Promptfoo

Promptfoo builds open-source tools for evaluating AI applications, adversarial security testing, and static scanning. Its application testing focuses on failures such as context poisoning, tool misuse, and use-case hijacking—risks shaped by how an application connects models to data and tools. On March 9, 2026, Promptfoo announced an agreement to be acquired by OpenAI, subject to customary closing conditions.[2][4]

Alongside the agreement, Promptfoo committed to continuing service and support, maintaining its open-source red-teaming, static-scanning, and evaluation suite, and supporting diverse model providers. The founders planned to integrate its core technology into OpenAI’s model and infrastructure layers so teams could catch vulnerabilities earlier. Those plans extended work that Ian Webster and Michael D’Angelo had begun when they founded Promptfoo in 2024.[4]

In his July 2024 account, co-founder and CEO Ian Webster described starting Discord’s Platform Ecosystem organization before leading a team building LLM products for millions of users. He designed the first version of Promptfoo to help application developers test, discover, and fix LLM failures. Michael D’Angelo, a longtime friend and engineering leader from Smile Identity, joined him as co-founder; by the July 2025 announcement, D’Angelo was identified as CTO.[2][3]

Promptfoo’s focus went beyond model jailbreaks and prompt injection to business-specific application behavior. Its seed announcement used examples such as an AI promising free cars, a customer-service agent revealing database information, and a homework tutor producing political opinions to explain the failures developers might test for. The founders later recalled that adversarial tests for security, safety, and other behavioral risks became central to their work, especially with large enterprises.[2][4]

On July 23, 2024, Promptfoo announced it had raised a $5 million seed round led by Andreessen Horowitz, with participants including Shopify CEO Tobi Lutke, Discord CTO Stanislav Vishnevskiy, and Okta co-founder Frederic Kerrest. It reported more than 25,000 software engineers using its open-source evaluation tool, including engineers at Shopify, Amazon, and Anthropic, and credited community contributors with helping drive development.[2]

On July 29, 2025, Promptfoo announced an $18.4 million Series A led by Insight Partners, with participation from Andreessen Horowitz. Insight managing director Ganesh Bell was joining its board. The announcement’s adoption section reported that 125,000+ developers had downloaded the open-source tools.[3]

Its July 2025 roadmap addressed applications that acted over many steps and used external tools. Planned work included chain-level tracing and safety checks for agent and multi-agent conversations; capturing, replaying, and scoring Model Context Protocol (MCP) function calls; and native audio security features. Promptfoo also described an evaluation-first development workflow in which teams would run tests on every commit and application update.[3]

By March 2026, Promptfoo had extended its security work to model artifacts through ModelAudit. The offline static scanner checks unsafe loading behavior, known CVEs, and suspicious artifacts across 42+ format categories without loading or executing models or importing ML frameworks. Its Python engine is MIT-licensed and can run directly through modelaudit scan or through the promptfoo scan-model wrapper. Promptfoo also offers a hosted interface and managed integrations using the same engine.[7]

Security engineer Yash Chhabria described expanding an existing team-built scanner after joining Promptfoo in September 2025. The work added opcode-level bypass detection, broader format coverage, and an allowlist-first approach. He explained the gap it addressed: malicious deserialization could execute code before an application started, beyond the reach of runtime application testing.[7]

Chhabria reported four security advisories against Fickling and three against Picklescan, crediting Trail of Bits and Picklescan’s maintainers with fixes. One reported Picklescan bypass used pkgutil.resolve_name to resolve a dangerous callable such as os.system from string data: a blocklist inspecting callable names saw the resolver rather than the blocked function. He specifically credited D’Angelo with finding missing high-risk imports in Fickling, identified as CVE-2026-22609.[7]

The team’s validation results informed the decision to extract ModelAudit from the Promptfoo platform as a standalone open-source engine. Chhabria reported zero false positives in a final 100-model regression run and subsequent checks against more than 200 additional clean models. The March 3, 2026 announcement said the open-source release had occurred the previous week; these bounded tests did not establish a universal false-positive rate.[7]

In their March 9, 2026 announcement, Webster and D’Angelo reported that more than 350,000 developers had used Promptfoo, 130,000 were active each month, and teams at more than 25% of Fortune 500 companies relied on it. They said the organization had grown to 23 people across engineering, go-to-market, and operations. These figures described developer adoption, team usage, and staffing rather than a count of paid customers.[4]