Releases

In active maintenance. The twelve months of updates committed on the pricing page run from the first release below.

1.1.0 · 2026-09-17

A fifth attack, and the approval policy that makes the two email attacks stoppable without a person on every reply. Both came from readers of the kit's write-ups, credited in the repository's changelog. Inbound message injection: the payload arrives in the result of a tool — the assistant reads its support inbox to reply to a customer, and the newest message tells it to forward the whole thread to a stranger's address. It is the third channel through which a stranger's text reaches the model, and the one the context guardrail does not frame; the recording landed on the first try, guardrails off, and the human-in-the-loop gate stops it on replay, proved by removing it. And G06 now ships a policy, recipient provenance: a message may go out only to an address the conversation already knows through a trusted channel — the user wrote it, or a tool returned it as a structured field — never one read out of a message body. Under it, the reply to the customer goes out and the forward to the stranger does not, on the same recording. The seam gained one optional argument so a gate can judge provenance; existing guardrails, including yours, keep working unchanged.

1.0.1 · 2026-09-10

Three fixes to the machinery that publishes what this kit proves. No guardrail changed; what changed is what can be said about them, and by whom. The evidence page on this site can no longer print unguarded model output: it used to publish the recorder's note, which interpolates values out of the raw stream captured with the guardrails off — for one attack, a hundred-character slice of whatever the model recited, exactly where your system prompt's credential would be if you recorded against your own. Every attack now carries an authored summary and the exporter publishes that instead. Re-recording is now a version change: the version gate watched the catalogue but not the transcripts, so re-recording against a different model required no bump and anything checking "is this current?" by version answered yes while showing the old model and date. And the two sources that decide whether a run was recorded — the coverage table and the transcript on disk — must now agree, or the export stops.

1.0.0 · 2026-09-10

The first release, and the date the twelve months of committed updates run from. Nine guardrails, each with the test that proves it, and an attack suite that replays recorded runs with no model and no key. This release also carries the fixes from a full audit: G01 no longer refuses ordinary support questions, an ASCII hyphen no longer walks past it, a long conversation no longer kills the endpoint, a refused turn no longer poisons the session, and the recorder can no longer publish your API key. The README used to say the suite proved all nine guardrails; it now proves each one by removing it, and names the ones a deterministic replay cannot prove.

What this means if you have bought

Repository access is perpetual: a new release takes nothing away from you and there is nothing to renew. What runs for twelve months is the commitment to PUBLISH new releases, not your access to the ones that already exist.

If you are on the notice list you get an email when a release is published. That email always carries an unsubscribe link, and unsubscribing does not touch your repository access.