OpenAI Acquired Promptfoo. Here's What That Means for AI Security Testing.

Yesterday OpenAI announced that it is acquiring Promptfoo, the open-source AI red-teaming tool used by 350,000 developers (130K monthly active) and over 25% of the Fortune 500. All 11 employees, including co-founders Ian Webster and Michael D'Angelo, will join OpenAI. Promptfoo will be integrated into OpenAI Frontier, the enterprise platform for building and operating AI agents.

Promptfoo raised $23 million (Series A led by Insight Partners, seed from a16z and Shopify CEO Tobi Lutke) and was valued at $86 million. It built the most popular open-source framework for LLM evaluation and red teaming. It was good software. We used it.

Here is how we read the acquisition.

What It Confirms

AI security testing is an enterprise category. OpenAI paying $86M+ for a red-teaming tool settles whether teams need it. Companies building AI agents need adversarial testing.

Agent security is where the market is moving. Ian Webster put it directly: "As AI agents become more connected to real data and systems, securing and validating them is more challenging and important than ever." OpenAI acquired Promptfoo for Frontier, its agent platform.

The Multi-Vendor Question

Promptfoo's strength was neutrality. It tested OpenAI, Anthropic, Google, Meta and open-source models with the same rigor. Promptfoo's own blog commits to keeping the repository public under the same license, supporting multiple providers and cutting releases.

We take that commitment at face value and will watch how it evolves. Most enterprises run multi-model architectures and will want that investment to continue. Security testing works best when the tooling is agnostic to the system under test.

Model Testing vs. Agent Testing

This is the larger shift the acquisition highlights.

Promptfoo was strong at model-level testing:

• LLM evaluation: comparing outputs across providers
• Prompt injection testing: detecting when models follow injected instructions
• Jailbreak detection: testing guardrail bypasses
• MCP security testing: tool response manipulation, cascading unauthorized actions and data leakage

Promptfoo was also expanding into agent and MCP testing. Its MCP security testing guide covered real attack vectors. Integrating that into Frontier raises the baseline for every team building on OpenAI's platform.

There is a layer below application-level scanning that automated tools rarely reach. Auditing the protocol SDKs' source code reveals systemic issues: specification gaps present in every implementation that follows the spec as written.

• Tool shadowing: the SDK's listChanged notification has no origin verification, so a rogue server can silently replace trusted tools (documented in our MCP security research)
• Token audience confusion: the SDK's ProviderTokenVerifier accepts tokens from any registered issuer, so a read-only token can run admin operations
• Stale authorization: cached sessions have no re-validation, so revoked permissions persist

We tested 5 production MCP implementations and found 33 vulnerabilities across these patterns, plus 7 specification-level gaps (SG-1 through SG-7). One vendor patched in 6 hours. The vulnerabilities were not in the models. They were in the protocol layer.

This is not a critique of Promptfoo. Automated scanning and source-code auditing solve different problems, and the market needs both.

What Changes Next

Platform-native security improves. Red teaming built into Frontier raises the floor for every team building agents there.

Depth testing is still needed. Automated scanning catches common patterns at scale. Manual work finds what it misses: issues in protocol design, authorization logic and the trust boundaries between services.

Agent security is its own discipline. Agents do not just generate text. They call tools, access databases, run code and cross trust boundaries. The attack surface is the integration layer: tool boundaries, authorization flows and multi-agent trust. That needs a different method than model evaluation.

Where Tachyonic Fits

We build security runtimes for AI agents and MCP systems. We test agents, not only models, with a focus on the integration layer:

• MCP tool boundaries: tool shadowing, description poisoning and cross-server trust
• Agent authorization: token audience confusion, stale authorization and privilege escalation through tool chains
• Multi-agent systems: cascading injection, inter-agent trust and orchestration-layer flaws

Our attack taxonomy of 168 attack patterns is open source. We published a source-code audit of both MCP SDKs and disclosed 33 vulnerabilities across production implementations. A runtime runs these patterns against your agent or MCP server and returns reproducible findings with a signed evidence bundle.

The free tier covers your first runtimes, and the quickstart takes minutes. To scope testing against a specific agent surface, book a 15-minute call.