Promptfoo

• OpenAI could favour the paid testing inside Frontier over the open-source project that 300,000 developers adopted, which would slow the free tool that feeds the paid one.
• Developers and teams that valued the tool belonging to no model provider could move to an independent alternative now that OpenAI owns it.
• Rival labs could stop teaching or recommending a tool owned by OpenAI, which would cost Promptfoo the cross-lab standing that Anthropic’s own course currently shows.
• Enterprise revenue and paying customer names are undisclosed, so the paid business could be far smaller than the free adoption suggests.
• Incumbent providers are shipping comparable capability, with Anthropic launching Claude Code Security in February 2026 and OpenAI making automated red teaming native to Frontier, which could leave less room for a separate purchase.
• The runtime products, Guardrails and the MCP Proxy, carry no named customer in the reviewed sources, so the move from development-time testing into production controls is unproven.

Promptfoo sells to the teams putting language models into production, and it names the developer and the security buyer alike. Its documentation frames the problem as vulnerabilities that adversarial inputs expose before a system reaches production, from prompt injection through information leakage in retrieval systems and misuse of the APIs an agent can call. The homepage addresses chief information security officers, security directors and developers in one section.

Independent reporting supports the demand behind that pitch. CSO Online, writing on 10 March 2026, cites IDC’s 2025 Asia/Pacific Security Study. That study places prompt injection and model manipulation among the concerns enterprises report. The same article quotes Counterpoint Research saying red teaming, governance and evaluation tools are becoming table stakes.

European regulation now names the same activity. The European Commission records that the AI Act became applicable on 2 August 2026, with the AI Office enforcing the rules for general-purpose models. Article 55 of that law requires providers of general-purpose models with systemic risk to conduct and document adversarial testing. [s2, s16, s25, s26, s1]

Promptfoo documents six product surfaces. The site lists Red Teaming, Guardrails, Model Security, MCP Proxy, Code Scanning and Evaluations, so the range runs from development-time testing to controls that sit in front of a running application.

The testing method is published in full. The documentation describes generating a diverse set of malicious intents, wrapping each one in a prompt that tries to exploit the target, then grading the outputs with deterministic and model-graded metrics. Teams run it as a one-off report or continuously inside a build pipeline.

Two of the surfaces work at runtime. The MCP Proxy sits between users, AI applications and the Model Context Protocol servers they call, allowing only approved servers and logging every request. Guardrails offers real-time protection that the vendor says improves from red-team findings, and it can also test guardrail systems a customer already runs.

The open-source core is what a buyer can inspect. The repository carries an MIT licence and 24,625 stars, the about page counts over 323 open-source contributors, and the code scanner traces how user input reaches a model prompt across several files. [s1, s2, s3, s4, s6, s21, s8]

Independent research places Promptfoo inside a named class of tools. A May 2026 arXiv preprint on agentic red teaming lists Microsoft’s PyRIT, NVIDIA’s Garak, Promptfoo and Meta’s Purple Llama CyberSecEval as the widely adopted automated red-teaming frameworks. It characterises Promptfoo as a configuration-driven tool that runs YAML-defined adversarial tests against model endpoints. Every author of that preprint gives an affiliation at Dreadnode, whose own AI red-teaming agent the paper introduces, so it reads as a rival’s account rather than neutral validation.

Model providers are building the same capability in house. The Next Web reports that Anthropic launched Claude Code Security in February 2026 aimed at similar vulnerability-scanning work, and OpenAI says automated security testing and red teaming will become a native part of its Frontier agent product.

The Next Web reports that developer adoption was built on the premise that the tool belonged to the developer community rather than to any one vendor. The open-source suite tests applications built on any model, and the founders committed to keep maintaining it for any model or application. A model provider owns the company now. [s18, s17, s11, s10, s8]

Promptfoo runs a free-to-paid motion and publishes the free half. The Community tier costs nothing, covers evaluation features and caps red teaming at 10,000 probes a month, run locally or self-hosted. Enterprise and On-Premise tiers are quoted on request and add collaboration, a compliance dashboard, single sign-on and managed or isolated deployment.

The reach figures all come from the company. Its site states that 156 of the Fortune 500 use Promptfoo in their AI development lifecycle, and the March 2026 acquisition post reports more than 350,000 developers having used it and 130,000 active each month.

Third parties document adoption of a different kind. Anthropic devotes five of the nine lessons in its own prompt-evaluation course to Promptfoo. Amazon Web Services publishes a Bedrock workshop built on it. Semgrep’s engineering team wrote up using it to test the AI features behind its product.

The paid business stays private. No named paying customer appears in the reviewed sources, enterprise revenue is undisclosed, and SecurityWeek reports the acquisition terms were not disclosed either. CB Insights records roughly 23.4 million dollars raised over four rounds, and the company has filed two Form D notices with the Securities and Exchange Commission. [s7, s1, s10, s23, s24, s22, s15, s19, s20]

The founders built AI products at scale before starting the company. Ian Webster ran language-model engineering and developer platform work at Discord, where AI products reached 200 million users under safety, security and policy standards. Michael D’Angelo was vice president of engineering and head of AI at Smile Identity, where he scaled machine learning to serve over 100 million people.

The exit is the strongest verifiable outcome on their record. OpenAI announced on 9 March 2026 that it is acquiring the company, roughly two years after the commercial launch that The Next Web dates to 2024 with a 5 million dollar seed round from Andreessen Horowitz.

The company also publishes research and holds community standing. Its press page lists coverage of its DeepSeek censorship work by Ars Technica, TechCrunch, Gizmodo and the Stanford Cyber Policy Center. It also runs a public Language Model Security Database that summarises primary-source AI security research. Over 323 open-source contributors work on the project.

The funding leaves a public regulatory trail. Promptfoo, Inc. appears in the Securities and Exchange Commission submissions record with two Form D exempt-offering notices. [s8, s17, s11, s9, s27, s20]

Promptfoo publishes company attestations through an inspectable trust centre. The rendered portal lists ISO 27001:2022 and SOC 2, and names an ISO 27001 certificate, a SOC 2 Type II report and an external penetration-test report alongside a request-access control.

Where the testing data sits depends on which tier a customer buys. The Community tier runs locally or self-hosted, and the On-Premise tier adds deployment on the customer’s own infrastructure with complete data isolation. The same trust centre lists Google Cloud Platform as a subprocessor for cloud-hosted infrastructure and AI services, and OpenAI as a subprocessor for application AI functionality. The reviewed record does not say which testing data reaches either.

The acquisition reshapes the deeper question. OpenAI owns the company and will fold the testing into a competing agent product. The MIT licence leaves an exit from the open-source core, and the commercial roadmap depends on OpenAI. [s12, s7, s11, s8, s21]

Add analyzed competitors to compare them side by side with Promptfoo.

Promptfoo publishes a free tier an engineer can install without a purchase, and it quotes the Enterprise and On-Premise tiers on request. The Community tier costs nothing and runs locally or self-hosted, and the product and pricing pages carry a demo request. The company reports more than 350,000 developers having used it and 130,000 active each month.

The paid segment is the large enterprise that wants governance over that use. Promptfoo’s site states that 156 of the Fortune 500 use the tool in their AI development lifecycle, and the Enterprise tier adds team access control, a compliance dashboard, single sign-on and service-level guarantees.

Regulated industries get their own front doors. The site sells financial-services testing aligned to FINRA rules, insurance testing on policyholder data and coverage accuracy, telecommunications testing for voice and text agents, and fair-housing testing for real estate. The Next Web, relaying the company’s own Series A figures, reports over 30 Fortune 500 enterprise deployments and customers spanning retail, telecoms, financial services and media.

Promptfoo generates attacks tailored to a specific application and grades what comes back. The documented process creates malicious intents, wraps each in a prompt that tries to exploit the target, and scores the outputs with deterministic and model-graded metrics. Plugins cover harmful content, broken object-level and function-level authorization, and competitor endorsement, and the tests map to the OWASP LLM Top 10, the NIST AI Risk Management Framework and the EU AI Act.

Two newer surfaces work while an application is running. The MCP Proxy sits between users, AI applications and the Model Context Protocol servers they call, permitting only approved servers and logging every request with alerts for sensitive-data exposure. Guardrails offers real-time protection that the vendor says learns from red-team findings.

Model and code security extend the same engine backwards. The model scanner analyses PyTorch, TensorFlow, Keras and Pickle files for malicious code and risky configurations before deployment. The code scanner uses agents to trace how user input reaches a model prompt across several files, then posts findings as pull-request comments.

The open-source base is what a security team can inspect. The repository carries an MIT licence and 24,625 stars, and over 323 open-source contributors work on it.

Promptfoo runs a free-to-paid motion, and the free half carries the volume. The Community tier covers evaluation features, all model providers and red teaming capped at 10,000 probes a month. The paid tiers add team access control, single sign-on, a centralised dashboard and managed or on-premise deployment, and both are quoted on request.

Every scale figure in the record belongs to the company. The site claims 156 of the Fortune 500, and the acquisition post reports more than 350,000 developers having used the tool and 130,000 active monthly. The Next Web relays the Series A figures of 125,000 developers and over 30 Fortune 500 enterprise deployments.

Outside organisations document adoption of a different kind. Anthropic gives Promptfoo five of the nine lessons in its own prompt-evaluation course, Amazon Web Services publishes a Bedrock workshop built on it, and Semgrep’s engineers wrote up using it against their production AI features.

What the record does not carry is the paid side. No named paying customer appears in the reviewed sources, enterprise revenue is undisclosed, and SecurityWeek reports that the acquisition terms were not disclosed, so the size of the commercial business stays out of view.

Promptfoo publishes the free tier and quotes the rest on request. Community is free forever and includes all evaluation features, every model provider and red teaming capped at 10,000 probes a month, run locally or self-hosted. Metering the free tier by probe volume signals that probes are the unit the company watches.

The Enterprise tier is custom-priced behind a demo request. It adds custom red-teaming limits, team sharing, continuous monitoring, a centralised security and compliance dashboard, single sign-on, API access and managed cloud deployment. Quoting Enterprise on request is the shape of a negotiated sale rather than a self-serve one.

The On-Premise tier charges for control rather than features. It carries all Enterprise features plus deployment on the customer’s own infrastructure, complete data isolation, a dedicated runner and an assigned deployment engineer. The page does publish two pricing factors: Enterprise pricing is customized on a team’s size and needs, and Enterprise customers can buy additional probes beyond the free 10,000 a month. Exact rates and the full formula stay behind a quote, so a buyer cannot size the cost of scaling before a sales call.

Promptfoo documents three deployment shapes. Community runs locally or self-hosted on the team’s own infrastructure. Enterprise adds managed cloud deployment, and On-Premise adds deployment on the customer’s own infrastructure with complete data isolation.

The testing fits into existing development work. The documentation describes one-off runs that produce a report with suggested mitigations, and continuous runs inside a build pipeline that watch for regressions as an application changes. The code scanner adds a third placement, inside the editor and the pull request.

The paid tiers add people around the software, not in place of it. Enterprise lists professional services support, priority support and service-level guarantees, and On-Premise assigns a deployment engineer. The reviewed sources publish no uptime figure, so the reliability of the managed service cannot be checked from the record.

Promptfoo publishes company attestations on an inspectable trust centre. The rendered portal lists ISO 27001:2022 and SOC 2, and names an ISO 27001 certificate, a SOC 2 Type II report and an external penetration-test report alongside a request-access control.

Where the data sits depends on the tier. Community runs locally or self-hosted and On-Premise adds complete data isolation, so a customer can keep testing inside its own environment. The same trust centre lists Google Cloud Platform as a subprocessor for cloud-hosted infrastructure and AI services, and OpenAI as a subprocessor for application AI functionality. The reviewed record does not say which testing data reaches either.

Ownership is now the harder trust question. OpenAI owns the company and will fold the testing into a competing agent product. The MIT licence leaves an exit for the open-source half, and the commercial roadmap depends on OpenAI.

Promptfoo positions itself as a testing layer for any AI application rather than a single-model tool. The Community tier lists all model providers and integrations, and the documentation covers integrations with build systems, so a team can test whatever it built on.

The ecosystem runs on open source and other people’s platforms. The MIT-licensed repository carries 24,625 stars and over 323 open-source contributors, and the paid tiers add customized red-teaming plugins and organization-specific attack profiles. That reach comes through software other organisations run, and the paid tiers are sold through a demo request.

Two other organisations now teach the tool inside their own material. Anthropic’s courses repository gives Promptfoo five of its nine prompt-evaluation lessons, and Amazon Web Services publishes a workshop pairing it with Bedrock. One of the two, Anthropic, also ships a competing code-security scanner, which is what makes the ownership change a live question for the ecosystem.

The founders built and shipped AI products at scale before starting the company. Ian Webster ran language-model engineering and developer platform work at Discord, where AI products reached 200 million users under safety, security and policy standards. Michael D’Angelo was vice president of engineering and head of AI at Smile Identity, where he scaled machine learning to serve over 100 million people.

The company sold within roughly two years of commercial launch. The Next Web dates the commercial launch to 2024 with a 5 million dollar seed round from Andreessen Horowitz, and OpenAI announced the acquisition on 9 March 2026. The founders state the team reached 23 people across engineering, go-to-market and operations.

Published research and community work back the founders up. The press page lists coverage of the company’s DeepSeek censorship research by Ars Technica, TechCrunch, Gizmodo and the Stanford Cyber Policy Center. The company also runs a public Language Model Security Database summarising primary-source AI security research.

The funding leaves a regulatory trail. Promptfoo, Inc. appears in the Securities and Exchange Commission submissions record with two Form D exempt-offering notices.