The AI Toolchain — issue 005, August 23, 2026

Adds promptfoo logs command to view log files from the CLI; -d/--description flag on redteam generate for labeling generated scans; --share/--no-share flags for Model Audit to control cloud sharing; $VAR syntax support in file paths for referencing environment variables in configuration; support for multiple --env-file flags to load several environment files in one invocation; and an --extension flag to load extensions via the command line.

$ promptfoo logs

$ promptfoo redteam generate -d 'nightly-telecom-scan' --config redteam.yaml

$ promptfoo eval --env-file .env --env-file .env.secrets -c promptfooconfig.yaml

Adds numTests config key to cap the number of test cases generated per red team strategy; metadata.sessionId surfaced as a variable column in eval result tables and exports; a word-count assertion type to validate response word counts; a __count variable for use in derived metrics to compute averages; and test-level prompts filter, providers filter, and per-test structured output configuration at the individual test case level.

strategies:
  - id: jailbreak
    numTests: 20
assertions:
  - type: word-count
    threshold: 200

Adds apiBaseUrl and websocketUrl override config and function call support to the xAI Voice provider.

Adds a Transformers.js provider to run Hugging Face models locally in Node.js or the browser; Vercel AI Gateway and Cloudflare AI Gateway providers for routing requests; an AWS Bedrock Video provider supporting Nova Reel and Luma Ray 2 video generation; and an Azure AI Foundry Video provider for Sora video generation.

Adds --output json and --output yaml flags to openshell sandbox get, openshell sandbox status, and openshell sandbox create for machine-readable output, e.g. openshell sandbox create --output json -- claude or openshell sandbox status --output yaml.

$ openshell sandbox create --output json -- claude

$ openshell sandbox status --output yaml

Adds stop and start operations to the sandbox subcommand, enabling sandboxes to be suspended and resumed without deletion, e.g. openshell sandbox stop my-sandbox followed later by openshell sandbox start my-sandbox.

$ openshell sandbox stop my-sandbox
# ... later ...
openshell sandbox start my-sandbox

The CLI now warns when a value passed to --env at sandbox creation looks like a credential, helping prevent accidental secret exposure, e.g. openshell sandbox create --env API_KEY=sk-abc123secret -- claude.

$ openshell sandbox create --env API_KEY=sk-abc123secret -- claude

The Helm chart gains cert-manager external issuer support and OpenShift passthrough Route support for deployment, plus a storageClassName configuration for workspace PVCs to control storage class selection in Kubernetes deployments.

OpenShell now emits AI inference events using the OCSF ai_operation profile on ApiActivity events, with the OCSF schema bumped to v1.8.0 (OCSF class ID 6003).

Adds a policy DNS correlation store linking DNS lookups to outbound TCP connections for richer network policy decisions, and enables Docker and Podman runtimes to enforce policy DNS and transparent TCP, extending L7 network controls to both container backends.

Adds a complete Go SDK with domain clients, authentication, and hardening, plus a TypeScript SDK published as @nvidia/openshell-sdk, enabling programmatic integration with OpenShell from both languages.

Adds nono connect subcommand to attach a local terminal to a session hosted by nono-console, usable as nono connect for interactive discovery or nono connect <session-id> to attach directly by global session ID. Extends nono ps with a --remote flag to list sessions hosted by the enrolled tenant's nono-console, combinable with --all and --json for full remote session visibility.

$ nono ps --remote --all --json

$ nono connect local:host:abc123

Adds export_env to tool-sandbox command policy config, letting callers declare specific environment variables to pass through to child tools verbatim, bypassing the allow_vars blocklist — supports exact names, trailing-* prefixes, or bare *. Adds session_export_env key to command_policies config for declaring env pass-through when the resolved caller is the session itself rather than a mediated command.

{
  "command_policies": {
    "commands": {
      "my-tool": {
        "export_env": ["PYTHONPATH"]
      }
    }
  }
}

Adds mediation for vault login -method=oidc with support for a custom inject_header and a per-command open_port, so Vault OIDC flows can complete inside a sandboxed tool policy.

{
  "command_policies": {
    "credentials": {
      "vault-oidc": {
        "type": "proxy",
        "upstream": "https://vault.example.com",
        "inject_header": "X-Vault-Token",
        "credential_format": "Bearer {}"
      }
    },
    "commands": {
      "vault": {
        "from": {
          "session": {
            "sandbox": {
              "open_port": 8250,
              "credentials": [{ "name": "vault-oidc" }]
            },
            "invocation_policy": {
              "default": "deny",
              "allow": [
                { "argv": { "prefix": ["login", "-method=oidc"] } }
              ]
            }
          }
        }
      }
    }
  }
}

The external value for --sandbox-policy on Linux now keeps Landlock active for filesystem/process policy while only delegating TCP enforcement externally, rather than installing no sandbox at all.

Adds CapturedNonceShape with a jwt option for capture intercepts, emitting a <header>.<payload>.nono_<64hex> token so consumers that validate JWT structure before use can still resolve the embedded nonce.

Adds a static seccomp network baseline on Linux (alongside Landlock) under the auto --sandbox-policy mode, strengthening network restriction on kernels where Landlock ABI < V4.

Removes openclaw and swival as built-in profiles; users relying on them must supply their own profile going forward. Any nono run --profile openclaw or nono run --profile swival invocation will fail after upgrading.

Removes the deprecated nono learn command (deprecated since v0.50.1); any scripts or workflows invoking nono learn will break — use nono run instead.

New .sbxenv.yaml file defines agent, workspace, kits, environment variables, secrets, registry credentials, ports, and resource limits, and is committable with a project for reproducible contributor environments. sbx env run provisions a sandbox from the file and opens an interactive session, while sbx env create, sbx env exec, and sbx env rm manage the full lifecycle. Multiple .sbxenv.yaml files can be combined for shared configuration with local overrides, and host environment variable references pull in machine-specific paths and credentials.

$ sbx env run

# .sbxenv.yaml
agent: claude
workspace: .
kits:
  - name: my-kit
env:
  - NODE_ENV=development
secrets:
  - MY_API_KEY
ports:
  - 8080

Experimental --usb flag on sbx create (enabled via DOCKER_SANDBOXES_FEATURE_SANDBOX_USB environment variable) re-attaches specified USB devices into the sandbox via usbfs on Linux x86_64/ARM64.

$ DOCKER_SANDBOXES_FEATURE_SANDBOX_USB=1 sbx create --usb /dev/bus/usb/001/002 my-sandbox

New --deny-network HOST flag on sbx run and sbx create records per-sandbox network deny rules at creation time, with layer-aware egress messages; blocked HTTPS proxy connections now appear in sbx policy log even when the client aborts the TLS handshake, and IP-literal destinations denied by a CIDR rule fail fast with a policy message instead of timing out.

$ sbx run --deny-network 10.0.0.0/8 claude

New sbx mcp subcommand registers and manages remote or local MCP servers, backed by a built-in MCP gateway that keeps OAuth credentials on the host. Dynamic MCP tools mcp-find, mcp-add, and mcp-config-set attach registered MCP servers to sandboxes, and MCP server and tool registrations can be governed organization-wide using Cedar policies.

Experimental proxy, proxy.sandbox, proxy.daemon, and matching no_proxy settings provide separate proxy configuration scopes for sandbox and daemon traffic; proxy.integratedAuth on Windows enables NTLM/Kerberos/Negotiate authentication to upstream proxies, and tls.allowNegativeSerial (set via sbx settings set tls.allowNegativeSerial true) adds compatibility with TLS-inspecting proxies issuing certificates with negative serial numbers.

sbx run --model <name> claude can run Claude Code against a local GGUF model (experimental); models from an existing Ollama installation were selected with an ollama/ prefix, which is now replaced by an explicit --provider ollama flag on sbx run --model.

$ sbx run --model ollama/llama3 claude

Kits can now be signed and verified with cosign-compatible Sigstore signatures via sbx kit sign / sbx kit verify, with optional policy enforcement at load time.

Introduces kit spec schemaVersion: '2' with clearer structure for setup, permissions, agent instructions, networking, and credentials, while v1 kits continue to load via the legacy path. Kit install commands can now consume static files from files/home, including binary files, and kits using extends correctly inherit and override the base image or build source of their parent.

sbx run and sbx create now accept -e/--env and --env-file to inject environment variables into a sandbox, following docker run precedence rules.

Sandboxes now expose SANDBOX_NAME and SANDBOX_ID environment variables matching the values shown by sbx ls --json; the older SANDBOX_VM_ID variable is deprecated.

Claude Code's /remote-control endpoint can now be used inside sandboxes by enabling the claude.remoteControl setting via sbx settings set claude.remoteControl true.

Experimental sbx run --gpu enables NVIDIA VFIO GPU passthrough on Linux, enabled via sbx settings set feature.sandbox-gpu true.

New sbx prune command bulk-removes stopped sandboxes with filtering by how long each has been stopped, never touching running sandboxes.

sbx secret set and sbx secret set-custom now support dynamic secrets that resolve values from a reference or command, with options to control refreshing, verification, and error output.

New platform.images.registryMirror setting redirects Docker Hub-resolving sandbox template and kit images to an organization's registry mirror.

sbx create and sbx run show detailed structured startup progress, including environment files loaded, resources provisioned, and each kit command outcome; kit-install progress streams live during sbx create --kit.

Service and custom secrets are now global by default, with a --sandbox flag to scope a secret to a single sandbox; the legacy positional and --global forms are deprecated with warnings.

Pins project-scoped skill installs in a toolhive.lock.yaml lock file including Sigstore provenance fields. Adds thv skill sync to restore a project's pinned skill set on any machine and verify on-disk content in CI, and thv skill upgrade to re-resolve pinned skills to newer content without silent lock drift, both with typed exit codes and a pre-install confirmation gate for scriptable CI use. Adds Sigstore signature verification for skills at install, sync, and upgrade time.

$ thv skill sync

$ thv skill upgrade

Wires RFC 8693 token exchange into the embedded authorization server's token endpoint, with delegated token audience bounded by the subject token; subject tokens from trusted external OIDC issuers (Keycloak, Entra, Okta) can be validated for exchange. Adds trusted_issuers to the embedded auth server config so agents can exchange subject tokens from external OIDC providers for ToolHive-scoped delegated tokens under a fail-closed RFC 8693 consent policy. Supports actor_token in RFC 8693 flows for delegated-identity scenarios where the acting party differs from the subject, and makes RFC 8693 delegate (token-exchange) clients reachable and usable via vmcp-config.yaml. Audit logs capture the RFC 8693 act claim and full delegation chain, distinguishing an agent acting for a user from the user itself.

backends:
  github:
    type: token_exchange
    tokenExchange:
      tokenUrl: "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token"
      clientId: "vmcp-github-exchange"
      clientSecretEnv: "GITHUB_EXCHANGE_SECRET"
      audience: "github-api"
      scopes: ["repo", "read:org"]

Adds aggregation.defaultToolVisibility: deny to vMCP config so only workloads explicitly listed in aggregation.tools have their tools advertised, closing the fail-open gap in tool aggregation. On the Modern (2026-07-28) path, vMCP tools excluded via filter, excludeAll, or excludeAllTools are no longer directly callable — tools/call now returns -32602 at HTTP 400 instead of executing; un-filter the tool or wrap it in a composite tool.

name: "engineering-vmcp"
groupRef: "engineering-team"
aggregation:
  defaultToolVisibility: deny
  tools:
    - workload: github
    - workload: jira

Adds insecureAllowHTTP: true under spec.inline in MCPOIDCConfig to explicitly opt in to plain-HTTP issuer and JWKS URLs for dev/test environments; production configs must use HTTPS. MCPOIDCConfig resources of type inline with a plain-HTTP, malformed, or scheme-less issuer or jwksUrl now flip to Valid=False on next reconcile and block reconciliation of every MCPServer, MCPRemoteProxy, and VirtualMCPServer referencing them; add insecureAllowHTTP: true or switch to HTTPS to unblock.

apiVersion: toolhive.stacklok.dev/v1beta1
kind: MCPOIDCConfig
metadata:
  name: keycloak-auth
spec:
  type: inline
  inline:
    issuer: http://keycloak:8080/realms/toolhive
    jwksUrl: http://keycloak:8080/realms/toolhive/protocol/openid-connect/certs
    insecureAllowHTTP: true

Namespace-scoped Helm installs (operator.rbac.scope=namespace) now fail helm upgrade at render time unless operator.features.storageVersionMigrator: false is set, because the StorageVersionMigrator controller is now enabled by default (operator.features.storageVersionMigrator: true).

operator:
  rbac:
    scope: namespace
  features:
    storageVersionMigrator: false

status.referencingWorkloads, status.referenceCount, and the References printer column are removed from all six config CRDs (MCPOIDCConfig, MCPAuthzConfig, MCPExternalAuthConfig, MCPToolConfig, MCPWebhookConfig, MCPTelemetryConfig); replace any automation reading them with workload field queries via -o json | jq.

Cedar authorization policy is now evaluated against the post-mutation MCP request, closing a bypass window for length-preserving mutating webhook rewrites. Cedar policy and audit records now evaluate against the post-mutation MCP request body; re-audit Cedar policies and update SIEM rules keyed on type or target.name before upgrading workloads that combine a mutating: entry in --webhook-config (or MCPWebhookConfig.spec.mutating) with Cedar authorization.

Adds TOOLHIVE_API_TIMEOUT environment variable to override the CLI API client timeout for thv skill and thv ai-plugin commands (default is 10 minutes).

$ TOOLHIVE_API_TIMEOUT=30s thv skill list

With Cedar authorization enabled (--authz-config), POST requests without Content-Type: application/json (including a missing header) now return 400 instead of being forwarded unauthorized; all MCP POST clients must send Content-Type: application/json.

Composite tools now support MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint), with a conservative fail-closed safety floor derived from the workflow's step tools when none are set explicitly.

pkg/telemetry/providers is deleted and two optimizerdec constants are removed from the Go API; out-of-tree Go importers must drop references to these before upgrading.

Supports the MCP 2026-07-28 stateless ('Modern') spec revision end to end across transport proxies, transparent proxy, and Virtual MCP — bridging era-mismatched client×backend combinations. Modern client-facing dispatch is gated per capability instead of a global kill-switch, with listen-stream support and pagination. Stabilizes vMCP protocol negotiation, stopping flapping between Modern and Legacy MCP revisions, and the readiness probe now sends the current MCP protocol version instead of a hardcoded 2024-11-05.

Virtual MCP is now MCP-conformant: completions, resource templates, subscriptions, and mid-call server-to-client forwarding all work. Backend list_changed notifications are now consumed and propagated to clients for tools, resources, and prompts. Guarantees tools/list pagination completeness for aggregated sets exceeding 1,000 tools. Tool definitions carrying invalid x-mcp-header annotations (SEP-2243) are now rejected as the spec requires.

Rate-limit JSON-RPC error code changed from -32029 to 429; clients branching on error.code == -32029 must match 429 instead.

Guards OAuth token and Dynamic Client Registration (DCR) endpoints against Server-Side Request Forgery (SSRF) attacks, supports confidential clients in dynamic client registration, ignores unsupported grant types in CIMD documents for interoperability with authorization servers advertising non-standard grant types, and dynamically registered OAuth clients now renew expiring client secrets automatically (RFC 7591/7592).

Adds a plugins key to the lock file schema so plugin entries are tracked in lock provenance, plus a PluginLockService and a managed install flag to support plugin lifecycle management through the lock file. Records certificate ref and runner in lock provenance for supply-chain traceability, and enforces the recorded ref and runner fields during skill verification.

Adds a reasoning field to LLM end events in the Python SDK, populated via _extract_reasoning() from LangChain ChatGeneration messages. Supports three provider layouts: a summary list of {type: 'summary_text', text: ...} entries (OpenAI Responses / LangChain default), a bare reasoning string (LangChain output_version='v1'), and Anthropic's thinking string. Also extends reasoning capture to the TypeScript OpenAI SDK integration, reading delta.reasoning_content from streamed chat completion chunks for OpenAI-compatible servers.

New Claude Code plugin (integrations/claude-code/adrian_cc/agent.py) connects Claude Code hooks to the Adrian backend via WebSocket, supporting three server-driven execution modes: MODE_ALERT (fire-and-forget), MODE_BLOCK (wait for verdict, block on policy), and MODE_HITL (wait for human approval on the dashboard). HITL verdicts are now forwarded to Claude Code for native inline approval, letting human-in-the-loop decisions flow directly back to a running Claude Code session.

Adds PII filtering (integrations/claude-code/adrian_cc/pii/_patterns.py), detecting 12 categories — EMAIL, PHONE, SSN, CREDIT_CARD, IP_ADDRESS, DATE_OF_BIRTH, IBAN, PASSPORT, STREET_ADDRESS, POSTAL_CODE, DRIVER_LICENSE, and AWS_KEY — in agent conversations before they are forwarded to the backend.

The Scenario API in giskard.checks composes multi-turn eval interactions via .interact() and .check() chaining, with a .run() async entrypoint and .print_report() output.

import asyncio
from giskard.checks import Scenario, Groundedness

def get_answer(inputs: str) -> str:
    return "Paris"  # replace with your RAG pipeline

async def main() -> None:
    scenario = (
        Scenario("test_capital_grounded")
        .interact(inputs="What is the capital of France?", outputs=get_answer)
        .check(
            Groundedness(
                name="answer is grounded",
                context="France is in Western Europe. Its capital is Paris.",
            )
        )
    )
    result = await scenario.run()
    result.print_report()

asyncio.run(main())

Giskard v2 is no longer actively maintained; the v2 automatic tabular scan (giskard.Model + giskard.Dataset), the giskard.testing ML test suite, and Giskard Hub are absent from v3 — install pip install 'giskard[llm]>2,<3' to retain v2 behavior. v3 also requires Python 3.12+; earlier Python versions are no longer supported.

vulnerability_scan in giskard.scan automates red-teaming of agents across OWASP LLM Top-10 threat categories including prompt injection, harmful content, stereotypes, and misinformation, accepting target, description, and languages parameters. The built-in prompt-injection dataset was later expanded with additional scenarios and templates to broaden adversarial coverage.

import asyncio
from giskard.scan import vulnerability_scan

async def my_agent(inputs: str) -> str:
    return f"Echo: {inputs}"  # replace with your real agent

async def main() -> None:
    await vulnerability_scan(
        target=my_agent,
        description="A customer support chatbot for an e-commerce platform.",
        languages=["en"],
    )

asyncio.run(main())

Ships Groundedness, Conformity, and LLMJudge checks in giskard.checks, with default model openai/gpt-4o-mini. A later release enforces non-blank judge reasons so these checks always carry an explanatory rationale.

import asyncio
from giskard.checks import Scenario, Groundedness

def get_answer(inputs: str) -> str:
    return "Paris"  # replace with your RAG pipeline

async def main() -> None:
    scenario = (
        Scenario("test_capital_grounded")
        .interact(inputs="What is the capital of France?", outputs=get_answer)
        .check(
            Groundedness(
                name="answer is grounded",
                context="France is in Western Europe. Its capital is Paris.",
            )
        )
    )
    result = await scenario.run()
    result.print_report()

asyncio.run(main())

generate_suite accepts custom ScenarioGenerator instances, with a vulnerability_suite_generator_registry for registering domain-specific generators. A later release exposed the default registry generators on the public API via vulnerability_suite_generator_registry, enabling third-party generators to be registered and consumed by both vulnerability_scan and generate_suite.

Unknown fields anywhere in the persisted-scenario tree are now rejected via strict validation, so saved scenarios containing unrecognised fields fail to load after upgrade. The field holding the value under test on every check is renamed to target_key, breaking any code that referenced the previous field name.

New giskard[scan], giskard[openai], and giskard[anthropic] install extras wire in provider SDKs and scanner dependencies independently. Telemetry can be disabled via DO_NOT_TRACK=1 or GISKARD_TELEMETRY_DISABLED=1 environment variables set before import.

quality_scan with KnowledgeBase support in giskard-scan evaluates RAG knowledge-base quality, replacing the v2 RAGET functionality.

Skill-Scan is repackaged as a standalone PyPI package aig-skill-scan for easy CI/CD integration, Agent-Scan is modularized as a standalone CLI with AIG integration support, and MCP-Scan is modularized with dual-mode support (CLI + AIG Web) plus a new standalone mcp-scan-lite module.

Agent-Scan gained new OWASP-based detection skills across releases: v4.5.1 added agentic-supply-chain, cascading-failure, human-agent-trust, inter-agent-comm, unexpected-code-execution, and web-exfiltration-detection, bringing the total to 10 detection skills; v4.5.0 added 4 additional (unnamed) detection skills for AI agent security.

The vulnerability/fingerprint library grew across this window: v4.5.0 expanded coverage to 130 AI components and 1888 rules with new AI component fingerprints; v4.5.1 updated the rule set to the 2026-07-24 release; v4.5.2 expanded further to 2000+ CVE rules and added GET-only fingerprint detection for Qdrant, Chroma, and Weaviate.

Adds Many-Shot, PAIR, GOAT, and ActorAttack multi-turn jailbreak attack methods to PromptSecurity evaluation.

Adds Skill-Scan Agent Skill security auditing support with 9 risk categories, achieving a SkillTrustBench top score of 0.9848; skill audits can also export SARIF 2.1.0 output.

Adds execution_successful top-level status field and analysis_completeness.ledger_exceptions diagnostics to JSON/SARIF output, with canonical inspection-ledger accounting across static and LLM analysis stages, per-component coverage, and explicit out-of-scope records. The CLI now exits with code 2 for a fatal execution or accounting failure even when a JSON report was produced, enabling fail-closed CI gates, and recursive scans propagate child scan failures into the combined report, returning non-zero exit when any child fails. Baseline files must be regenerated with skillspector baseline <path> to produce version 2 fingerprints that bind accepted findings to the scanner version, source content, and full finding evidence — version 1 fingerprints are rejected on upgrade (rules-only v1 baselines remain supported with a warning) — and JSON integrations must now treat invalid/missing output, a nonzero exit, or execution_successful: false as a blocking error and inspect analysis_completeness.ledger_exceptions for diagnosis.

$ skillspector scan ./my-skill/ --format json --output report.json; python3 -c "import json,sys; r=json.load(open('report.json')); sys.exit(1 if not r.get('execution_successful') else 0)"

$ skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml

Adds SKILLSPECTOR_MAX_LLM_CONCURRENCY environment variable to configure the default async LLM batch concurrency; blank or invalid values retain the default of 10, and values below 1 clamp to 1.

$ SKILLSPECTOR_MAX_LLM_CONCURRENCY=1 skillspector scan ./my-skill/

$ SKILLSPECTOR_PROVIDER=anthropic
ANTHROPIC_API_KEY=sk-ant-...
SKILLSPECTOR_MAX_LLM_CONCURRENCY=3

Enforces INGEST_MAX_BYTES (100 MiB per-ingest cap) and INGEST_MAX_ZIP_MEMBERS (10,000 entries) for streamed URL downloads, zip archives, and Git repository clones, failing closed with IngestLimitExceededError on breach.

Adds opt-in automatic discovery of a top-level .skillspector-baseline.yaml file; a baseline explicitly supplied via --baseline remains authoritative over the discovered file.

$ skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml
# commit .skillspector-baseline.yaml to the repo root, then in CI:
skillspector scan ./my-skill/

Adds MCP registry posture scanning via the skillspector mcp command, installed with the mcp extra (skillspector[mcp]).

HTTP MCP clients can no longer scan local filesystem paths or supply local YARA-rule directories; use a remote repository or URL for HTTP requests, or switch to stdio transport for local scans.

Adds static analysis coverage for insecure deserialization patterns surfaced as AST10, TT6, and DS1–DS4 findings; detects whitespace-padding techniques used to conceal prompt-injection instructions inside skill content; and adds a HIGH-severity SC8 finding when a skill ships Python bytecode or __pycache__ content.

Mend AI adds framework-based agent discovery that detects AI agents and their connected tools and Model Context Protocols (MCPs) within projects, surfacing referenced models and system prompts. A new dedicated agent dashboard and detailed agent views (currently in beta) let teams manage and secure the AI agent ecosystem; accessible via the AI Inventory section's new 'Agents' dashboard (beta).

Adds entity-level suppression and review for AI entities — Models, System Prompts, Agent Configs, and Agents — including a status column tracking triage states (unreviewed, manually reviewed, or suppressed), bulk actions, and an audit trail that persists across scans.

Adds a unified run.spec selection grammar that combines probe, buff, and intent selection into a single specification, replacing separate probe_spec and buff_spec config keys. Existing config files using top-level probe_spec or buff_spec will break, and CLI plugin selection options for probes and buffs are now deprecated (backwards-compatible aliases remain).

Adds probe_summary entries and an enriched technique_intent_matrix (with names and descriptions) to report.jsonl output, providing per-probe and cross-technique/intent reporting. The report.jsonl structure changes accordingly: a new probe_summary entry type is added, the digest format is expanded, and older digest values tied to the removed *_spec configuration keys are no longer emitted.

Adds a native Anthropic generator plugin, enabling direct scanning of Anthropic Claude models without going through a compatibility shim.

$ python -m garak --target_type anthropic --target_name claude-3-5-haiku-20241022 --probes encoding

Adds suppressed_params support to the BedrockGenerator, allowing callers to exclude specific inference parameters from AWS Bedrock requests.

adr-sensor, installable via pip install adr-sensor, is a Python package that collects and normalizes agent telemetry from Claude Code, Cursor, Codex, opencode, and Claude Desktop into a unified schema. It supports agent observability across macOS, Linux, and Windows, capturing agent intent, tool use, and execution traces from 7+ AI coding tools.

$ pip install adr-sensor

AgentMesh transitions from open access to a tiered freemium model: an Anonymous tier (no login) exposes 100 items per category via the Web UI; a Signed-In free tier unlocks 300 items per category plus a trial of 20 API calls/month capped at 1/day; a Premium tier ($15/user/month) grants full catalog access, 300 API calls/month capped at 20/day, and a bundled Kirin endpoint-agent license; a Pro tier ($850/user/month) grants unlimited API access with no daily cap and a bundled Kirin IDE license, targeting automated pipelines and production integrations; and a custom-priced Enterprise tier covers deployments of 10 or more users with dedicated support. Existing users without a paid plan are now subject to the Anonymous or Signed-In tier limits.

Privacy Mode (now in Preview) restricts session visibility by default so that only agent sessions with policy violations are automatically surfaced to security teams; compliant sessions without violations remain private unless an authorized governance team member records an explicit justification for access, with Certiv logging who accessed the session and why. It integrates with the existing Policy Engine and Scout endpoint observer — Block, Pause, and Steer runtime interventions continue operating unchanged, since Privacy Mode governs only post-session review access.

The POST /openai/v1/chat/completions endpoint now supports openai/gpt-oss-20b (20B MoE, 32 experts, 131K token context, 32K max output tokens, ~1000+ TPS) and openai/gpt-oss-120b (120B MoE, 128 experts, 131K token context, 32K max output tokens, ~500+ TPS). Both models support structured outputs, built-in browser search, and code execution.

$ curl https://api.groq.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "openai/gpt-oss-20b", "messages": [{"role": "user", "content": "Explain why fast inference is critical for reasoning models"}]}'

$ curl https://api.groq.com/openai/v1/chat/completions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "openai/gpt-oss-120b", "messages": [{"role": "user", "content": "Summarise this clinical report and flag any anomalies"}]}'

New gpt-realtime-2.1 model adds improved alphanumeric recognition, silence and noise handling, and interruption behavior for realtime reasoning workloads.

The Python SDK ships v1.0, migrating the HTTP layer from httpx to httpx2 (build custom http_client, Timeout, and transport objects from httpx2; call httpx2.alias_httpx() at startup to preserve httpx-patching tracing/mocking libraries) and now requires Python 3.10 or later. It removes the legacy Text Completions API, drops the temperature, top_p, and top_k parameters from Messages methods, removes the tool runner's compaction_control, changes the async client so .with_raw_response results now require await response.parse() instead of a synchronous call, and makes AnthropicBedrock raise an error when no AWS region is configured instead of silently defaulting to us-east-1.

import httpx2
httpx2.alias_httpx()

import anthropic
client = anthropic.Anthropic()

import anthropic
import asyncio

async def main():
    client = anthropic.AsyncAnthropic()
    raw = await client.messages.with_raw_response.create(
        model="claude-opus-4-5",
        max_tokens=256,
        messages=[{"role": "user", "content": "Hello"}]
    )
    message = await raw.parse()
    print(message.content)

asyncio.run(main())

Claude Managed Agents can restrict web_search and web_fetch tools by setting allowed_domains or blocked_domains on the tool's entry in the agent_toolset_20260401 configs array; web_fetch also accepts max_content_tokens and web_search accepts user_location.

{
  "agent_toolset": "agent_toolset_20260401",
  "configs": [
    {
      "name": "web_search",
      "type": "web_search",
      "allowed_domains": ["example.com", "docs.example.com"],
      "user_location": "US"
    },
    {
      "name": "web_fetch",
      "type": "web_fetch",
      "allowed_domains": ["example.com"],
      "max_content_tokens": 8000
    }
  ]
}

The Files API (/v1/files endpoints) is promoted to GA — the files-api-2025-04-14 beta header is no longer required. The new response format adds expires_at on file objects, expires_in_seconds on upload, page/next_page pagination, and an ids[] filter on list requests; requests sent without the beta header now receive this new format rather than the previous one.

$ # Upload a file with a 7-day expiry
curl https://api.anthropic.com/v1/files \
  -H 'x-api-key: $ANTHROPIC_API_KEY' \
  -H 'anthropic-version: 2023-06-01' \
  -F '[email protected];type=application/pdf' \
  -F 'expires_in_seconds=604800'

# List specific files by ID with pagination
curl 'https://api.anthropic.com/v1/files?ids[]=file_abc123&ids[]=file_def456&page=1' \
  -H 'x-api-key: $ANTHROPIC_API_KEY' \
  -H 'anthropic-version: 2023-06-01'

computer_toolset_20260801 is promoted to GA on the Claude API — no beta header required — adding batch actions (multiple actions per turn), enabling zoom by default, and supporting per-member configuration via configs; earlier beta versions remain available. Existing computer-use integrations must follow the 'Migrate from computer_20251124' guide since the request shape and tool handling change. Both computer_toolset_20260801 and browser_toolset_20260801 are available for Claude Fable 5, Claude Mythos 5, Claude Opus 5, Claude Sonnet 5, and Claude Opus 4.8.

Managed Agents can consult a strategic advisor model mid-turn via the multiagent config, e.g. {"multiagent": [{"type": "advisor", "model": "claude-opus-5"}]}.

{
  "multiagent": [
    { "type": "advisor", "model": "claude-opus-5" }
  ]
}

Agents can pin inference to a specific geography for data residency by setting inference_geo (e.g. "eu") under the model field when creating an agent.

{
  "model": {
    "name": "claude-opus-5",
    "inference_geo": "eu"
  }
}

Workbench is renamed to Playground, now available at platform.claude.com/playground and covering every Messages API parameter in an interactive UI. It adds built-in templates demonstrating features like code execution and web search, and surfaces the full SDK request and raw API response for each run.

The claude-opus-4-1-20250805 model has been retired; all API requests to that model now return an error. Upgrade to Claude Opus 5.