SECURITY ATLAS / EVALUATION BRIEF
Promptfoo AI Security Testing
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/promptfoo-agent-testing/

THE ATLAS TAKE
Promptfoo is a strong evaluation candidate for developers who want reproducible AI security tests close to application changes. Its agent and MCP guides are particularly useful because they distinguish a safe final response from unsafe intermediate tool execution. Atlas would use it to preserve high-confidence failure traces and targeted regressions, not to declare an application secure from a large pass count. Open-source, enterprise and hosted generation capabilities have different operating and data-handling boundaries. Promptfoo supplies assessment; production authorization and runtime enforcement still require their own controls.

SCOPE
Separate open-source testing from enterprise service capabilities and any OpenAI platform integration. An evaluation result does not enforce production tool policy.

WORTH A LOOK WHEN
Developer and security teams able to instrument an application and maintain versioned adversarial/regression tests.

THINK TWICE WHEN
The requirement is automatic production blocking or a zero-network setup without reviewing every provider/plugin path.

IMPLEMENTATION
1. Freeze target and test configuration
Record application/model versions, tool permissions, plugin selection and generation/grading providers.

2. Use synthetic observable actions
Create expendable resources and tracing that can prove authorization failures without exposing customer data.

3. Keep adjudicated regressions
Turn a confirmed failure into a narrow repeatable assertion, then run it with legitimate tasks after relevant changes.

OPERATING REALITY
The team owns target configuration, test data, generation/grading providers and result adjudication. Useful agent trajectories require instrumentation that exposes the relevant tool steps. Trace contents, grader inputs and attack feedback should be reviewed deliberately, because adding internal context can improve assessment while also changing what data leaves the application.

COMMERCIAL CONSIDERATIONS
Compare open-source operation with enterprise functionality and hosting requirements. Include target-model, generation/grading, infrastructure and reviewer costs; ownership announcements do not establish every platform entitlement.
- Generation, target and grading model consumption
- Selected enterprise/hosting features and infrastructure
- Instrumentation, finding review and regression maintenance

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Capture a synthetic unsafe intermediate tool action
Acceptance evidence: Verify the trace exposes the action even if the final response looks safe.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Turn the failure into a trajectory regression
Acceptance evidence: Preserve tool name, relevant arguments and expected denied behavior.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Audit actual assessment network paths
Acceptance evidence: Record providers, remote plugins, telemetry and any sanitized trace feedback.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Does this test exercise real tools or a model endpoint only?
- Which capabilities require the enterprise service?
- How are test data and evaluator model costs handled?

EVIDENCE GAPS
- Atlas has not independently benchmarked attack coverage or grader accuracy.
- Confirm current open-source/enterprise boundaries and exact provider/plugin data handling.

SOURCES
Promptfoo: agent testing and trace evidence (Product information)
https://www.promptfoo.dev/docs/red-team/agents/
Promptfoo: MCP security-testing scenarios (Product information)
https://www.promptfoo.dev/docs/red-team/mcp-security-testing/
Promptfoo: targets, plugins, and strategies (Product information)
https://www.promptfoo.dev/docs/red-team/configuration/
Promptfoo: generation, grading, and data handling (Product information)
https://www.promptfoo.dev/docs/red-team/troubleshooting/data-handling/
Promptfoo: project and ownership context (Product information)
https://www.promptfoo.dev/press/

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.