matched.
   • Redesigned navigation is now the default for all users on SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and Enterprise.

   3 details in Everything

   • New detection New structural and long-context jailbreak attacks in the airt SDK
   • New detection New classifier-evasion attacks in the airt SDK
4. Agentic attack trace parity Oct 15, 2026 · issue 117

   Dreadnode adds SLIP jailbreak attack, enriched findings parquet with audit/compliance columns, and session pinning in Chat and Agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Run a SLIP tree-search jailbreak campaign against a target model to measure attack success rate with controlled branching.
   📍In the AI red-teaming UI, select your project, choose SLIP from the attack tool list, set your target model, configure depth, branching, and judge models, then launch the campaign.
   • Adds SLIP self-jailbreaking attack tool to AI red-teaming, enabling tree-search-based prompt jailbreaks against a target model with configurable depth, branching, and judge models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enriches the findings parquet export with new columns for audit trail, ASR, compliance tags, adversarial-ML metrics, and project-level rollups, and reflects the latest operator-reviewed severity and status.
   • Adds session pinning in Chat and Agents: pin sessions from the ... menu in the Chat sidebar or Agents › Sessions; pinned sessions appear at the top of the list and are visible only to you.
   • Retries hosted inference SDK streams dropped mid-connection up to 3 times with exponential backoff (1s, 2s, 4s) to reduce failures on unstable network paths.
   • Adds SLIP self-jailbreaking attack tool to AI red-teaming, enabling tree-search-based prompt jailbreaks against a target model with configurable depth, branching, and judge models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds session pinning in Chat and Agents: pin sessions from the ... menu in the Chat sidebar or Agents › Sessions; pinned sessions appear at the top of the list and are visible only to you.

   2 more in Everything

5. Agentic attack trace parity Oct 15, 2026 · issue 018

   Dreadnode adds SLIP jailbreak attack, enriched findings parquet with audit/compliance columns, and session pinning in Chat and Agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Run a SLIP tree-search jailbreak campaign against a target model to measure attack success rate with controlled branching.
   📍In the AI red-teaming UI, select your project, choose SLIP from the attack tool list, set your target model, configure depth, branching, and judge models, then launch the campaign.
   • Adds SLIP self-jailbreaking attack tool to AI red-teaming, enabling tree-search-based prompt jailbreaks against a target model with configurable depth, branching, and judge models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enriches the findings parquet export with new columns for audit trail, ASR, compliance tags, adversarial-ML metrics, and project-level rollups, and reflects the latest operator-reviewed severity and status.
   • Adds session pinning in Chat and Agents: pin sessions from the ... menu in the Chat sidebar or Agents › Sessions; pinned sessions appear at the top of the list and are visible only to you.
   • Retries hosted inference SDK streams dropped mid-connection up to 3 times with exponential backoff (1s, 2s, 4s) to reduce failures on unstable network paths.
   • Adds SLIP self-jailbreaking attack tool to AI red-teaming, enabling tree-search-based prompt jailbreaks against a target model with configurable depth, branching, and judge models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds session pinning in Chat and Agents: pin sessions from the ... menu in the Chat sidebar or Agents › Sessions; pinned sessions appear at the top of the list and are visible only to you.

   2 more in Everything

6. changelog Oct 13, 2026 · issue 107

   Dreadnode: Adds ApiClient.list_project_memories filtering by session ID so agents can trace which memories a session created, updated, or closed.

   └──▷ USE IT
   Apply a custom severity policy to an AIRT assessment so findings are classified against your org's own risk thresholds rather than defaults.
   python copy

   assessment.severity_policy = {
     'thresholds': {'critical': 0.9, 'high': 0.7, 'medium': 0.4},
     'aliases': {'jailbreak': 'critical'},
     'matrix': {'tool_misuse': 'high'}
   }

   Declare extra tool directories in a capability so uv or Go binaries installed into non-standard paths are found by agents in E2B sandboxes.
   capability.yaml copy

   dependencies:
     path:
       - /root/.cargo/bin
       - /usr/local/go/bin

   Retrieve all memories that a specific session created or modified, so an agent can audit its own memory footprint for a past run.
   python copy

   memories = client.list_project_memories(project_id='<project_id>', session_id='<session_id>')
   for m in memories:
       print(m.key, m.status)

7. File and folder uploads in Web Chat Oct 8, 2026 · issue 106

   Dreadnode adds file/folder uploads in Web Chat, structured binary-analysis output, and a severity_policy parameter for AI red-teaming.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Apply a custom severity taxonomy during an AI red-team engagement so findings are classified against your org's own risk thresholds rather than defaults.
   python copy

   generate_attack(severity_policy={"thresholds": {"critical": 9.0, "high": 7.0, "medium": 4.0}, "aliases": {"rce": "critical"}})

   Declare extra tool directories in a capability so agents can find binaries installed outside the default PATH in E2B sandboxes.
   capability.yaml copy

   dependencies:
     path:
       - /home/user/.cargo/bin
       - /usr/local/go/bin

   Trace all memories a specific session created or modified when investigating an agent run.
   python copy

   ApiClient.list_project_memories(project_id="<project_id>", session_id="<session_id>")

   • Adds severity_policy parameter to generate_attack so you can define custom risk taxonomies — thresholds, matrices, and aliases — that the agent applies when classifying findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ?tool_call=<id> linkable URL parameter and a View in transcript button in the Media tab to jump directly to the tool call that logged an artifact.
   • Adds dependencies.path field in capability.yaml so capabilities can declare additional tool directories for agents running in E2B sandboxes.
   • Supports filtering project memories by session ID via the API, SDK tool, and ApiClient.list_project_memories.
   • Adds file, folder, and pasted-image uploads directly in Web Chat; uploads land in the runtime workspace so the agent can reference them immediately.

   +5 more show less

   • Adds a Memories tab to Sessions showing every memory the session created, updated, closed, or reopened, with links to full memory detail.
   • Binary-analysis capability now emits structured findings and assets — recovered keys, vulnerability root causes, malicious capabilities, extracted payloads, and embedded endpoints — trackable through the review-and-submit workflow.
   • Adds a Share action to Chat session menus so a private session can be made visible to the workspace team without leaving Chat.
   • Eval sample detail page now lists worker sessions the agent started for that attempt, with links to each session in Agent Sessions.
   • Web Chat capabilities picker now shows the installed version of each capability and offers an inline update when a newer version is available.
   • Adds severity_policy parameter to generate_attack so you can define custom risk taxonomies — thresholds, matrices, and aliases — that the agent applies when classifying findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ?tool_call=<id> linkable URL parameter and a View in transcript button in the Media tab to jump directly to the tool call that logged an artifact.
   • Adds dependencies.path field in capability.yaml so capabilities can declare additional tool directories for agents running in E2B sandboxes.
   • Adds file, folder, and pasted-image uploads directly in Web Chat; uploads land in the runtime workspace so the agent can reference them immediately.
   • Adds a Memories tab to Sessions showing every memory the session created, updated, closed, or reopened, with links to full memory detail.

   +2 more show less

   • Adds a Share action to Chat session menus so a private session can be made visible to the workspace team without leaving Chat.
   • Eval sample detail page now lists worker sessions the agent started for that attempt, with links to each session in Agent Sessions.

   3 more in Everything

8. Web Chat Interface Redesign Oct 1, 2026 · issue 106

   Pre-launch sandbox config panel, bulk finding triage, Assessment.record_attack_result() SDK method, dataset attribution metadata in SDK push, bulk memory close/reopen, safe clickable links in agent content.

   • Adds Assessment.record_attack_result() SDK method so custom-target attacks (multistep tool attacks, indirect injection flows) can emit traces and materialize findings in the platform.
   • Adds bulk triage on the Agent Output page — select multiple findings and set their triage status in a single action, with per-row results and a confirmation toast.
   • Adds pre-launch sandbox configuration panel in the web chat session view: teams can choose capabilities, compute, secrets, and idle timeout before a sandbox starts, then inspect its runtime status, installed capabilities, health issues, and logs in a panel beside the chat.
   • Adds dataset attribution metadata to SDK push: datasets now carry license, tags, language, task categories, and source provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., populating the license badge, tag filters, and Source section in the platform.
   • Adds bulk close and reopen for project memories: select multiple memories on the Memories page and close or reopen them via the bulk-action bar.

   +3 more show less

   • Adds safe clickable links in agent content: links in agent messages, tool results, memories, and item notes open a confirmation dialog showing the actual destination before navigating.
   • Adds organization owner management from the org detail page: owners can be added and removed directly, with a confirmation prompt when adding an unrecognized email.
   • Adds a no-model-deployments informational notice on self-hosted installs with no model deployments, shown on the home page and in model-dependent CLI guides.

   8 details in Everything

   • New compliance framework AIRT dataset library — OWASP LLM and Agentic coverage mapping
9. Approve or reject held tool calls in web chat Sep 24, 2026 · issue 085

   Dreadnode adds inline tool-call approvals, eight new agentic probe families, a browsable Tool catalog, and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. runtime log switching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Cap an unattended red-team workflow at a specific step count to bound runaway autonomous execution.
   copy

   $ dn --print --max-steps 50

   • Adds generate_attack support for agentic-probes 2026 attacks in the ai-red-teaming agent, including transforms for argument injection, deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. payloads, RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. poisoning, and covert channels, plus matching evidence-gated scorers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds eight new agentic red-teaming probe families to the SDK: evidence-gated scorers and transforms covering tool-misuse RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., advanced exfiltration, MINJA memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. line-jumping, RAG optimization attacks, and indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. via the new IterInject attack loop.
   • Adds a new provisionable multiagent sandbox target agentic-probes-sandbox for 2026 agentic-probe evaluation families.
   • Press F5 then Tab in the TUI console to switch between local process logs and the connected runtime's server logs, with retained history up to 2,000 entries, level filtering, copy, and save.
   • Adds a browsable Tool catalog in Agent Policies with searchable metadata, copyable IDs, schema fingerprints, and collapsible input schemas for every visible tool and its revision history.

   +14 more show less

   • Held tool calls now appear inline in the conversation transcript with full arguments, the policy reason, and Approve / Reject buttons, replacing the previous generic input card.
   • Adds a new workbench at /beta with a new information architecture across project shell, Hub catalogs (Capabilities, Environments, Datasets, Models), Agent Outputs, and Sessions.
   • Capability tools, hooks, and workers can now use standard package-relative imports instead of relying on flat module names.
   • The capability detail page now shows a workflow graph of how the capability's steps connect.
   • Adds an unread badge on the sidebar account button showing how many release notes have not been seen yet, clearing automatically when Release Notes is opened in Account Settings.
   • Adds --max-steps N with --print for explicit autonomy budgets; unattended workflows (dn --auto, /auto, /background, --print, guard sessions, and web chat Auto/Background) now default to 100 steps.
   • SDK 2.0.47 adds runtime capability health inspection for agents, and model selection for local workflow runs.
   • Transcript headers now show tool policy state (active, disabled, failed, awaiting approval, or not recorded) for both live and past sessions.
   • Associated workflow runs now appear inline on the Workflows page with status, duration, and run ID.
   • Agent cold-start is 93% faster — median agent construction drops from ~5 s to ~0.3 s by deferring heavy imports (pandas, numpy, pyarrow, Optuna) until actually used.
   • E2B sandbox pre-warming bakes server, LiteLLM, agent graph, and first-turn imports into the E2B runtime snapshot, eliminating the largest filesystem-load costs at startup.
   • Trace storage uploads now run in a background pool so the first chat turn no longer waits on credential fetching or object uploads before issuing the first model request.
   • SDK scope validation now runs reads concurrently with exponential backoff and an 8-second shared deadline, reducing validation latency.
   • The workflow run page has a new header, node panel, transcript view, and graph direction controls.
   • Adds generate_attack support for agentic-probes 2026 attacks in the ai-red-teaming agent, including transforms for argument injection, deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. payloads, RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. poisoning, and covert channels, plus matching evidence-gated scorers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds eight new agentic red-teaming probe families to the SDK: evidence-gated scorers and transforms covering tool-misuse RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., advanced exfiltration, MINJA memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. line-jumping, RAG optimization attacks, and indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. via the new IterInject attack loop.
   • Adds a new provisionable multiagent sandbox target agentic-probes-sandbox for 2026 agentic-probe evaluation families.
   • Press F5 then Tab in the TUI console to switch between local process logs and the connected runtime's server logs, with retained history up to 2,000 entries, level filtering, copy, and save.
   • Adds a browsable Tool catalog in Agent Policies with searchable metadata, copyable IDs, schema fingerprints, and collapsible input schemas for every visible tool and its revision history.

   +5 more show less

   • Adds a new workbench at /beta with a new information architecture across project shell, Hub catalogs (Capabilities, Environments, Datasets, Models), Agent Outputs, and Sessions.
   • The capability detail page now shows a workflow graph of how the capability's steps connect.
   • Adds an unread badge on the sidebar account button showing how many release notes have not been seen yet, clearing automatically when Release Notes is opened in Account Settings.
   • SDK 2.0.47 adds runtime capability health inspection for agents, and model selection for local workflow runs.
   • Transcript headers now show tool policy state (active, disabled, failed, awaiting approval, or not recorded) for both live and past sessions.

   9 more in Everything

10. Workflows are now in open beta Sep 17, 2026 · issue 085

    Dreadnode Workflows enter open beta with CLI/SDK/UI pipelines, Slack integration, and a built-in agent runtime health tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Connect your Dreadnode org to Slack so your team can trigger and watch agent sessions without leaving their chat workspace.
    📍In the Dreadnode UI, go to Settings → Integrations and connect your Slack workspace. Once connected, @mention the agent in any channel to stream a full session in-thread. Use the link posted in-thread to open the session in Agents → Sessions.
    • Adds a runtime_info built-in tool agents can call to inspect which capabilities are loaded, enabled, and healthy — including failed loads and component health — without exposing raw config or credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Workflows in open beta: define, run, and inspect multi-step agent pipelines from the CLI, SDK, and a new Workflows section in the UI, with project-scoped catalog, stable graphs, inline CLI guide, and model selection at run time.
    • Adds Slack integration: org owners connect a workspace via Settings → Integrations, then @mention an agent to stream a full session in-thread with stop support and a direct link back to the session in Agents → Sessions.
    • Adds a memory creation panel and form on the Memories page so memories can be created directly from the UI.
    • Adds organization avatars: owners can set an avatar in Settings by choosing one of five color presets, uploading a PNG, JPEG, or SVG, or falling back to the org name initial.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SDK now requires websockets 15.0.1 or later; environments running websockets 14.x will fail at fastmcp initialization.
11. Traditional ML attack targets now available across all organizations Sep 10, 2026 · issue 071

    Dreadnode adds traditional ML attack targets, light TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. theme, /reload and /transcript chat commands, and bulk workspace membership across all orgs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Provision a public ML attack target by bare task name — no org prefix required — to kick off a membership inference campaign.
    copy

    $ dreadnode env provision ml-extraction-fraud-tabular

    • Set DREADNODE_TUI_THEME=light to switch the TUI from its default dark palette to a light theme.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds /reload slash command in chat sessions to reload the current agent without leaving the session.
    • Adds /transcript command in the TUI to toggle between compact and full agent transcript views.
    • Adds provision as an accepted alias for create in dreadnode env, and bare public task names (e.g. ml-extraction-fraud-tabular) now resolve without requiring an org prefix.
    • Three traditional ML attack targets — fraud tabular, MNIST image, and IMDB text — are now available across all organizations, covering extraction, membership inference, evasion, and inversion attack types, provisionable by name via the SDK or TUI.

    +8 more show less

    • Adds a Release Notes section in Account Settings listing the ten most recent changelog entries with links to full docs, on both SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and self-hosted installs.
    • Capability detail view and install picker now display which credentials a capability requires before installation.
    • Adds a direct link to the system status page in the Support tab of Account Settings on SaaS deployments.
    • Bulk workspace member addition now lets you select and add multiple members to a workspace at once from the workspace settings page.
    • Session responses now include attribution for who shared a session with the workspace and when, covering all share paths including bulk promotion and creation-time visibility.
    • AIRT assessments and findings now display the workspace member who ran each assessment.
    • Each session in the chat session list now displays a message count.
    • Runtime cold start reduced by more than 60%, dropping time-to-ready from 18.8 s to 6.6 s.
    • Set DREADNODE_TUI_THEME=light to switch the TUI from its default dark palette to a light theme.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds /reload slash command in chat sessions to reload the current agent without leaving the session.
    • Adds /transcript command in the TUI to toggle between compact and full agent transcript views.
    • Three traditional ML attack targets — fraud tabular, MNIST image, and IMDB text — are now available across all organizations, covering extraction, membership inference, evasion, and inversion attack types, provisionable by name via the SDK or TUI.
    • Adds a Release Notes section in Account Settings listing the ten most recent changelog entries with links to full docs, on both SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and self-hosted installs.

    +2 more show less

    • Adds a direct link to the system status page in the Support tab of Account Settings on SaaS deployments.
    • Bulk workspace member addition now lets you select and add multiple members to a workspace at once from the workspace settings page.

    6 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The workspace_mount runtime option is now a no-op; /home/user/workspace is ordinary sandbox-local storage. Object-storage access must go through the SDK.
12. Traditional ML attack targets now available across all organizations Sep 10, 2026 · issue 012

    Dreadnode adds traditional ML attack targets, light TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. theme, /reload and /transcript chat commands, and bulk workspace membership across all orgs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Provision a public ML attack target by bare task name — no org prefix required — to kick off a membership inference campaign.
    copy

    $ dreadnode env provision ml-extraction-fraud-tabular

    • Set DREADNODE_TUI_THEME=light to switch the TUI from its default dark palette to a light theme.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds /reload slash command in chat sessions to reload the current agent without leaving the session.
    • Adds /transcript command in the TUI to toggle between compact and full agent transcript views.
    • Adds provision as an accepted alias for create in dreadnode env, and bare public task names (e.g. ml-extraction-fraud-tabular) now resolve without requiring an org prefix.
    • Three traditional ML attack targets — fraud tabular, MNIST image, and IMDB text — are now available across all organizations, covering extraction, membership inference, evasion, and inversion attack types, provisionable by name via the SDK or TUI.

    +8 more show less

    • Adds a Release Notes section in Account Settings listing the ten most recent changelog entries with links to full docs, on both SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and self-hosted installs.
    • Capability detail view and install picker now display which credentials a capability requires before installation.
    • Adds a direct link to the system status page in the Support tab of Account Settings on SaaS deployments.
    • Bulk workspace member addition now lets you select and add multiple members to a workspace at once from the workspace settings page.
    • Session responses now include attribution for who shared a session with the workspace and when, covering all share paths including bulk promotion and creation-time visibility.
    • AIRT assessments and findings now display the workspace member who ran each assessment.
    • Each session in the chat session list now displays a message count.
    • Runtime cold start reduced by more than 60%, dropping time-to-ready from 18.8 s to 6.6 s.
    • Set DREADNODE_TUI_THEME=light to switch the TUI from its default dark palette to a light theme.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds /reload slash command in chat sessions to reload the current agent without leaving the session.
    • Adds /transcript command in the TUI to toggle between compact and full agent transcript views.
    • Three traditional ML attack targets — fraud tabular, MNIST image, and IMDB text — are now available across all organizations, covering extraction, membership inference, evasion, and inversion attack types, provisionable by name via the SDK or TUI.
    • Adds a Release Notes section in Account Settings listing the ten most recent changelog entries with links to full docs, on both SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and self-hosted installs.

    +2 more show less

    • Adds a direct link to the system status page in the Support tab of Account Settings on SaaS deployments.
    • Bulk workspace member addition now lets you select and add multiple members to a workspace at once from the workspace settings page.

    6 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The workspace_mount runtime option is now a no-op; /home/user/workspace is ordinary sandbox-local storage. Object-storage access must go through the SDK.
13. Offline SDK and CLI install for air-gapped deployments Sep 3, 2026 · issue 071

    Dreadnode adds offline SDK/CLI bundles, a Global Tool Registry API, multi-agent red-teaming tasks, and Cloudflare Workers OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. support for air-gapped deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Enumerate all registered tools in your organization to audit capability surface before a red-team engagement.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/api/v1/tools | jq '.[].id'

    Inspect the cold-start timing breakdown on a slow runtime to attribute whether delay is provider provisioning or package install.
    copy

    $ dn runtime start && curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/runtimes/<id> | jq '.timing'

    Inject an internal CA into the Node frontend on a self-hosted air-gapped deployment so TLS to an on-prem model proxy is trusted.
    values.yaml copy

    caBundle: |
      -----BEGIN CERTIFICATE-----
      <your-internal-CA-cert>
      -----END CERTIFICATE-----

    • Adds GET /api/v1/tools and GET /api/v1/tools/{tool_id} endpoints to query the new Global Tool Registry, giving published capability Python tools and command wrappers stable, organization-scoped identities with immutable revision history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds caBundle config key for self-hosted deployments to inject a custom CA bundle into the Node frontend, completing CA trust support across all workloads (API, LiteLLM, and frontend).
    • Surfaces full cold-start timing breakdown (total, platform overhead, provider provisioning, boot, installs, slowest step) via dn runtime start and GET /runtimes/{id}.
    • Serves the SDK and CLI as self-contained offline bundles from self-hosted deployments, enabling install without reaching PyPI or any external host.
    • Serves documentation at /docs inside every deployment for air-gapped and on-prem operators.

    +13 more show less

    • Adds organization-owner-configurable lifetime credit cap per non-owner member, visible to capped members under Settings → Billing.
    • Adds bulk share-with-workspace action for multiple agent sessions via the floating action bar.
    • Adds Cloudflare Workers support via wrangler to the web-security capability for deploying programmable OAST endpoints, enabling blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payload hosting, callback logging, and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. chain redirection.
    • Adds signup IP allow-list mode letting admins restrict new account creation to explicitly approved IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges with deny rules taking precedence.
    • Adds 12 multi-agent AI red-teaming tasks covering access-control bypass, indirect injection, memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. poisoning, reasoning hijack, supply-chain, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., DevOps RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., and sector-specific meshes to the task catalog under the airt-generative-ai set.
    • Adds an indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. web task where agents must detect injections hidden via HTML comments, hidden CSS, off-screen ARIA, white-on-white text, and Unicode tags across a public web page.
    • Adds an agentic CI/CD secret-exfiltration multiagent task simulating hidden instructions in untrusted repo content that cause a CI assistant to leak its deploy secret.
    • Adds a multi-step tool attack sandbox task featuring an over-permissioned agent with file, database, email, and HTTP tools where success requires chaining a sensitive data source to an external exfiltration sink.
    • Adds two honeytoken tools to the ai-red-teaming capability: mint canary tokens (exfil or RCE variants) and check whether a target agent leaked them across an output boundary.
    • Adds algorithmic multi-step tool-attack search to the AI red-teaming agent for finding replay-stable read-then-exfiltrate causal paths across HTTP agent tool call chains.
    • Adds a turnkey OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.-ASI agentic attack suite runner, argument-aware tool-evidence scoring, and a honeytoken harness for black-box exfil and RCE detection to the SDK.
    • Adds environment-agnostic attack-success detection to the airt SDK using canary exfiltration, OAST beacons, dataflow taint, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.
    • Adds SDK transforms and scorers covering search-query and trusted-domain image exfiltration channels plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.
    • Adds GET /api/v1/tools and GET /api/v1/tools/{tool_id} endpoints to query the new Global Tool Registry, giving published capability Python tools and command wrappers stable, organization-scoped identities with immutable revision history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Serves the SDK and CLI as self-contained offline bundles from self-hosted deployments, enabling install without reaching PyPI or any external host.
    • Serves documentation at /docs inside every deployment for air-gapped and on-prem operators.
    • Adds organization-owner-configurable lifetime credit cap per non-owner member, visible to capped members under Settings → Billing.
    • Adds bulk share-with-workspace action for multiple agent sessions via the floating action bar.

    +11 more show less

    • Adds Cloudflare Workers support via wrangler to the web-security capability for deploying programmable OAST endpoints, enabling blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payload hosting, callback logging, and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. chain redirection.
    • Adds signup IP allow-list mode letting admins restrict new account creation to explicitly approved IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges with deny rules taking precedence.
    • Adds 12 multi-agent AI red-teaming tasks covering access-control bypass, indirect injection, memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. poisoning, reasoning hijack, supply-chain, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., DevOps RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., and sector-specific meshes to the task catalog under the airt-generative-ai set.
    • Adds an indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. web task where agents must detect injections hidden via HTML comments, hidden CSS, off-screen ARIA, white-on-white text, and Unicode tags across a public web page.
    • Adds an agentic CI/CD secret-exfiltration multiagent task simulating hidden instructions in untrusted repo content that cause a CI assistant to leak its deploy secret.
    • Adds a multi-step tool attack sandbox task featuring an over-permissioned agent with file, database, email, and HTTP tools where success requires chaining a sensitive data source to an external exfiltration sink.
    • Adds two honeytoken tools to the ai-red-teaming capability: mint canary tokens (exfil or RCE variants) and check whether a target agent leaked them across an output boundary.
    • Adds algorithmic multi-step tool-attack search to the AI red-teaming agent for finding replay-stable read-then-exfiltrate causal paths across HTTP agent tool call chains.
    • Adds a turnkey OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.-ASI agentic attack suite runner, argument-aware tool-evidence scoring, and a honeytoken harness for black-box exfil and RCE detection to the SDK.
    • Adds environment-agnostic attack-success detection to the airt SDK using canary exfiltration, OAST beacons, dataflow taint, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.
    • Adds SDK transforms and scorers covering search-query and trusted-domain image exfiltration channels plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.

    2 more in Everything

14. Offline SDK and CLI install for air-gapped deployments Sep 3, 2026 · issue 012

    Dreadnode adds offline SDK/CLI bundles, a Global Tool Registry API, multi-agent red-teaming tasks, and Cloudflare Workers OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. support for air-gapped deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Enumerate all registered tools in your organization to audit capability surface before a red-team engagement.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/api/v1/tools | jq '.[].id'

    Inspect the cold-start timing breakdown on a slow runtime to attribute whether delay is provider provisioning or package install.
    copy

    $ dn runtime start && curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/runtimes/<id> | jq '.timing'

    Inject an internal CA into the Node frontend on a self-hosted air-gapped deployment so TLS to an on-prem model proxy is trusted.
    values.yaml copy

    caBundle: |
      -----BEGIN CERTIFICATE-----
      <your-internal-CA-cert>
      -----END CERTIFICATE-----

    • Adds GET /api/v1/tools and GET /api/v1/tools/{tool_id} endpoints to query the new Global Tool Registry, giving published capability Python tools and command wrappers stable, organization-scoped identities with immutable revision history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds caBundle config key for self-hosted deployments to inject a custom CA bundle into the Node frontend, completing CA trust support across all workloads (API, LiteLLM, and frontend).
    • Surfaces full cold-start timing breakdown (total, platform overhead, provider provisioning, boot, installs, slowest step) via dn runtime start and GET /runtimes/{id}.
    • Serves the SDK and CLI as self-contained offline bundles from self-hosted deployments, enabling install without reaching PyPI or any external host.
    • Serves documentation at /docs inside every deployment for air-gapped and on-prem operators.

    +13 more show less

    • Adds organization-owner-configurable lifetime credit cap per non-owner member, visible to capped members under Settings → Billing.
    • Adds bulk share-with-workspace action for multiple agent sessions via the floating action bar.
    • Adds Cloudflare Workers support via wrangler to the web-security capability for deploying programmable OAST endpoints, enabling blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payload hosting, callback logging, and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. chain redirection.
    • Adds signup IP allow-list mode letting admins restrict new account creation to explicitly approved IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges with deny rules taking precedence.
    • Adds 12 multi-agent AI red-teaming tasks covering access-control bypass, indirect injection, memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. poisoning, reasoning hijack, supply-chain, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., DevOps RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., and sector-specific meshes to the task catalog under the airt-generative-ai set.
    • Adds an indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. web task where agents must detect injections hidden via HTML comments, hidden CSS, off-screen ARIA, white-on-white text, and Unicode tags across a public web page.
    • Adds an agentic CI/CD secret-exfiltration multiagent task simulating hidden instructions in untrusted repo content that cause a CI assistant to leak its deploy secret.
    • Adds a multi-step tool attack sandbox task featuring an over-permissioned agent with file, database, email, and HTTP tools where success requires chaining a sensitive data source to an external exfiltration sink.
    • Adds two honeytoken tools to the ai-red-teaming capability: mint canary tokens (exfil or RCE variants) and check whether a target agent leaked them across an output boundary.
    • Adds algorithmic multi-step tool-attack search to the AI red-teaming agent for finding replay-stable read-then-exfiltrate causal paths across HTTP agent tool call chains.
    • Adds a turnkey OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.-ASI agentic attack suite runner, argument-aware tool-evidence scoring, and a honeytoken harness for black-box exfil and RCE detection to the SDK.
    • Adds environment-agnostic attack-success detection to the airt SDK using canary exfiltration, OAST beacons, dataflow taint, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.
    • Adds SDK transforms and scorers covering search-query and trusted-domain image exfiltration channels plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.
    • Adds GET /api/v1/tools and GET /api/v1/tools/{tool_id} endpoints to query the new Global Tool Registry, giving published capability Python tools and command wrappers stable, organization-scoped identities with immutable revision history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Serves the SDK and CLI as self-contained offline bundles from self-hosted deployments, enabling install without reaching PyPI or any external host.
    • Serves documentation at /docs inside every deployment for air-gapped and on-prem operators.
    • Adds organization-owner-configurable lifetime credit cap per non-owner member, visible to capped members under Settings → Billing.
    • Adds bulk share-with-workspace action for multiple agent sessions via the floating action bar.

    +11 more show less

    • Adds Cloudflare Workers support via wrangler to the web-security capability for deploying programmable OAST endpoints, enabling blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payload hosting, callback logging, and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. chain redirection.
    • Adds signup IP allow-list mode letting admins restrict new account creation to explicitly approved IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges with deny rules taking precedence.
    • Adds 12 multi-agent AI red-teaming tasks covering access-control bypass, indirect injection, memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. poisoning, reasoning hijack, supply-chain, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., DevOps RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., and sector-specific meshes to the task catalog under the airt-generative-ai set.
    • Adds an indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. web task where agents must detect injections hidden via HTML comments, hidden CSS, off-screen ARIA, white-on-white text, and Unicode tags across a public web page.
    • Adds an agentic CI/CD secret-exfiltration multiagent task simulating hidden instructions in untrusted repo content that cause a CI assistant to leak its deploy secret.
    • Adds a multi-step tool attack sandbox task featuring an over-permissioned agent with file, database, email, and HTTP tools where success requires chaining a sensitive data source to an external exfiltration sink.
    • Adds two honeytoken tools to the ai-red-teaming capability: mint canary tokens (exfil or RCE variants) and check whether a target agent leaked them across an output boundary.
    • Adds algorithmic multi-step tool-attack search to the AI red-teaming agent for finding replay-stable read-then-exfiltrate causal paths across HTTP agent tool call chains.
    • Adds a turnkey OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.-ASI agentic attack suite runner, argument-aware tool-evidence scoring, and a honeytoken harness for black-box exfil and RCE detection to the SDK.
    • Adds environment-agnostic attack-success detection to the airt SDK using canary exfiltration, OAST beacons, dataflow taint, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.
    • Adds SDK transforms and scorers covering search-query and trusted-domain image exfiltration channels plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.

    2 more in Everything

15. Web Chat open to all users Aug 27, 2026 · issue 071

    Dreadnode opens Web Chat to all users, adds air-gap deployment, HTTP desyncHTTP desyncAn attack technique that exploits disagreements between a front-end proxy and a back-end server about where one HTTP request ends and the next begins, letting an attacker poison the request queue and hijack other users' traffic. detection, IP rotation, geo-DNSgeo-DNSA DNS service that returns different answers based on the requester's geographic location, letting cyber tools route users to the nearest or most appropriate server automatically., and LSB steganographyLSB steganographyA data-hiding technique that encodes secret bytes into the least-significant bits of image, audio, or video samples, making changes imperceptible to human senses while preserving a covert channel inside ordinary files. in web-security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Check your current session context at a glance in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. without leaving the chat interface.
    copy

    $ /status

    List only the runtimes you own to avoid acting on a colleague's shared runtime in a multi-user workspace.
    copy

    $ dn runtime ls --mine

    Prevent the Replicated SDK pod from phoning home during a Helm-based air-gap install in a disconnected environment.
    copy

    $ helm upgrade --install dreadnode ./dreadnode-chart --set replicated.isAirgap=true

    • Adds replicated.isAirgap=true Helm CLI setting to prevent the Replicated SDK pod from attempting outbound connections to replicated.app in air-gapped installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --mine flag to dn runtime ls to filter runtimes to only those you own; also marks runtimes you do not own in the default listing.
    • Adds /status slash command to the TUI, displaying current session, model, user, org, workspace, and project at a glance.
    • Adds IP rotation tool to the web-security capability, deploying Cloudflare Worker proxies on demand for round-robin egress through rotating IPs during engagements.
    • Adds HTTP desync and request-smuggling detection to the web-security capability, covering 11 smuggling families with fingerprinting, payload construction, cache-poisoning detection, and victim-response classification.

    +10 more show less

    • Adds geo-distributed DNS resolution to the web-security capability, resolving target hostnames through open resolvers in multiple countries (via Shodan or Censys) to detect geo-fenced infrastructure, GSLB routing, and region-locked DNS responses.
    • Adds LSB steganography support for PNG images to the web-security capability, enabling payload-smuggling tests and upload pipeline inspection via the built-in Python tool.
    • Adds air-gap deployment mode that vendors all front-end resources locally, hides the analytics notebook, serves model pricing from a bundled catalog, and pre-bakes capability dependencies into the runtime image so sandbox boot requires no network access.
    • Adds support to self-hosted Helm charts for non-root container execution and custom CA bundle mounts for outbound TLS trust in private-CA environments.
    • Adds bulk archive and unarchive for agent sessions from the Sessions tab, with context-aware actions for active, archived, or mixed selections.
    • Surfaces failed capability preflight checks (e.g. missing dnsx, katana) as explicit warnings in the agent system prompt and operator logs instead of silently proceeding.
    • Expands postMessage handler detection in the web-security capability's DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. analysis to cover window.onmessage, MessagePort/MessageChannel, and monitoring-shim wrappers, plus additional origin-validation bypass patterns including unescaped-dot and missing-anchor regex bugs.
    • Adds guard invocation highlighting in session transcripts, showing policy decisions inline within the conversation view.
    • Adds pagination and full-text search by title, model, agent, and label to the chat session list, removing the previous 100-session cap.
    • Adds six new documentation pages covering Web Chat: overview, quickstart, sessions, runtimes, agents and models, and slash commands.
    • Adds replicated.isAirgap=true Helm CLI setting to prevent the Replicated SDK pod from attempting outbound connections to replicated.app in air-gapped installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds /status slash command to the TUI, displaying current session, model, user, org, workspace, and project at a glance.
    • Adds IP rotation tool to the web-security capability, deploying Cloudflare Worker proxies on demand for round-robin egress through rotating IPs during engagements.
    • Adds HTTP desync and request-smuggling detection to the web-security capability, covering 11 smuggling families with fingerprinting, payload construction, cache-poisoning detection, and victim-response classification.
    • Adds geo-distributed DNS resolution to the web-security capability, resolving target hostnames through open resolvers in multiple countries (via Shodan or Censys) to detect geo-fenced infrastructure, GSLB routing, and region-locked DNS responses.

    +5 more show less

    • Adds LSB steganography support for PNG images to the web-security capability, enabling payload-smuggling tests and upload pipeline inspection via the built-in Python tool.
    • Adds air-gap deployment mode that vendors all front-end resources locally, hides the analytics notebook, serves model pricing from a bundled catalog, and pre-bakes capability dependencies into the runtime image so sandbox boot requires no network access.
    • Adds bulk archive and unarchive for agent sessions from the Sessions tab, with context-aware actions for active, archived, or mixed selections.
    • Adds guard invocation highlighting in session transcripts, showing policy decisions inline within the conversation view.
    • Adds six new documentation pages covering Web Chat: overview, quickstart, sessions, runtimes, agents and models, and slash commands.

    5 more in Everything

16. Web Chat open to all users Aug 27, 2026 · issue 012

    Dreadnode opens Web Chat to all users, adds air-gap deployment, HTTP desyncHTTP desyncAn attack technique that exploits disagreements between a front-end proxy and a back-end server about where one HTTP request ends and the next begins, letting an attacker poison the request queue and hijack other users' traffic. detection, IP rotation, geo-DNSgeo-DNSA DNS service that returns different answers based on the requester's geographic location, letting cyber tools route users to the nearest or most appropriate server automatically., and LSB steganographyLSB steganographyA data-hiding technique that encodes secret bytes into the least-significant bits of image, audio, or video samples, making changes imperceptible to human senses while preserving a covert channel inside ordinary files. in web-security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Check your current session context at a glance in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. without leaving the chat interface.
    copy

    $ /status

    List only the runtimes you own to avoid acting on a colleague's shared runtime in a multi-user workspace.
    copy

    $ dn runtime ls --mine

    Prevent the Replicated SDK pod from phoning home during a Helm-based air-gap install in a disconnected environment.
    copy

    $ helm upgrade --install dreadnode ./dreadnode-chart --set replicated.isAirgap=true

    • Adds replicated.isAirgap=true Helm CLI setting to prevent the Replicated SDK pod from attempting outbound connections to replicated.app in air-gapped installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --mine flag to dn runtime ls to filter runtimes to only those you own; also marks runtimes you do not own in the default listing.
    • Adds /status slash command to the TUI, displaying current session, model, user, org, workspace, and project at a glance.
    • Adds IP rotation tool to the web-security capability, deploying Cloudflare Worker proxies on demand for round-robin egress through rotating IPs during engagements.
    • Adds HTTP desync and request-smuggling detection to the web-security capability, covering 11 smuggling families with fingerprinting, payload construction, cache-poisoning detection, and victim-response classification.

    +10 more show less

    • Adds geo-distributed DNS resolution to the web-security capability, resolving target hostnames through open resolvers in multiple countries (via Shodan or Censys) to detect geo-fenced infrastructure, GSLB routing, and region-locked DNS responses.
    • Adds LSB steganography support for PNG images to the web-security capability, enabling payload-smuggling tests and upload pipeline inspection via the built-in Python tool.
    • Adds air-gap deployment mode that vendors all front-end resources locally, hides the analytics notebook, serves model pricing from a bundled catalog, and pre-bakes capability dependencies into the runtime image so sandbox boot requires no network access.
    • Adds support to self-hosted Helm charts for non-root container execution and custom CA bundle mounts for outbound TLS trust in private-CA environments.
    • Adds bulk archive and unarchive for agent sessions from the Sessions tab, with context-aware actions for active, archived, or mixed selections.
    • Surfaces failed capability preflight checks (e.g. missing dnsx, katana) as explicit warnings in the agent system prompt and operator logs instead of silently proceeding.
    • Expands postMessage handler detection in the web-security capability's DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. analysis to cover window.onmessage, MessagePort/MessageChannel, and monitoring-shim wrappers, plus additional origin-validation bypass patterns including unescaped-dot and missing-anchor regex bugs.
    • Adds guard invocation highlighting in session transcripts, showing policy decisions inline within the conversation view.
    • Adds pagination and full-text search by title, model, agent, and label to the chat session list, removing the previous 100-session cap.
    • Adds six new documentation pages covering Web Chat: overview, quickstart, sessions, runtimes, agents and models, and slash commands.
    • Adds replicated.isAirgap=true Helm CLI setting to prevent the Replicated SDK pod from attempting outbound connections to replicated.app in air-gapped installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds /status slash command to the TUI, displaying current session, model, user, org, workspace, and project at a glance.
    • Adds IP rotation tool to the web-security capability, deploying Cloudflare Worker proxies on demand for round-robin egress through rotating IPs during engagements.
    • Adds HTTP desync and request-smuggling detection to the web-security capability, covering 11 smuggling families with fingerprinting, payload construction, cache-poisoning detection, and victim-response classification.
    • Adds geo-distributed DNS resolution to the web-security capability, resolving target hostnames through open resolvers in multiple countries (via Shodan or Censys) to detect geo-fenced infrastructure, GSLB routing, and region-locked DNS responses.

    +5 more show less

    • Adds LSB steganography support for PNG images to the web-security capability, enabling payload-smuggling tests and upload pipeline inspection via the built-in Python tool.
    • Adds air-gap deployment mode that vendors all front-end resources locally, hides the analytics notebook, serves model pricing from a bundled catalog, and pre-bakes capability dependencies into the runtime image so sandbox boot requires no network access.
    • Adds bulk archive and unarchive for agent sessions from the Sessions tab, with context-aware actions for active, archived, or mixed selections.
    • Adds guard invocation highlighting in session transcripts, showing policy decisions inline within the conversation view.
    • Adds six new documentation pages covering Web Chat: overview, quickstart, sessions, runtimes, agents and models, and slash commands.

    5 more in Everything

17. Kubernetes Gateway API support for on-prem installs Aug 20, 2026 · issue 056

    Dreadnode adds Kubernetes Gateway API routing, a Caido TypeScript SDK skill, new web-security attacks, bulk session freeze, and media previews.

    └──▷ TRY IT
    Use a paid webhook.site account in the callback tool to avoid anonymous rate limits during web-security agent runs.
    copy

    $ export WEBHOOK_SITE_API_KEY=your-api-key-here

    • Adds WEBHOOK_SITE_API_KEY environment variable to the web-security callback tool, enabling a paid webhook.site account to bypass rate limits while preserving anonymous and interactsh fallback.
    • Supports Kubernetes Gateway API (HTTPRoute) routing for on-prem deployments, enabling installations on Istio, Envoy Gateway, and Cilium stacks instead of relying on Ingress.
    • Adds a caido-mode skill in the web-security capability, exposing the full Caido TypeScript SDK — including Match & Replace rules, replay sessions, HTTPQL history search, findings management, and curl-through-Caido testing — from within an agent.
    • Adds three new web-security attack skills: SQL-injection-to-RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. escalation, MathJaxMathJaxAn open-source JavaScript library that renders LaTeX and MathML math notation in web browsers, giving cyber tools a reliable way to display formatted equations without server-side processing./KaTeX macro injection, and an ORB/XS-Leak browser side-channel via service-worker fetch proxy.
    • Enables bulk freeze of multiple agent sessions from the Agent Sessions tab, with a confirmation dialog before sessions are affected.

    +3 more show less

    • Embeds image, audio, and video previews directly in the output panel alongside existing field data.
    • Adds ATIF dataset and replay downloads in the Worlds UI: download the full ATIF dataset from Worlds → Jobs, or export the normalized replay payload as JSON from the Trajectories page.
    • Adds typed DELETE-{count} challenge confirmation for bulk and single-row session deletes, guarding against accidental permanent deletion.

    8 details in Everything

18. Versioned item type registry for structured agent output seen Aug 19, 2026 · issue 050

    Dreadnode adds a versioned item type registry, ScopeGuard in remote/headless sessions, Caido MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, and a response-queue-poisoning skill.

    • Adds a versioned item type registry backing structured agent output: platform admins can define, publish, and manage structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. contracts (findings, assets, and custom types) via Operations → Objects, with capabilities binding to approved registry versions and all item writes validated against the canonical schema.
    • Adds ScopeGuard policy support in remote and headless sessions via the SDK (experimental); the session UI renders tool-call policy decisions when ScopeGuard metadata is present — opt-in, with no workspace setting or picker entry yet.
    • Adds the full Caido MCP server (66 tools, 6 resources) as a second MCP server in the web-security capability, alongside the existing Python wrapper, both targeting the same Caido instance.
    • Adds a response-queue-poisoning skill to the web-security capability, covering CRLF-powered desync attacks including response queue poisoning and request tunnelling via HTTP header injection.
    • Adds a spinner (or plain status line in non-interactive output) to dn evaluation create while the evaluation is being submitted.

    +6 more show less

    • Adds bulk session delete: multiple agent sessions can now be selected and deleted together, with deleted sessions disappearing from the list immediately without a page refresh.
    • Adds a new sandbox isolation reference page covering Firecracker compute isolation, application authentication, public sandbox routing, outbound internet access, credential scope, and shared responsibility.
    • Adds a --include-public flag documentation clarification for Hub browse pages (Datasets, Models, Capabilities, Environments), distinguishing CLI --include-public behavior from the Public scope tab.
    • Redesigns the capabilities UI with improved navigation, richer detail views for agents, skills, and MCP servers, and a new file browser for capability contents.
    • Makes the model slug visible by default in session metadata so the exact model used is identifiable without extra clicks.
    • Reader-role orgs are now visibly marked and disabled in the New Workspace dialog to prevent 403 errors on form submission.

    11 details in Everything

19. Versioned item type registry for structured agent output Aug 13, 2026 · release notes

    New versioned item type registry for structured agent output and ScopeGuard in remote sessions.

    • Adds a versioned item type registry for agent output, allowing admins to define schemas via Operations → Objects
    • Enables ScopeGuard policy usage in remote and headless sessions via the SDK
    • Includes full Caido MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server (66 tools) in web-security capability alongside existing Python wrapper
    • Adds bulk session deletion with immediate list update
    • Adds response-queue-poisoning skill covering CRLF-powered desync attacks

    +1 more show less

    • Displays model slug by default in session metadata

    6 details in Everything

20. Model deployment visibility control Aug 6, 2026 · release notes

    Dreadnode adds explicit hidden model visibility control, clickable stat-card filters for Agent Outputs, and media gallery color coding.

    └──▷ HOW TO FIND IT
    Filter Agent Outputs to show only items requiring review.
    📍Click the Needs review stat card on the Agent Outputs page
    • Adds hidden attribute to models; operators set this explicitly to hide models from pickers, member grants, and SDK keys
    • Agent Outputs page stat cards (Needs review, Critical + High) are now clickable filter toggles
    • Session Media gallery adds color coding by media kind and improved layout

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Model visibility no longer uses name-prefix convention; operators must use the hidden attribute to hide models
21. Agent memory, triage, and session monitoring overhaul seen Aug 4, 2026 · issue 035

    Dreadnode adds agent memory UI, five data-integration connectors, air-gapped hub sync commands, ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based JS/TS analysis, and in-place finding triage.

    └──▷ TRY IT
    File a bug report from the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. immediately after a crash without losing session logs.
    copy

    $ /report-bug

    • Adds dn capability sync and dn task sync CLI commands to pull hub content from SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. (or another on-prem) into a local directory and push it to a self-hosted instance, enabling air-gapped on-prem loading.
    • Adds /report-bug command (or r in console) to the TUI, assembling a privacy-reviewed diagnostic bundle and submitting it without losing logs after a crash.
    • Adds the llm-wiki capability (compiles source material into linked wiki pages) and analysis-ledger capability (maintains a resumable code-analysis frontier with evidence-bearing claims).
    • Adds five data-integration connectors — Atlassian, Azure DevOps, GitHub, GitLab, and Linear — as platform capabilities.
    • Adds AST-based JS/TS static analysis via ast-grep in the web-security runtime, removing the need for semgrep, CodeQL, or a jxscout license.

    +9 more show less

    • Adds an Inactive filter to Agent Sessions to isolate sessions idle past 15 minutes but not yet archived.
    • New Memories page under Agents lets operators view, inspect, and manage project memory entries, including version history and diffs.
    • Enables finding triage (status and notes) directly from a finding's detail panel in Agent Output.
    • Session monitoring redesigned: adds a Last Msg relative-activity column, highlights sessions active in the last 15 minutes, and adds forward/backward transcript pagination with tailing mode.
    • Stat cards for Needs review and Critical + High on the Agent Outputs page are now clickable filter toggles; the items grid gains a sortable Updated column.
    • Sessions group-by control (None / Workflow / Capability / Agent / Source) is now available to all orgs, with workflow runs collapsed by default.
    • Models and Datasets Hub browse pages add a table view alongside cards, with a unified toolbar offering separate sort and filter controls across all four Hub browse pages.
    • New workspace dialog includes an organization picker to create a workspace in any org without switching context.
    • Agent Output items from failed report_item POSTs are automatically recovered from span backups when a session is frozen.

    14 details in Everything

22. Traditional-ML red teaming suite — evasion, extraction, membership inference, and model inversion in one platform seen Aug 4, 2026 · issue 035

    Dreadnode adds 20+ traditional-ML attacks, dn airt run-classifier CLI, multi-agent ATLAS campaigns, and eval agent selection to its red teaming platform.

    └──▷ TRY IT
    Pin a specific agent to an evaluation run so results are reproducible and the run report identifies which agent executed.
    copy

    $ dn evaluation create --agent <name>

    Increase the number of project memories available at session start beyond the default of 20 to give agents broader context on large engagements.
    copy

    $ dn ... --project-memory-preload-limit 100

    • New dn airt run-classifier CLI command runs classic-ML attacks — evasion, extraction, membership inference, and model inversion — directly against a predict endpoint without SDK code.
    • New dn evaluation create --agent <name> flag specifies which agent runs in an evaluation; eval output reports which agent actually ran.
    • New --project-memory-preload-limit flag sets the number of memories preloaded at session start (range: 1–200), replacing a hardcoded default of 20.
    • Adds four traditional-ML attack families (evasion, extraction, membership inference, model inversion) to AIRT, covering 20+ named attacks — including equation-solving, Jacobian, copycat, knockoff, PWWS, BAE, TextBugger, threshold, and label-only — across tabular, image, and text modalities, with per-finding metrics, adversarial trajectory traces, and MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling./SAIF/NIST compliance mappings.
    • Adds model inversion attacks that reconstruct class-representative inputs via black-box queries to surface privacy risks, completing the fourth traditional-ML attack category in AIRT.

    +9 more show less

    • Adds the ATLAS multi-agent attack framework for running adaptive campaigns against deployed multi-agent environments across three attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources., with executed tool calls captured per-trial and surfaced in findings across the UI, API, and SDK.
    • Agent Output now functions as a severity-first triage workspace — searches, sorts, and filters an engagement's findings; each finding can be exported to CSV, deep-linked, or copied into a report.
    • New executive/CISO summary panel on the assessment view shows attack-surface posture, query cost to compromise, risk score, and a plain-English headline for stakeholder reporting.
    • Richer privacy-attack metrics in findings: extraction findings include KL divergence and accuracy retention; membership inference includes attack accuracy, precision, and recall; model inversion includes reconstruction quality.
    • New dedicated media gallery collects all images and other media logged by a session's tools in one place for reviewers.
    • New web-security initial-recon skill provides structured reconnaissance for domain, wildcard, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., IP-list, and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. entry points using the ProjectDiscovery toolchain.
    • Evaluation runtime now records the health of all runtime components (broken tools, skills, policies) at run time, so degraded capabilities are visible after the fact.
    • Five self-contained AIRT demo notebooks cover model evasion, extraction, membership inference, jailbreaks, and multi-agent attacks — runnable via dn login with no provider keys required.
    • New AI Red Teaming Learning Guide adds eight documentation pages covering all four traditional-ML attack categories and generative AI attacks, with runnable SDK, TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., and CLI examples.

    14 details in Everything

23. Traditional-ML red teaming suite — evasion, extraction, membership inference, and model inversion in one platform seen Aug 4, 2026 · issue 006

    Dreadnode adds 20+ traditional-ML attacks, dn airt run-classifier CLI, multi-agent ATLAS campaigns, and eval agent selection to its red teaming platform.

    └──▷ TRY IT
    Pin a specific agent to an evaluation run so results are reproducible and the run report identifies which agent executed.
    copy

    $ dn evaluation create --agent <name>

    Increase the number of project memories available at session start beyond the default of 20 to give agents broader context on large engagements.
    copy

    $ dn ... --project-memory-preload-limit 100

    • New dn airt run-classifier CLI command runs classic-ML attacks — evasion, extraction, membership inference, and model inversion — directly against a predict endpoint without SDK code.
    • New dn evaluation create --agent <name> flag specifies which agent runs in an evaluation; eval output reports which agent actually ran.
    • New --project-memory-preload-limit flag sets the number of memories preloaded at session start (range: 1–200), replacing a hardcoded default of 20.
    • Adds four traditional-ML attack families (evasion, extraction, membership inference, model inversion) to AIRT, covering 20+ named attacks — including equation-solving, Jacobian, copycat, knockoff, PWWS, BAE, TextBugger, threshold, and label-only — across tabular, image, and text modalities, with per-finding metrics, adversarial trajectory traces, and MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling./SAIF/NIST compliance mappings.
    • Adds model inversion attacks that reconstruct class-representative inputs via black-box queries to surface privacy risks, completing the fourth traditional-ML attack category in AIRT.

    +9 more show less

    • Adds the ATLAS multi-agent attack framework for running adaptive campaigns against deployed multi-agent environments across three attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources., with executed tool calls captured per-trial and surfaced in findings across the UI, API, and SDK.
    • Agent Output now functions as a severity-first triage workspace — searches, sorts, and filters an engagement's findings; each finding can be exported to CSV, deep-linked, or copied into a report.
    • New executive/CISO summary panel on the assessment view shows attack-surface posture, query cost to compromise, risk score, and a plain-English headline for stakeholder reporting.
    • Richer privacy-attack metrics in findings: extraction findings include KL divergence and accuracy retention; membership inference includes attack accuracy, precision, and recall; model inversion includes reconstruction quality.
    • New dedicated media gallery collects all images and other media logged by a session's tools in one place for reviewers.
    • New web-security initial-recon skill provides structured reconnaissance for domain, wildcard, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., IP-list, and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. entry points using the ProjectDiscovery toolchain.
    • Evaluation runtime now records the health of all runtime components (broken tools, skills, policies) at run time, so degraded capabilities are visible after the fact.
    • Five self-contained AIRT demo notebooks cover model evasion, extraction, membership inference, jailbreaks, and multi-agent attacks — runnable via dn login with no provider keys required.
    • New AI Red Teaming Learning Guide adds eight documentation pages covering all four traditional-ML attack categories and generative AI attacks, with runnable SDK, TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., and CLI examples.

    14 details in Everything

24. Agent memory, triage, and session monitoring overhaul seen Aug 4, 2026 · issue 006

    Dreadnode adds agent memory UI, five data-integration connectors, air-gapped hub sync commands, ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based JS/TS analysis, and in-place finding triage.

    └──▷ TRY IT
    File a bug report from the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. immediately after a crash without losing session logs.
    copy

    $ /report-bug

    • Adds dn capability sync and dn task sync CLI commands to pull hub content from SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. (or another on-prem) into a local directory and push it to a self-hosted instance, enabling air-gapped on-prem loading.
    • Adds /report-bug command (or r in console) to the TUI, assembling a privacy-reviewed diagnostic bundle and submitting it without losing logs after a crash.
    • Adds the llm-wiki capability (compiles source material into linked wiki pages) and analysis-ledger capability (maintains a resumable code-analysis frontier with evidence-bearing claims).
    • Adds five data-integration connectors — Atlassian, Azure DevOps, GitHub, GitLab, and Linear — as platform capabilities.
    • Adds AST-based JS/TS static analysis via ast-grep in the web-security runtime, removing the need for semgrep, CodeQL, or a jxscout license.

    +9 more show less

    • Adds an Inactive filter to Agent Sessions to isolate sessions idle past 15 minutes but not yet archived.
    • New Memories page under Agents lets operators view, inspect, and manage project memory entries, including version history and diffs.
    • Enables finding triage (status and notes) directly from a finding's detail panel in Agent Output.
    • Session monitoring redesigned: adds a Last Msg relative-activity column, highlights sessions active in the last 15 minutes, and adds forward/backward transcript pagination with tailing mode.
    • Stat cards for Needs review and Critical + High on the Agent Outputs page are now clickable filter toggles; the items grid gains a sortable Updated column.
    • Sessions group-by control (None / Workflow / Capability / Agent / Source) is now available to all orgs, with workflow runs collapsed by default.
    • Models and Datasets Hub browse pages add a table view alongside cards, with a unified toolbar offering separate sort and filter controls across all four Hub browse pages.
    • New workspace dialog includes an organization picker to create a workspace in any org without switching context.
    • Agent Output items from failed report_item POSTs are automatically recovered from span backups when a session is frozen.

    14 details in Everything

25. August 2026 Aug 1, 2026 · release notes

    Dreadnode August 2026 introduces air-gap mode, web-security detection capabilities, and bulk session management.

    • Introduces airgapped configuration profile to vendored fonts, analytics, model pricing, and pre-baked dependencies for disconnected installs
    • Adds IP rotation via Cloudflare Workers in web-security capability
    • Adds HTTP desyncHTTP desyncAn attack technique that exploits disagreements between a front-end proxy and a back-end server about where one HTTP request ends and the next begins, letting an attacker poison the request queue and hijack other users' traffic. and request-smuggling detection covering 11 smuggling families in web-security capability
    • Adds geo-distributed DNS resolution via Shodan or Censys in web-security capability
    • Adds LSB steganographyLSB steganographyA data-hiding technique that encodes secret bytes into the least-significant bits of image, audio, or video samples, making changes imperceptible to human senses while preserving a covert channel inside ordinary files. on PNG images in web-security capability

    +1 more show less

    • Enables bulk archive and unarchive for agent sessions from the Sessions tab

    6 details in Everything

26. Agent memory, triage, and session monitoring overhaul Jul 30, 2026 · release notes

    Dreadnode adds Inactive session filter, hub sync for air-gapped envs, ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. JS/TS analysis, and direct finding triage.

    └──▷ USE IT
    Sync hub content to a local directory for air-gapped environments.
    shell copy

    dn capability sync

    Filter agent sessions to view only those idle for more than 15 minutes but not yet archived.
    📍Select Inactive from the filter dropdown in Agent Sessions
    • Adds dn capability sync and dn task sync commands for air-gapped on-prem loading by pulling hub content from SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. or another on-prem instance.
    • Adds Inactive filter to Agent Sessions to isolate idle sessions past 15 min that are not archived
    • Adds AST-based JS/TS static analysis via ast-grep in web-security runtime without semgrep, CodeQL, or jxscout license
    • Enables triage of findings directly from the detail panel in Agent Output by setting status and adding notes

    4 details in Everything

27. AIRT Report Builder now generally available with templates, branding, and DOCX export seen Jul 23, 2026 · issue 023

    Dreadnode AIRT Report Builder goes GA with templates, DOCX export, new AI red-teaming skills, and a major CLI overhaul.

    └──▷ TRY IT
    Uninstall a capability you no longer need from your agent environment.
    copy

    $ dn capability uninstall <capability-name>

    Update the Dreadnode CLI to the latest version without leaving your terminal.
    copy

    $ dn update

    Build and download an AIRT report in DOCX format with custom branding for client delivery.
    📍In the platform, go to AIRT › Reports, select or create a report template, configure branding (logo, company name, confidentiality footer), then click Export › DOCX.
    • AIRT Report Builder is now generally available for all users, with saved templates (load/save/rename/delete), custom branding (logo, company name, title, confidentiality footer), DOCX export, and a live structural preview panel.
    • New trace-analysis advisor skill surfaces attack-effectiveness analysis, transform recommendations, and vulnerability pattern identification from historical run data directly inside the agent.
    • New GuardSessionPolicy gates every agent tool call through an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge before execution, with a built-in safety rubric and optional custom rules.
    • GuardSessionPolicy supports five transcript strategies (rubric_only, intent_only, intent_plus_calls, full, and more) to control how much context is sent to the judge.
    • New export endpoint converts session transcripts to ATIF v1.7 or OpenAI Chat Completions format; new dn session CLI command group and a session UI download menu enable browsing, inspecting, and exporting sessions.

    +11 more show less

    • New dn capability uninstall command added; session archive, freeze, and delete lifecycle actions available in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency.; session picker rewritten with richer status columns and inline lifecycle controls.
    • New dn inference-model (alias dn llm), dn secret list, and dn environment wait CLI commands added; dn env renamed to dn environment (alias retained); destructive-action --yes/-y confirmation standardized across all commands.
    • New dn update command lets users update the Dreadnode CLI directly from the terminal.
    • Platform admins can configure which models appear as featured in the catalog via a new admin UI, including manual entry of preview or unreleased model IDs, without code changes or redeployments.
    • TUI now renders report tool calls inline with full markdown content and a clickable View in web deep-link opening the platform Reports tab for the active session.
    • Agent session views and TUI footer now show tool call count and estimated USD cost alongside message count and token usage.
    • The ask_user tool now supports structured multi-question bundles, explicit cancel flows (raising UserCancelled), and an interactive TUI widget with tab navigation, multi-select, and Esc-to-cancel.
    • Datasets, environments, models, and capabilities now have dedicated shareable URLs; training job selections are reflected in the URL via ?job=<id>.
    • Exported ATIF trajectories now include an extra.dreadnode block with origin and {id, key} pairs for organization, workspace, and project to support downstream data lineage tracing.
    • Persistent TUI welcome panel now shows profile, runtime, and capability context; a new getting-started skill routes new users to the right capability or task automatically.
    • Notification badges for pending org invitations now appear in the nav bar and Account Settings on login or page refresh.

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Export PDF Report button on the AIRT overview page has been removed; the Reports tab now handles PDF and all other export formats.
    • !The default GuardSessionPolicy transcript strategy is now intent_plus_calls (previously unspecified/different), which changes what context is sent to the LLM judge for existing GuardSessionPolicy configurations.
28. Agent Output available in beta for all orgs seen Jul 23, 2026 · issue 023

    Dreadnode adds ATLAS multi-agent attack framework, 170 multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. red-team transforms, LiteLLM on-prem inference, E2B sandbox, and a full slash-command/@ palette in web chat.

    └──▷ TRY IT
    Cap token spend on an evaluation run for reproducible cost control across CI pipelines.
    copy

    $ dn evaluation create --max-steps 50 --config evaluation.yaml

    • Adds ATLAS multi-agent attack framework (dreadnode.airt.atlas) running campaigns across eight attack modes using a MDP+Hedge router, with tool calls captured per-trial and surfaced in findings across the UI, API, and SDK.
    • Ships 130+ image, audio, and video perturbations for red teaming vision/audio/video models, covering ImageNet-C corruptions, AugLy augmentations, SpecAugment, FigStep, and DolphinAttack techniques.
    • Exposes 131 multimodal transforms in the AI red-teaming TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. (up from 26), including 57 image, 52 audio, and 22 video transforms.
    • Adds slash-command palette in the web chat composer — type / for a fuzzy-filtered overlay with built-in actions (/new, /clear, /rewind, /model, /agent, and more) plus dynamically-discovered skills.
    • Adds @-mention agent picker in the web chat composer, navigable by keyboard or mouse, inserting agents as inline mentions.

    +16 more show less

    • Adds /background <task> (or /bg) launcher to spin up a headless session without leaving the current conversation.
    • Introduces new tool renderers in chat (glob, grep, read, query, web search), an improved session header, capability picker, and read-only session notices.
    • Renames Structured Output to Agent Output throughout the UI, nav, and route (/agents/agent-outputs/); now available in beta for all orgs including on-prem/enterprise.
    • Bundles LiteLLM as a Helm subchart for on-prem/enterprise installs, enabling dn/* models, TUI/chat inference, and the Admin Model Deployments surface.
    • Adds E2B as a first-class on-prem sandbox provider configurable via KOTS toggle.
    • Adds --max-steps / max_steps: budget parameter to dn evaluation create and evaluation.yaml for reproducible cost control.
    • Adds AgentMail email inbox integration for web-security agents — list/create inboxes and list, get, send, or reply to messages.
    • Adds Azure AI Foundry multimodal target support for probing text+image and text+audio deployments via the SDK and TUI.
    • Adds dreadnode[nova-sonic] install extra for Nova Sonic S2S dependencies.
    • Automated internal-network and Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. engagements now run end-to-end through a pipeline of specialized agents covering discovery, exploitation, credential harvesting, reporting, lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., and coercion.
    • Blind vulnerability testing (e.g., blind SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) now works without external tooling, with automatic provider fallback.
    • Provisions rockyou.txt, SecLists 10k-most-common.txt, and OneRuleToRuleThemAll.rule at install time for out-of-the-box hashcat and john_the_ripper support.
    • Displays native reasoning_content / Anthropic thinking blocks in session transcript viewer and includes them in ATIF trajectory exports.
    • TUI agent picker (Ctrl+A) now shows the locally installed version of each capability.
    • Session sharing now shows a popover with plain-language visibility state (Private / Shared with workspace) and a copyable deeplink.
    • Assessment findings automatically carry target and judge model metadata inferred from configs, eliminating manual annotation.

    21 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Structured Output nav item and route are renamed to Agent Output at /agents/agent-outputs/; any bookmarks or integrations referencing the old route or label will break.
29. Analytics query and notebook UX overhaul seen Jul 23, 2026 · issue 023

    Dreadnode adds web chat for project runtimes, persistent web-security agent memory, and a refreshed analytics UX.

    └──▷ HOW TO FIND IT
    When reviewing a web-security agent run, use example query chips and schema column insertion on the analytics page to quickly build queries against persisted memory artifacts without writing SQL from scratch.
    📍In the console, go to Analytics › Query, select a schema column from the column insertion panel, or choose an example query chip to pre-populate the editor with a query against your project's reconnaissance findings or discoveries.
    • Adds empty states, a stats summary strip, loading skeletons, inline error banners, schema column insertion, and example query chips to the analytics query and notebook pages.
    • Enables the web-security agent to persist reconnaissance findings, gadgets, leads, defense bypasses, and discoveries across sessions using structured project memory.
    • Allows revealed images in tool results and logged outputs to be re-hidden, freeing the decoded blob from memory.

    3 details in Everything

30. Android APK research capability and issue-tracker connectors for web-security seen Jul 23, 2026 · issue 023

    Dreadnode adds Android APK static analysis, Jira/GitHub issue-tracker connectors, artifact logging, and admin model controls for web-security agents.

    • Adds android-apk-research capability bundle: a 10-tool MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with four skills for static semantic vulnerability research on Android APKs.
    • Adds Jira Cloud MCP connector for web-security agents to export validated findings directly as remediation tickets.
    • Adds GitHub MCP connector for web-security agents to file findings as GitHub issues and post follow-up comments from within the agent workflow.
    • Adds four artifact logging tools (log_image_output, log_audio_output, log_video_output, log_file_artifact) for attaching media and file artifacts to a web-security agent run.
    • Adds waymore to the web-security capability runtime, enabling historical URL and response retrieval from Wayback Machine, CommonCrawl, OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure., URLScan, and VirusTotal.

    +4 more show less

    • Adds a built-in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. rubric for the SDK's default LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scorer with graduated pentest-aligned cross-boundary access criteria, composable via task.yaml and SDK configs.
    • Adds a live activity feed on the home page showing recent projects, sessions, evaluations, training jobs, and other workspace activity.
    • Enables organization administrators to grant each member access to a specific set of AI models, enforced across the web app, API, and CLI.
    • Adds an Ask an agent tab to every in-product CLI guide across all surfaces (capability, task/environment, dataset, model, evaluation, optimization, world manifest, trajectory, training).

    9 details in Everything

31. Binary analysis capability replaces windows-reversing with cross-platform PE/ELF/Mach-O support seen Jul 23, 2026 · issue 023

    Dreadnode adds cross-platform binary analysis, Android APK research, AEM/Sling web testing, and bulk evaluation log downloads.

    └──▷ USE IT
    Enable cross-platform binary analysis (PE/ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code./Mach-O) in an agent capability config, replacing the old windows-reversing bundle.
    yaml copy

    capability: binary-analysis

    Run static vulnerability research against an Android APK by enabling the new android-apk-research capability bundle.
    yaml copy

    capability: android-apk-research

    Mark an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server header optional so OAuth runs as the default when the env var is unset.
    yaml copy

    headers:
      - name: Authorization
        value: "Bearer ${MY_API_KEY}"
        optional: true

    • New binary-analysis capability supports PE, ELF, and Mach-O formats with an expanded Ghidra MCP server and a consolidated 8-phase analysis skill.
    • New android-apk-research capability ships a 10-tool MCP server and four skills for static semantic vulnerability research on Android APKs.
    • Automated web-security testing now covers Adobe Experience Manager and Apache Sling, surfacing selector-abuse, dispatcher-bypass, and XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. weaknesses.
    • Bulk evaluation log download lets you export all sample logs from an evaluation as a single ZIP bundle.
    • Dashboard workspace toggle lets users filter activity between personal workspace and full organization view.

    +4 more show less

    • Org owners and admins can download receipts for individual credit purchases from the billing settings page.
    • MCP server headers now support optional: true so unset env vars omit the header entirely, enabling OAuth as the default without a wrapper capability.
    • Server-side transcript search enables finding matches across all messages in a long session without paging through the entire transcript.
    • Task verification method (script, flag, judge, or compound) is now visible in the environment task detail and evaluation sample detail views.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The windows-reversing capability bundle is replaced by binary-analysis; any configuration referencing windows-reversing must be updated to use binary-analysis.
32. Claude Code engine — run Claude's agentic loop as a governed, session-backed agent seen Jul 23, 2026 · issue 023

    Dreadnode adds Claude Code engine, Task Sets, per-role environment model selection, eval sample search, and two new offensive security skills.

    └──▷ TRY IT
    Override the defender (environment) model per role independently of the solver and judge, e.g. to pit a weaker defender against a stronger attacker.
    copy

    $ dn eval run --env-model defender=openai/gpt-4o --env-model judge=anthropic/claude-3-5-sonnet <eval-target>

    Group related tasks into a versioned Task Set and run them all as one evaluation target from the CLI.
    copy

    $ dn task-set run <org>/<task-set-name>

    • Adds pluggable agent execution engines with Claude Code as the first built-in option, running Claude's agentic loop as a governed, session-backed agent with full trace viewer support.
    • Introduces Task Sets — named, versioned collections of tasks runnable as a single evaluation target via the API, dn task-set CLI commands, or the Environments UI.
    • Enables user-controlled task-environment models: choose which model each environment role uses via --env-model role=id (CLI), model_overrides in evaluation.yaml, or the API, independently of solver and judge models.
    • Adds free-text search across all samples in an evaluation, with match highlighting, per-sample match counts, and a Matches only filter.
    • Adds a blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. extraction skill supporting boolean/timing-based oracle identification, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. bypass patterns, and automated char-by-char extraction.

    +5 more show less

    • Extends the blind-SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.-chains skill to detect available cloud CLIs and provision attacker infrastructure (S3 buckets, redirect servers) for SSRF proof-of-concept evidence.
    • Shows task-set provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. (org/name and skipped members with reasons) on the evaluation detail page when an eval was run from a task set.
    • Adds a model, tokens, tool calls, and cost summary to stderr in dn --print headless mode after each run.
    • Displays sub-agent LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. costs as a separate subagents $X.XX segment in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. footer.
    • Running dn --resume (or -r) with no argument now opens the session picker instead of erroring.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --session <name> flag is now required for concurrent web-security agents; omitting it will cause agents to clobber each other's browser state.
33. Compound eval verification — script_and_judge and flag_and_judge seen Jul 23, 2026 · issue 023

    Dreadnode adds compound eval verification, agentic outcome judging, 6 new web pentesting skills, and expanded AIRT goal categories.

    └──▷ TRY IT
    Run an agentic outcome judge against an agent trajectory to get a pass/fail verdict without writing a custom scoring script.
    copy

    $ dn outcome-judge run

    • New script_and_judge and flag_and_judge verification methods chain a mechanical check (script or flag) with an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge to close reward-hacking gaps in eval tasks — no custom rubric required.
    • New outcome_judge verification method lets eval tasks use an agentic LLM to inspect agent trajectories and emit pass/fail verdicts, exposed via the new dn outcome-judge run CLI subcommand.
    • New opt-in intent_plus_outputs_summary guard strategy replaces raw tool outputs with LLM-generated summaries in judge prompts, reducing prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. surface while preserving tool-call context.
    • Six new web app pentesting skills added: ESI injection, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.-Web pentest, H2C/WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. smuggling, HTTP connection contamination, timing-attack recon, and XSLT injection.
    • Adds waymore to the web-security capability runtime for historical URL and response retrieval from Wayback Machine, CommonCrawl, OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure., URLScan, and VirusTotal.

    +4 more show less

    • Free-text search in evaluation trajectories with inline match highlighting, auto-expansion of collapsed tool calls, and query state synced to the URL.
    • Expanded AIRT goal categories from 9 to all 15, now including reasoning_exploitation, supply_chain, and resource_exhaustion.
    • Org admins can now control which AI models each member is allowed to use from the org members admin page.
    • Simplified AIRT workspace layout uses a cleaner ~/.dreadnode/airt/[org]/[workspace]/ path structure, replacing the previous env-var-based path system.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The AIRT workspace path structure has changed to ~/.dreadnode/airt/[org]/[workspace]/, replacing the previous env-var-based path system — existing setups relying on the old env-var paths will need to be updated.
34. End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces seen Jul 23, 2026 · issue 023

    Dreadnode adds end-to-end multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. AI red teaming, custom HTTP targets, Task Sets, and a SecurityContext MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.

    └──▷ USE IT
    Point a PAIR attack at a private Azure OpenAI endpoint using Azure AD auth via the new custom_http target mode.
    python copy

    build_target(TargetSpec(mode="custom_http", url="https://<your-resource>.openai.azure.com/openai/deployments/<deployment>/chat/completions", auth="azure_ad"))

    View the README for a capability in the CLI before running it, to understand inputs, outputs, and auth requirements.
    copy

    $ dn capability info <capability-name> --readme

    • New multimodal AI red teaming: probe LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. with text, image, audio, and video inputs; apply per-modality transforms; score with the new multimodal_judge scorer; view full message parts inline in findings, traces, and parquet exports (schema v3 with base64 media columns).
    • Cross-product prompt_matrix mode runs N prompts × M media items = N×M trials for systematic multimodal attack coverage.
    • Nova Sonic speech-to-speech target support added to the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. capability picker and build_target SDK factory.
    • New custom_http target mode and build_target(TargetSpec) factory let TAP, PAIR, and other attacks hit any endpoint (Azure, Vertex, SageMaker, Bedrock, OpenAI-compatible) with declarative auth strategies (API key, Bearer, AWS SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets., Azure AD, GCP).
    • Per-modality response scores in findings and Assessment Findings tables, with the highest-scoring modality emphasized.

    +15 more show less

    • Structured findings and assets: agents can emit typed vulnerabilities, endpoints, and other items viewable in a new Structured Output page with per-type tables, detail panels, and provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. history.
    • Web-security agents now produce WebVulnerability and WebEndpoint items visible in the Items UI for triage, filtering, and cross-session tracking.
    • Task Sets (V1): group multiple tasks into a named, versioned set and run evaluations against the whole set via API, CLI (dn task-set), or the Environments UI.
    • Session groups and workflow hierarchies organize multi-session agent runs into collapsible workflow groups; the SDK exposes a new client.workflow() API.
    • SecurityContext MCP server for web-security agents: mines commit history and CVE disclosures to generate hunting briefs and ranked vulnerability leads via three tools — get_security_context, create_security_context, get_vulnerability_leads.
    • Three new web-security skills added: git-integration-exploitation, http-query-method (RFC 10008 parser differentials), and dom-vulnerability-detection (postMessage IP normalization bypass).
    • Model reasoning (Anthropic thinking blocks, reasoning_content) now appears as a typed first-class field in session transcripts and ATIF trajectory exports.
    • Web chat gains interactive ↔ autonomous mode toggle with optional step cap, Rewind to here control, and a full action menu (copy ID/link, export trajectory, archive/freeze/delete) from the session list.
    • Web chat transcript surfaces ask_user prompts inline, renders live tool media during streaming, and exposes a reasoning-effort selector in the composer.
    • Chat UI promoted to main sidebar navigation (no longer a beta route).
    • New dreadnode[nova-sonic] SDK extra installs all required AWS dependencies for Nova Sonic speech-to-speech targets.
    • Bundle README surfaced in frontend, TUI (d key), and CLI (--readme / -R flags on dn capability info and dn task info).
    • Hub scope tabs (Mine · {org} · Public) with live count pills added to Dataset, Model, Capability, and Environment browse pages.
    • New auth-setup-guide skill for AIRT walks through authenticating target, attacker, and judge models across Azure, AWS Bedrock, GCP Vertex, and custom HTTP endpoints.
    • Chat sandbox keepalive: a periodic ping extends the runtime's expiry every 30 seconds while actively working, preventing mid-session auto-pause.

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The items key in capability manifests is replaced by a unified produces key that configures built-in item types, custom types, and disablement — existing manifests using items will need to be updated.
35. Free-text search in evaluation trajectories seen Jul 23, 2026 · issue 023

    Dreadnode adds free-text search in evaluation trajectories, session rewind, cross-org share links, and sandbox dependency auto-install.

    └──▷ HOW TO FIND IT
    Quickly locate a specific tool call or output string inside a long evaluation run without manually scrolling through every trajectory step.
    📍In the console, open an evaluation trajectory, then type your search term into the free-text search box — matching content is highlighted inline and tool calls containing the term expand automatically.
    Roll back a TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. conversation to an earlier point to re-run from a known-good message without losing the full history.
    copy

    $ /rewind

    • Adds free-text search in hosted evaluation trajectories — matches are highlighted inline and tool calls auto-expand when their content matches the search term.
    • Adds session rewind via /rewind or double-Esc in the TUI, rolling back a conversation to any prior user message while preserving full session history.
    • Enables cross-org capability share links so Capability Hub links automatically redirect recipients to the correct page regardless of their org slug.
    • Sandbox runtimes now auto-install Python packages and system dependencies declared in capability manifests at load time.
    • AIRT CLI now auto-discovers attacks, transforms, and scorers at runtime (61 attacks, 547 transforms, 141 scorers) with accurate capability counts in the hub.

    +3 more show less

    • ATIF trajectory exports now include an extra.dreadnode block carrying org, workspace, project, and optional evaluation/item IDs for source traceability.
    • Adds a copy-to-clipboard button next to the task name in the environment detail drawer for quick use in CLI commands or evaluation setup.
    • Settings sidebar now groups options as Personal (Secrets, Chat Models) vs Organization for clearer separation.

    8 details in Everything

36. Session and Trace Views Now Display Agent-Captured Images, Audio, and Video seen Jul 23, 2026 · issue 023

    Dreadnode adds media playback in session views, ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. capability, HTTP/2 WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. bypass, GraphQL pentesting, and a sandbox runtime hierarchy.

    └──▷ TRY IT
    Run a smoke test that mirrors production runtime and validates judge-backed tasks before submitting — catches multi-file solution issues early.
    copy

    $ dn task validate --smoke

    Review agent-captured media artifacts from a session without auto-decoding potentially hostile content.
    📍In the platform UI, open a session transcript or trace details view, then click Show media on any image, audio, or video item to decode and display it.
    • Adds inline display of agent-captured images, audio, and video in session transcripts and trace details, with an explicit Show media click to prevent auto-decoding of hostile artifacts.
    • New attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management capability combining BBOT scanning, Shodan enrichment, Neo4j graph analysis, screenshot triage, and a multi-agent ASM pipeline.
    • New h2-waf-bypass skill covering 6 HTTP/2 WAF bypass classes: delayed DATA frame timing, body size truncation, Extended CONNECT, ForwardAuth body stripping, path normalization, and JSON content-type gaps.
    • New graphql-pentest skill covering endpoint discovery, introspection mining, resource abuse (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-400, CWE-674), content-type CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session., and capability matrix testing.
    • New standalone vuln-assessment-methodology capability providing a reusable severity matrix, disprove-first rules, and reporting standards any security capability can load.

    +8 more show less

    • New --judge-model flag on dn evaluation create lets you override the task-level judge model at eval creation time without modifying task.yaml.
    • ProcessJudge now supports opt-in prefix caching to reduce LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. costs on long judge sessions; GuardSessionPolicy enables it by default.
    • Automated Cloud Assessments now run authorized AWS exploitation checks to validate real-world impact of exposed AWS credentials or instance-metadata findings.
    • Dashboard workspace toggle lets analysts filter activity between personal workspace and full organization view.
    • Pinned smoke solution image: dn task validate --smoke now runs in a container mirroring the production agent runtime.
    • dn task validate --smoke now covers judge-backed verification methods (script_and_judge and flag_and_judge tasks).
    • Default agent timeout for evaluations doubled from 30 minutes to 1 hour.
    • Expired email verification links can now be resent in a single click from the recovery page.

    13 details in Everything

37. Tool media evidence in session transcript seen Jul 23, 2026 · issue 023

    Dreadnode adds ProjectMemory, inline media in transcripts, new DoS/path-traversal/EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. skills, and a unified LiteLLM admin proxy.

    └──▷ TRY IT
    Inject secrets or config into a challenge service during smoke testing without modifying docker-compose.yaml.
    copy

    $ dn task validate --smoke -e API_KEY=abc123 -e TARGET_HOST=http://localhost:8080

    • Adds ProjectMemory tools so agents can persist and retrieve durable project-scoped memory across runs.
    • Screenshots and media logged via dn.log_output() inside tools now render inline in the session transcript next to the producing tool call.
    • New unified LiteLLM admin proxy lets admins manage model deployments and credentials directly from the platform; platform models are now always org-allowlist-scoped.
    • Adds Ctrl+K shortcut in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. to open the full model browser.
    • New app-layer-dos skill covers ReDoSReDoSA denial-of-service attack that exploits catastrophically backtracking regular expressions, causing a regex engine to consume exponential CPU time on crafted input; tools use detection of vulnerable patterns to flag risky code., decompression bombs, server delay exploitation, and cross-protocol amplification for application-layer DoS testing.

    +11 more show less

    • New archive-path-traversal skill covers Zip Slip, symlink attacks, polyglot MIME bypass, and Unicode path confusion via archivealchemist tooling.
    • New exiftool capability adds exif_read, exif_write, exif_strip, and exif_copy methods for EXIF metadata manipulation in web-security agents.
    • AIRT Findings list now defaults to newest-first order, auto-refreshes every 20 seconds with a notification pill, and shows a structured Human Review table, Metadata tile with Finding/Assessment IDs, copy button on reasoning, and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-prefix search.
    • Web-security agent now emits a STATUS update (including an Unexplored field) after every action for improved scan-coverage visibility.
    • Web-security vulnerability reports now include a trace ID linking each finding back to the confidence assessment that approved it.
    • The web-security credence tool now accepts an optional CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score, echoes it as [cvss:N.N] in output, and flags mismatches such as low confidence paired with a high CVSS score.
    • ASR by Category card on the Assessments page now renders a bar chart in Charts mode.
    • Home page activity feed now shows an actor chip per event; agent sessions list shows who or what started each session.
    • Evaluations list now surfaces who or what ran each sample alongside the capability reference.
    • New -e / --env flag on dn task validate --smoke lets you inject environment variables into the challenge service at smoke-test time without editing docker-compose.yaml.
    • Adds a Release Notes page at docs.dreadnode.io/release-notes with tier chips, month navigation, per-entry permalinks, and an RSS feed.

    16 details in Everything

38. Traditional-ML red teaming suite — evasion, extraction, membership inference, and model inversion in one platform Jul 23, 2026 · release notes

    Dreadnode adds CLI for traditional-ML attacks, session media gallery, model inversion, and --project-memory-preload-limit

    └──▷ TRY IT
    Run classic-ML attacks against a predict endpoint directly from the command line without SDK code.
    copy

    $ dn airt run-classifier --target https://api.example.com/predict

    Specify which agent runs during an evaluation to control execution context.
    copy

    $ dn evaluation create --agent my_custom_agent

    • dn airt run-classifier CLI command
    • Configurable project memory preload limit via --project-memory-preload-limit (1–200)
    • Model inversion attacks as a new traditional-ML attack family with reconstruction quality metrics
    • Eval agent selection via dn evaluation create --agent <name>
    • A New Gallery Gathers a Session’s Captured Media in One Place

    +3 more show less

    • Web-security initial-recon skill using ProjectDiscovery for domain, wildcard, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., IP-list, and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. entry points
    • Executive/CISO summary panel on assessment view with attack-surface posture and query cost
    • Five AIRT demo notebooks for evasion, extraction, membership inference, jailbreaks, and multi-agent attacks

    8 details in Everything

39. Agent Output available in beta for all orgs Jul 16, 2026 · release notes

    Dreadnode adds slash-command chat palette, Agent Output beta for all orgs, E2B on-prem sandbox, and multi-agent ATLAS framework.

    └──▷ TRY IT
    Spin up a headless agent session for background tasks without leaving the current chat.
    copy

    $ /background <task>

    Run an evaluation with a hard step limit to control costs and ensure reproducibility.
    copy

    $ dn evaluation create --max-steps 100

    • Slash-command palette in the web chat composer opened by typing /
    • @ -mention agent picker in the chat composer
    • /background launcher in the web chat composer to spin up headless sessions
    • New Agent Output available in beta for all orgs
    • dreadnode.airt.atlas module for ATLAS multi-agent attack framework

    +5 more show less

    • 131 multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. transforms (image, audio, video) exposed via TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. and SDK
    • LiteLLM bundled as a Helm subchart for on-prem inference
    • E2B sandbox provider configurable via KOTS toggle in self-hosted installs
    • --max-steps flag on dn evaluation create and max_steps key in evaluation.yaml for cost control
    • AgentMail email inbox integration for web-security agents

    10 details in Everything

40. End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces Jul 9, 2026 · release notes

    Dreadnode adds end-to-end multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. AI red teaming (vision/audio/video), structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. page, web chat mode toggle, and Nova Sonic S2S target support

    └──▷ HOW TO FIND IT
    Probe a vision, audio, or video model end-to-end with automated scoring of generated media outputs
    📍dn redteam run --target build_target(TargetSpec(url='https://api.example.com/v1', auth_type='bearer')) --scorer multimodal_judge
    Install dependencies required for Nova Sonic speech-to-speech targets in your local environment
    📍pip install dreadnode[nova-sonic]
    • End-to-end multimodal AI red teaming — probe vision, audio, and video targets with multimodal_judge scorer, inline media rendering in findings/traces/exports (parquet schema v3 with base64 columns), cross-product prompt_matrix mode, and Nova Sonic S2S target support
    • New Structured Output page for web-security agents with per-type tables for WebVulnerability and WebEndpoint items, detail panels, and provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. history
    • Web chat interactive ↔ autonomous mode toggle with optional step cap, Rewind to here control on prior user messages, and full action menu (copy ID/link, export trajectory, archive/freeze/delete) from session list
    • Unified produces key for capability manifests, replacing the older items key
    • Chat sandbox keepalive that extends runtime expiry every 30 seconds during active work

    +12 more show less

    • Full multimodal AIRT output capture with per-modality worst-case MAX score aggregation and inline audio/video playback in trace viewer
    • Nova Sonic speech-to-speech target support via build_target(TargetSpec) factory and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. capability picker
    • SecurityContext MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for web-security agents with get_security_context, create_security_context, and get_vulnerability_leads tools
    • Three new web-security skills: git-integration-exploitation, http-query-method (RFC 10008 parser differentials), dom-vulnerability-detection (postMessage IP normalization bypass)
    • Agent sessions default to no grouping; workflow grouping available in selector on Sessions page
    • Model reasoning as first-class field in session transcripts and trajectory export (native reasoning content now appears instead of being silently dropped)
    • Auth-setup-guide skill for AIRT to walk through authenticating target, attacker, and judge models across Azure, AWS Bedrock, GCP Vertex, custom HTTP endpoints
    • New dreadnode[nova-sonic] SDK extra with required AWS deps for Nova Sonic speech-to-speech targets
    • Custom HTTP targets via build_target(TargetSpec) factory supporting declarative auth strategies (API key, Bearer, AWS SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets., Azure AD, GCP)
    • Hub scope tabs with live count pills on Dataset, Model, Capability, and Environment browse pages
    • Bundle README surfaced in frontend, TUI (d), CLI (--readme / -R)
    • Org, workspace, and project names enforce 100-character limit during input

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The items key in capability manifests is replaced by the unified produces key
    • !The undocumented run_in_background field has been removed from agent sessions
41. Claude Code engine — run Claude's agentic loop as a governed, session-backed agent Jul 2, 2026 · release notes

    Dreadnode introduces Claude Code engine, task sets, and new web-security skills

    └──▷ USE IT
    Group multiple tasks into a versioned collection and run them as a single evaluation target.
    shell copy

    dn task-set create --name security-scan-v1 --task-id t1,t2,t3

    Run an evaluation where the defender environment uses a specific model role.
    shell copy

    dn eval run --env-model defender=claude-3-5-sonnet-20241022

    • Adds pluggable execution engine architecture with Claude Code as the first built-in option
    • Adds dn task-set CLI commands to group tasks into named, versioned collections
    • Adds --env-model role=id CLI argument and model_overrides config key to select defender models per role
    • Adds free-text sample search with Matches only filter in evaluation UI
    • Adds new blind SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. extraction skill for boolean/timing-based oracle identification

    +2 more show less

    • Adds blind-SSRF-chains skill that guides agents to provision attacker infrastructure (S3, redirect servers)
    • Makes --session <name> flag required for concurrent web-security agents

    7 details in Everything

42. July 2026 Jul 1, 2026 · release notes

    New memory UI, five integration connectors, ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based JS/TS analysis, and air-gapped sync commands

    └──▷ USE IT
    Sync on-prem content from SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. hub to local directory.
    shell copy

    dn capability sync --from saas --to ./hub-content

    • Adds a Memories page under Agents for viewing, inspecting, and managing project memory entries with version history and diffs.
    • Adds five data-integration connectors: Atlassian, Azure DevOps, GitHub, GitLab, and Linear as platform capabilities.
    • Adds AST-based JS/TS static analysis in web-security using ast-grep.
    • Adds dn capability sync and dn task sync commands for air-gapped hub synchronization between SaaS and self-hosted instances.

    4 details in Everything

43. Analytics query and notebook UX overhaul Jun 25, 2026 · release notes

    Dreadnode adds web chat interface, structured project memory for agent findings, and media hiding controls.

    • Adds a full web chat interface for querying analytics of project runtimes
    • Enables the web-security agent to persist reconnaissance findings, gadgets, leads, defense bypasses, and discoveries across sessions via structured project memory
    • Allows users to hide revealed images in tool results and free decoded blobs from memory

    3 details in Everything

44. Tool media evidence in session transcript Jun 18, 2026 · release notes

    Dreadnode v2026-06-18 adds ProjectMemory persistence, DoS/path-traversal skills, EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. tools, and inline media rendering

    └──▷ HOW TO FIND IT
    Admin manage LiteLLM model deployments and credentials directly from the platform UI.
    📍Use Ctrl+K in the TUI to open the full model browser or navigate to the unified LiteLLM admin proxy page.
    Log media evidence from a tool so it appears inline in the session transcript for debugging.
    python copy

    # In your custom tool or script, log output which will now render inline
    import dn
    dn.log_output("screenshot.png", content_type="image/png")

    • Adds ProjectMemory tools for persisting and retrieving durable project-scoped memory across runs
    • Renders screenshots and media logged via dn.log_output() inline in the session transcript next to the tool call
    • Provides a unified LiteLLM admin proxy and model browser with org-allowlist scoping and Ctrl+K TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. access

    3 details in Everything

45. Session and Trace Views Now Display Agent-Captured Images, Audio, and Video Jun 11, 2026 · release notes

    Dreadnode v2026-06-11 adds media views, ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. and pentest skills, vuln-assessment methodology, and evaluation flags.

    • New Session and Trace Views now display agent-captured images, audio, and video directly in the transcript (requires Show media click).
    • New attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management capability combining BBOT, Shodan, Neo4j graph analysis, screenshot triage, and multi-agent ASM pipeline.
    • New h2-waf-bypass skill in web-security covering 6 bypass classes including delayed DATA frame timing and Extended CONNECT.
    • New graphql-pentest skill covering endpoint discovery, introspection mining, resource abuse (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-400, CWE-674), content-type CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session., and capability matrix testing.
    • New standalone vuln-assessment-methodology capability providing reusable severity matrix and disprove-first rules.

    +2 more show less

    • New --judge-model flag on dn evaluation create to override the task-level judge model without modifying task.yaml.
    • Automated Cloud Assessments now measure the impact of exposed AWS credentials with authorized exploitation checks.

    7 details in Everything

46. Binary analysis capability replaces windows-reversing with cross-platform PE/ELF/Mach-O support Jun 4, 2026 · release notes

    Dreadnode adds cross-platform PE/ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code./Mach-O binary analysis, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. header omission support, and bulk evaluation log download.

    • Binary-analysis capability replaces windows-reversing with cross-platform PE/ELF/Mach-O support
    • Conditional MCP header omission allows headers to be marked optional: true so unset env vars omit the header entirely
    • Bulk evaluation log download enables downloading all sample logs from an evaluation as a single ZIP bundle

    3 details in Everything

47. June 2026 Jun 1, 2026 · release notes

    Dreadnode June 2026 adds project memory, attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management, app-layer DoS and H2 WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. bypass skills, media evidence rendering, smoke test env injection, and session vi

    └──▷ USE IT
    Inject a custom API key into the smoke test challenge service without modifying docker-compose.yaml.
    shell copy

    dn task validate --smoke -e API_KEY=sk-live-xyz

    View agent-captured media directly in the session transcript with explicit Show media controls.
    📍In the Dreadnode platform, navigate to Session › [Session ID] and click Show media on any logged images, audio, or video artifacts.
    • dn task validate --smoke -e / --env flag to inject environment variables into challenge services during smoke tests
    • ProjectMemory tools for agent-persisted project-scoped memory across runs
    • app-layer-dos skill covering ReDoSReDoSA denial-of-service attack that exploits catastrophically backtracking regular expressions, causing a regex engine to consume exponential CPU time on crafted input; tools use detection of vulnerable patterns to flag risky code., decompression bombs, server delay exploitation, and cross-protocol amplification
    • archive-path-traversal skill covering Zip Slip, symlink attacks, polyglot MIME bypass, and Unicode path confusion via the archivealchemist tooling
    • exif_read, exif_write, exif_strip, exif_copy methods in web-security agents for EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. metadata manipulation

    +3 more show less

    • Attack surface management capability combining BBOT scanning, Shodan enrichment, Neo4j graph analysis, screenshot triage, and multi-agent ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. pipeline
    • h2-waf-bypass skill in the web-security capability covering 6 bypass classes including delayed DATA frame timing, body size truncation, Extended CONNECT, ForwardAuth body stripping, path normalization, and JSON content-type gaps
    • Session and Trace Views now display agent-captured images, audio, and video with explicit Show media controls instead of raw base64

    8 details in Everything

48. Android APK research capability and issue-tracker connectors for web-security May 28, 2026 · release notes

    New android-apk-research capability bundle, Jira and GitHub MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connectors, artifact logging tools, and IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. judge rubric for Dreadnode.

    • android-apk-research capability bundle ships with a 10-tool MCP server and four skills for static semantic vulnerability research on Android APKs
    • New Jira MCP connector lets web-security agents export validated findings directly to Jira Cloud as remediation tickets
    • New GitHub MCP connector lets web-security agents file findings as GitHub issues and add follow-up comments without leaving the agent workflow
    • Four new path-based logging tools for web-security agents: log_image_output, log_audio_output, log_video_output, and log_file_artifact to attach screenshots, audio, video, and file artifacts directly to a run
    • New built-in IDOR/BOLA rubric available for the SDK’s default LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scorer with graduated pentest-aligned cross-boundary access criteria

    +2 more show less

    • Home page now shows a live activity feed with recent projects, sessions, evaluations, training jobs, and other workspace activity
    • Organization administrators can grant each member access to a specific set of AI models, enforced across the web app, API, and CLI

    7 details in Everything

49. Compound eval verification — script_and_judge and flag_and_judge May 21, 2026 · release notes

    New compound eval verification strategies (script_and_judge, flag_and_judge) and an agentic outcome judge for Dreadnode

    • script_and_judge and flag_and_judge are new eval task verification methods that chain mechanical checks with an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. outcome judge to close reward-hacking gaps.
    • New dn outcome-judge run CLI subcommand exposes the agentic outcome_judge verification method for inspecting agent trajectories and emitting pass/fail verdicts.
    • New opt-in policy introduces the intent_plus_outputs_summary guard strategy, replacing raw tool outputs with LLM-generated summaries in judge prompts to reduce prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. surface.
    • Six new web-security capability skills are now available as knowledge distillations: ESI injection, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.-Web pentest, H2C/WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. smuggling, HTTP connection contamination, timing-attack recon, and XSLT injection.
    • waymore is added to the web-security capability runtime for historical URL and response retrieval from Wayback Machine, CommonCrawl, OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure., URLScan, and VirusTotal.

    +1 more show less

    • Organization admins can now control which AI models each member is allowed to use via a new setting on the org members admin page.

    6 details in Everything

50. Free-text search in evaluation trajectories May 14, 2026 · release notes

    Free-text search, session rewind, cross-org shares, and auto-installing sandbox deps in Dreadnode.

    • Adds free-text search in hosted evaluation trajectories with inline match highlighting and auto-expanding tool calls.
    • Adds /rewind subcommand and double-Esc keybinding to roll back a conversation session history via the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..
    • Enables cross-org capability share links that automatically redirect recipients to the correct page regardless of their org slug.
    • Enables sandbox runtimes to auto-install Python packages and system dependencies declared in capability manifests at load time.

    4 details in Everything

51. AIRT Report Builder now generally available with templates, branding, and DOCX export May 7, 2026 · release notes

    Dreadnode GA: Report templates, DOCX export, GuardSessionPolicy with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. tool gating, dn CLI overhaul

    • AIRT Report Builder graduates to general availability with saved templates (load/save/rename/delete), custom branding support (logo, company name, title, confidentiality footer), and DOCX export
    • GuardSessionPolicy gates every agent tool call through an LLM judge before execution using a built-in safety rubric and optional custom rules
    • GuardSessionPolicy supports five transcript strategies (rubric_only, intent_only, intent_plus_calls, full) to control judge context
    • New dn session CLI command group and export endpoint convert session transcripts to ATIF v1.7 or OpenAI Chat Completions format
    • Added dn capability uninstall command, dn inference-model (alias dn llm), dn secret list, dn environment wait, and dn update commands

    +1 more show less

    • Platform admins can configure featured catalog models via a new admin UI setting without code changes

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !dn env is renamed to dn environment (alias retained)
52. May 2026 May 1, 2026 · release notes

    Dreadnode May 2026: Android APK research capability, Jira/GitHub MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connectors, artifact logging tools, and compound eval verification

    └──▷ USE IT
    Run a web-security evaluation using compound verification to prevent reward hacking.
    shell copy

    dn task validate --method flag_and_judge --task my-eval-task.yaml
    dn outcome-judge run --trajectory /path/to/trajectory.json

    Attach logs and artifacts to a web-security agent run.
    shell copy

    log_image_output ./screenshot.png
    log_file_artifact ./debug.log

    • android-apk-research capability bundle with a 10-tool MCP server for static semantic vulnerability research on Android APKs
    • Jira MCP connector lets web-security agents export validated findings to Jira Cloud as remediation tickets
    • GitHub MCP connector lets web-security agents file findings as GitHub issues and add follow-up comments
    • Four new path-based logging tools for web-security agents: log_image_output, log_audio_output, log_video_output, and log_file_artifact to attach artifacts to runs
    • New built-in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. rubric for the SDK’s default LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scorer with graduated pentest-aligned cross-boundary access criteria

    +4 more show less

    • dn task validate now accepts flag_and_judge and script_and_judge compound verification methods
    • dn outcome-judge run CLI subcommand exposes outcome_judge agentic verification method for inspecting agent trajectories
    • Six new web app pentesting skills in the web-security capability: ESI injection, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.-Web pentest, H2C/WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. smuggling, HTTP connection contamination, timing-attack recon, and XSLT injection
    • waymore integration added to web-security capability runtime for historical URL and response retrieval from Wayback Machine, CommonCrawl, OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure., URLScan, and VirusTotal

    9 details in Everything