PROMPTFOO

OLYMPUS opened an institutional file on Promptfoo because it is the red-teaming and evaluation tool a large share of enterprise AI teams actually run, and since March 2026 it has belonged to one of the labs whose models those teams test. This is not a psychometric profile, since an institution has no Dark Triad. It is a mandate, a user base, a cap table and a licence, and the finding is the shape of the arrangement: the open-source harness that enterprises use to attack models is now owned by a company that sells models, and the only instrument on the record that keeps it neutral is a promise.

Institutional Archetype

THE HARNESS THE GRADED NOW OWNS — Promptfoo is a command-line tool and library that sends adversarial and routine test prompts at a model or an application and scores what comes back. Unlike the contract evaluators on the evaluator map it does not grade a lab’s model on the lab’s behalf; its customers run it themselves, against their own applications, in their own build pipelines. That is its reach and its distinction. On 9 March 2026 OpenAI announced it was acquiring the company, and Promptfoo’s pages now say it “is now part of OpenAI.” The tool that enterprises use to test whether a model can be made to misbehave is owned by a model vendor, and one of the models it was tested against three months earlier was that vendor’s.

Mandate & Origin

Promptfoo’s own account of its origin: “We founded Promptfoo in 2024 to make it easy for developers to systematically test their AI applications,” and “adversarial tests for security, safety, and other behavioral risks were the biggest blockers to shipping AI, especially at large enterprises” (Promptfoo, 9 Mar 2026). Its about page: “We are security and engineering practitioners who have scaled generative AI products to hundreds of millions of users.” It names two founders, Ian Webster, “CEO & Co-founder,” who “previously led LLM engineering and developer platform teams at Discord,” and Michael D’Angelo, “CTO & Co-founder,” “former VP of Engineering and Head of AI at Smile Identity” (Promptfoo, About). Insight Partners says the idea came to Webster at Discord in 2022 and that he built the first version as an open-source tool, “just something that I was doing for fun on the side” (Insight Partners, 3 Dec 2025). The repository’s GitHub record gives its creation as 28 April 2023, a year before the company’s stated founding, and lists the licence as MIT (GitHub).

What it sells and what it gives away. The README says: “promptfoo is a CLI and library for evaluating and red-teaming LLM-based apps,” that “LLM evals run 100% locally - your prompts never leave your machine,” and that it is “MIT licensed, with an active community” (GitHub). The pricing page lists a “Community” tier, “Free Forever,” described as “Our open-source tool, perfect for individual developers and small teams,” with “Red teaming (10k probes/month),” and an Enterprise tier that adds “Custom red teaming limits,” “Continuous monitoring,” a “Centralized security/compliance dashboard,” SSO and a “Managed cloud deployment” (Promptfoo, Pricing).

Its reach, as the company counts it. The counts have moved with each announcement. In July 2025: “over 125,000 developers use our open source framework and more than 30 Fortune 500 companies run our platform in production” (Promptfoo, 29 Jul 2025). In December 2025 Insight Partners: “more than 200,000 developers and over 80 Fortune 500 companies” (Insight Partners). In March 2026: “More than 350k developers have used it, 130k are active each month, and teams at more than 25% of the Fortune 500 rely on it” (Promptfoo, 9 Mar 2026), and OpenAI repeats the last figure: “trusted by over 25 percent of Fortune 500 companies” (OpenAI). The home page now reads: “156 of the Fortune 500 use Promptfoo in their AI development lifecycle,” with a strip of anonymized client descriptions that includes “Top foundation model lab,” “Top 5 global retailer,” “Top 3 U.S. wireless carrier,” “Top 5 U.S. healthcare company” and “Top 3 global strategy consultancy” (Promptfoo). Every figure is Promptfoo’s or its investor’s; the clients are described, not named, apart from the labs below.

Funding & Backers

Pre-acquisition, in the company’s words. A seed round of $5 million at launch in July 2024 (Insight Partners: “When it officially launched in July 2024, with $5M in seed funding”), then on 29 July 2025: “Promptfoo has raised an $18.4 million Series A led by Insight Partners, with participation from Andreessen Horowitz” (Insight Partners; Promptfoo, 29 Jul 2025). Ganesh Bell, a managing director at Insight Partners, joined the board at that round (“We’re excited to have Ganesh Bell, Managing Director at Insight Partners, join our board”). Zane Lackey, a general partner at Andreessen Horowitz, said: “When we first invested in Promptfoo, we recognized that AI security would become mission-critical for every enterprise.” The about page names “Early Supporters”: Bell and Lackey, Joel de la Garza (Investment Partner, Andreessen Horowitz), Tobi Lutke (CEO, Shopify), Stanislav Vishnevskiy (CTO, Discord), Frederic Kerrest (Vice-Chairman and Co-Founder, Okta) and Adam Ely (EVP, Head of Digital Products, Fidelity) (Promptfoo, About). TechCrunch, citing PitchBook, reported $23 million raised in total and a valuation of $86 million after the July 2025 round, and that “OpenAI did not disclose the value of the transaction” (TechCrunch, 9 Mar 2026). No lab appears as an investor in any of the company’s own announcements.

Since the acquisition. The money is its owner’s. OpenAI’s announcement of 9 March 2026: “We’re acquiring Promptfoo, an AI security platform that helps enterprises identify and remediate vulnerabilities in AI systems during development. Once the acquisition is finalized we will integrate Promptfoo’s technology directly into OpenAI Frontier, our platform for building and operating AI coworkers.” It adds: “The closing of the acquisition is subject to customary closing conditions” (OpenAI). Promptfoo’s founders wrote the same day that “OpenAI gives our work more resources and access to research at the model and inference layers that supercharge our goal of helping everyone ship secure, reliable AI,” and thanked the investors, “Ganesh at Insight Partners, Zane at a16z, their teams, and all the other angel investors” (Promptfoo, 9 Mar 2026). The company’s about page, press page and README now state it as done: “Based in San Francisco, California, Promptfoo is now part of OpenAI,” and the press page’s quick facts read “Part of OpenAI” (Promptfoo, About; Promptfoo, Press; GitHub). Neither company has published a closing notice or a price on the pages cited here.

Institutional Voice & Intent

Webster, in OpenAI’s announcement: “We started Promptfoo because developers needed a practical way to secure AI systems. As AI agents become more connected to real data and systems, securing and validating them is more challenging and important than ever. Joining OpenAI lets us accelerate this work, bringing stronger security, safety, and governance capabilities to the teams building real-world AI systems” (OpenAI). Srinivas Narayanan, OpenAI’s CTO of B2B Applications: “Promptfoo brings deep engineering expertise in evaluating, securing, and testing AI systems at enterprise scale. Their work helps businesses deploy secure and reliable AI applications, and we’re excited to bring these capabilities directly into Frontier” (same page). The home page tagline: “Ship agents, not vulnerabilities” (Promptfoo).

• On the long-term plan, in July 2025: “Our long-term vision is for Promptfoo to play the same role in AI infrastructure that CI pipelines play in DevOps: every new model or prompt change, or tool integration is automatically evaluated, red-teamed, and either blocked or promoted with a signed safety report” (Promptfoo, 29 Jul 2025).
• On who red-teams: “This process is how the big foundation labs - OpenAI, Anthropic, Microsoft, and Google - evaluate their models before they release them to the public. For a while, AI red teams were confined to these elite labs” (Promptfoo, Docs).
• On the tool’s own limits, its security policy: “Promptfoo OSS is a local eval runner, not a sandbox for adversarial eval content” (GitHub, SECURITY.md).

Stated intent: Make adversarial testing a routine step in building AI applications: “automatically evaluated, red-teamed, and either blocked or promoted,” for any model and any application, with an open-source core.

Observed intent: Be the harness enterprises run in CI, and, since March 2026, the testing layer inside OpenAI’s enterprise agent platform. OpenAI’s announcement lists what Frontier will take from it: “Automated security testing and red-teaming capabilities will become a native part of the Frontier platform,” and “Integrated reporting and traceability will help organizations document testing, monitor changes over time, and meet growing governance, risk, and compliance expectations for AI” (OpenAI).

Gap: The stated commitment and the stated plan are both on the record and point two ways. The commitment: “Promptfoo will remain open source and we will continue to serve users and customers,” and “We will continue to maintain the open-source suite as a best-in-class red teaming, static scanning, and evals tool for any AI model or application. Promptfoo will continue to support a diverse range of providers and models, reflecting the way real teams build and deploy AI systems” (Promptfoo, 9 Mar 2026). The plan: “At OpenAI, we’ll improve and integrate Promptfoo’s core tech within the model and infrastructure layers” (same post). A neutral harness and an integrated product feature are different jobs, and the record does not say which one wins when they conflict. The licence guarantees the code stays forkable, not that the maintainers’ priorities stay neutral. For the position, that is the finding; it does not need a motive.

Interest: Promptfoo argues for practices in its own words. What adoption would pay it is set out from its pricing, its announcements and OpenAI’s.

• Adversarial testing as a standing step in every AI build. Position: red teaming “is becoming a staple requirement of the enterprise AI development cycle,” and “continuous adversarial testing will become as fundamental as unit tests in traditional software” (Promptfoo, 29 Jul 2025). What it pays: the free tier is capped at “Red teaming (10k probes/month)” and the Enterprise tier sells “Custom red teaming limits,” so every team that makes the step routine is a candidate for the paid limit (Promptfoo, Pricing); since March the same step sits inside a platform OpenAI sells. Best case, Promptfoo’s: “Red teaming is different from other AI security approaches because it provides a quantitative measure of risk before deployment” (Promptfoo, Docs). Convergence: the security platforms that bought the same layer, nine of the ten acquisitions on the evaluators page, and the contract evaluators (Irregular, Gray Swan) whose product is also a pre-release test.
• Compliance frameworks as the requirement the test satisfies. Position: “Regulation is also accelerating. EU AI Act includes fines for insufficient testing and transparency. In the United States, OWASP LLM Top 10 and NIST AI Risk Management Framework are often cited as key requirements,” and “most regulations/standards support a systematic benchmarking/red teaming process that quantifies risk via testing prior to deployment” (Promptfoo, 29 Jul 2025; Promptfoo, Docs). What it pays: a rule that reads as requiring testing before deployment is a rule the Enterprise “Centralized security/compliance dashboard” answers, and OpenAI’s plan names the same market: “governance, risk, and compliance expectations for AI.” Best case, Promptfoo’s: its documentation carries a page mapping its tests to the OWASP LLM Top 10, and the frameworks it names are public standards. Convergence: the governance, risk and compliance vendors, and the labs whose enterprise platforms need an audit trail to sell to regulated buyers.
• An open, model-agnostic core. Position: the suite will support “any AI model or application” and “a diverse range of providers and models” (Promptfoo, 9 Mar 2026). What it pays: the open core is the distribution that fed the paid tier, and inside OpenAI it is distribution for Frontier; a neutral label is also what makes a lab-owned tool credible to enterprises that run several labs’ models. Best case, Promptfoo’s: evals “run 100% locally” and the code is MIT licensed, so a user can inspect it and run it without sending prompts anywhere (GitHub). Convergence: other open evaluation frameworks, Meridian Labs among them, whose argument for open tooling is the same; Anthropic’s stated reason for giving away its Petri tool was “to help ensure that Petri remains independent of any AI lab” (Anthropic), which is the opposite ownership outcome for the same kind of tool.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

Promptfoo sits in the tool layer, not the evaluator layer. Irregular and Gray Swan are paid by labs to test the labs’ models and their results appear in the labs’ release documents. Meridian Labs maintains the open Inspect framework that government institutes and nonprofit evaluators run. Promptfoo is the harness enterprises run on their own applications, and the labs are among its users and, since March, its owner.

• The labs as users, by Promptfoo’s account and the labs’ own course. Promptfoo’s series A post says “Foundation model labs test their models with Promptfoo before release,” its home page says “See how teams at OpenAI and Anthropic use Promptfoo to build better AI applications,” and the GitHub description reads “Used by OpenAI and Anthropic” (Promptfoo, 29 Jul 2025; Promptfoo; GitHub). Anthropic’s own prompt-evaluations course repository lists Promptfoo in five of its nine lessons, from “Promptfoo for evals: an introduction” to “Custom model-graded evals with promptfoo” (Anthropic, courses).
• The graded model, before the deal. On 11 December 2025, the day OpenAI released GPT-5.2, Promptfoo’s CTO published its own assessment: “OpenAI released GPT-5.2 today (December 11, 2025) at approximately 10:00 AM PST. We opened a PR for GPT-5.2 support at 10:24 AM PST and kicked off a red team eval … First critical finding hit at 10:29 AM PST, 5 minutes later.” The result: “our jailbreak strategies … improved attack success from 4.3% baseline to 78.5% (multi-turn) and 61.0% (single-turn),” with the caveat “This is an early, targeted assessment focused on jailbreak resilience and harmful content, not a full security review” (Promptfoo, 11 Dec 2025).
• The model reports. Promptfoo’s model-reports page lists security analyses of Claude Sonnet 4.5 and DeepSeek V3.2-Exp (29 September 2025) and two Qwen3 models (30 July 2025) (Promptfoo, Models). Its January 2025 DeepSeek censorship research was, in its words, “widely covered by major technology and news publications” (Promptfoo, Press). The page lists no report on an OpenAI model, and the blog index lists no company post dated after 12 March 2026 (Promptfoo, Blog).
• The press page. It describes the tool as “among the most popular evaluation frameworks” and “the first product to adapt AI-specific pentesting techniques to your application,” and says “Leading AI platforms have integrated Promptfoo into their official educational materials,” listing OpenAI, Anthropic, Amazon Web Services and IBM courses (Promptfoo, Press).

The adjacency to name without a verdict. The harness used to attack models is owned by a vendor of models, which is the same shape as Trail of Bits and OpenAI and Hugging Face and Nvidia on the same map. The difference from the contract evaluators is that Promptfoo’s output does not enter the lab’s own release document; it enters its customers’ pipelines, and the owner now sells the customers a platform.

Actions & Leadership Choices

CONDUCT: ACQUIRED BY A GRADED LAB — OPEN-SOURCE PLEDGE, NO PUBLISHED GOVERNANCE. No wrongdoing is alleged. The documented facts: a lab announced it was buying the harness, both parties pledged to keep it open source and MIT licensed, and the repository’s root lists a licence, a contributing guide, a security policy and a code of conduct and no governance, steering or foundation document (GitHub). The structural point is the dependency: the tool’s neutrality now rests on its owner’s continued choice.

What changed in the repository. The README opens with a notice: “Promptfoo is now part of OpenAI. Promptfoo remains open source and MIT licensed” (GitHub). The licence file reads “Copyright (c) Promptfoo 2025” under the MIT terms (GitHub, LICENSE). The about page counts “over 391 open source contributors” (Promptfoo, About). Since 9 March 2026 the most frequent commit author is an account named mldangelo-oai, whose GitHub profile gives the name Michael D’Angelo and the company “OpenAI” (GitHub, commits; GitHub, profile). The latest release listed is dated 8 October 2026 (GitHub, releases).

What it did in 2025 and 2026. It raised the $18.4 million Series A in July 2025; published a pull-request scanner for LLM-specific vulnerabilities in December 2025; open-sourced ModelAudit, a scanner for ML model files, in March 2026; and published red-team write-ups on an agent tool and on a consultancy’s reported API failure the same month (Promptfoo, Blog). Its security policy states the posture it asks users to take: “Treat Promptfoo configuration files and everything they reference or evaluate against as trusted code and data” (GitHub, SECURITY.md).

Alliance Map

These run at the same time. One company is owned by a lab, was funded by two venture firms that sit among its named early supporters, is taught in a rival lab’s course, and was publishing red-team results against the owner’s model about three months before the announcement. Each tie is stated by Promptfoo, OpenAI, Anthropic or the investor. The overlap is the finding.

Reach Assessment

Institutional: Its test harness runs inside the build pipelines of a large share of the companies deploying AI, by the company’s count 156 of the Fortune 500, and it now sits inside the enterprise agent platform of the largest lab. Memetic: The open repository’s 26,000 stars and its public model reports put its attack methods and its attack-success numbers into developers’ hands; its December 2025 GPT-5.2 post is the form most readers meet it in. Civilizational: When a testing tool becomes the default step before an application ships, what it probes for becomes the working definition of a vulnerability for the teams that run it. Promptfoo holds that position without any statute behind it, and its owner is also the vendor of models it probes.

Score basis. Atk 6 is reach: its home page says “156 of the Fortune 500 use Promptfoo in their AI development lifecycle,” its acquisition post counts “130k are active each month,” and Anthropic’s prompt-evaluations course repository lists it in five of nine lessons (Promptfoo; Promptfoo, 9 Mar 2026; Anthropic, courses). The points under 7 are that no statute, pre-release gate or procurement standard obliges anyone to run it, that its output goes into its users’ pipelines and not into a lab’s release document, and that the user counts are the company’s own. That puts it one above Hugging Face (5/6/8, hazard 62), whose reach is a distribution channel and not a test, level with Andon Labs (6/5/6, hazard 58), and two under Irregular and Gray Swan (8/6/7), whose tests are cited in labs’ release documents. Def 3 is funding insulation: OpenAI’s announcement says it will integrate Promptfoo “directly into OpenAI Frontier,” and Promptfoo’s about page says “Promptfoo is now part of OpenAI,” so its income and its employer are a lab it also tests, and the only instruments between them on the record are the MIT licence and the pledge that “Promptfoo will remain open source” (OpenAI; Promptfoo, About; Promptfoo, 9 Mar 2026). That is one point under the Global Engagement Center (7/4/2), whose single payer was Congress, and two under Meridian Labs (8/5/7), which names no funder and no owner; it is not lower than 3 because the code is MIT licensed and forkable, the founders’ pledge and OpenAI’s own announcement both commit to keeping the open-source project going, and its pre-acquisition investors were venture funds and angels, none of them labs (GitHub; Promptfoo, 29 Jul 2025). Hp 6 is entrenchment: the repository has an MIT licence and more than 26,000 stars, the about page counts 391 contributors, and OpenAI says it will keep building the open-source project inside Frontier (GitHub; Promptfoo, About; OpenAI); against that, no statute or program of record installs it, any team can swap in another harness, and any user can fork the code, which is why it sits level with Palisade Research and Transluce (6) and under Meridian Labs (7). Hazard 50 follows from 6/3/6 at the house formula and sits under Andon Labs (58) and Hugging Face (62) because its insulation is lower than either and its entrenchment is not as deep as Hugging Face’s.

Sources: Promptfoo is joining OpenAI — Promptfoo (Mar 9, 2026); OpenAI to acquire Promptfoo — OpenAI (Mar 9, 2026); Promptfoo — home; About Promptfoo; Promptfoo — Press; Promptfoo — Pricing; Promptfoo — Model reports; Promptfoo — Blog; Promptfoo Raises $18.4M Series A — Promptfoo (Jul 29, 2025); GPT-5.2 Initial Trust and Safety Assessment — Promptfoo (Dec 11, 2025); LLM red teaming — Promptfoo docs; promptfoo/promptfoo — GitHub; SECURITY.md — GitHub; LICENSE — GitHub; Commits — GitHub; Releases — GitHub; mldangelo-oai — GitHub; How Promptfoo is restoring trust and security in generative AI — Insight Partners (Dec 3, 2025); Prompt evaluations course — Anthropic; Donating Petri — Anthropic; OpenAI acquires Promptfoo to secure its AI agents — TechCrunch (Mar 9, 2026).