Release Notes
Changes with enterprise impact called out.
Use release notes to see what changed, whether an admin needs to act, and how to verify the change in your own environment.
How to read entries
Each entry names the product area, admin impact, validation path, and any action required. UI changes include screenshots when the workflow needs them.
July 20, 2026
Linux Universal Installer available as a signed beta
LinuxRPMAI DiscoveryAWS VDIEnterprise Install
What changed
- Added native x86_64 RPM architecture for RHEL 8/9 and Rocky Linux 8/9 with a dedicated unprivileged runtime broker and peer-authenticated Unix socket.
- Added Enterprise Installer tokens with native Linux provenance, explicit SSSD/local target users, persistent or ephemeral lifecycle, and all-nine-surface scope.
- Added structural reconciliation and AI Discovery reporting for Claude Code, Cursor, Windsurf, Copilot, Codex, Gemini, Antigravity, Cowork, and MCP Gateway without treating package presence as active enforcement.
- Added protected GPG signing, signed DNF metadata, offline bundle, SBOM, provenance, duplicate-NEVRA protection, and final-signed-byte validation workflows.
- Added Workstations, AI Discovery, Setup, AWS VDI, troubleshooting, and rollback guidance with explicit unsupported and repair-blocked states.
How to verify
- Use the artifact index to verify the RPM and repository signatures, pinned Gateway checksum, SBOMs, and build provenance.
- On a representative RHEL or Rocky Linux workstation, verify installation, enrollment, service health, reconciliation, upgrade, and rollback.
- Run one allowed Claude Code action and one controlled PreToolUse denial, then confirm both events in AgentKeeper Activity.
- Confirm Workstations and AI Discovery agree on Native Linux RPM provenance and the reported state for all nine surfaces.
June 23, 2026
Shadow AI Discovery for managed fleets
AI DiscoveryMDMIntuneJamfIru/Kandji
What changed
- Documented Shadow AI Discovery as a built-in capability of the current AgentKeeper MDM deployment packages, not a separate script to deploy.
- Added explicit Microsoft Intune instructions for Windows all-IDE packages, API-key configuration, Sysnative PowerShell, and recurring Remediations that report fresh Shadow AI proof.
- Added Jamf guidance for using Recurring Check-in policies to inspect known AI tools, repair AgentKeeper-owned coverage, and refresh AI Discovery proof.
- Added Iru/Kandji guidance for recurring Audit Scripts and Remediation Scripts so managed Macs continue reporting new AI tools and coverage drift.
- Clarified validation in AI Discovery > Discovered, including provider/platform filters, proof states, stale check-ins, and old detector catalogs.
How to verify
- Open the Intune, Jamf, or Iru/Kandji deployment guide and use the builder for the provider in scope.
- Confirm the deployment package has an AgentKeeper fleet API key configured before assigning it broadly.
- Configure recurring Intune Remediations, Jamf Recurring Check-in, or Iru/Kandji recurring Audit Script execution for ongoing Shadow AI check-ins.
- After the next check-in, open AI Discovery > Discovered and filter by provider and platform to confirm covered, present-not-covered, stale, or old-detector proof states.
- Use Workstations to inspect one device and confirm target user, catalog version, last check-in, and per-surface coverage evidence.
June 15, 2026
AI-assisted runtime triage for agent investigations
AI Runtime TriageRuntime ShieldInvestigationsSettings
What changed
- Introduced AI-assisted runtime triage as an investigation layer for suspicious agent activity, helping teams understand complex behavior without putting an LLM in the enforcement path.
- Added an opt-in mode ladder in the existing AI settings page: Off, Explain, Shadow, and Alert, so teams can roll out AI review at their own pace.
- Kept deterministic Runtime Shield decisions as the source of truth. AI can add cited context, but it cannot change verdicts, severity, enforcement decisions, or the original reason an alert fired.
- Added evidence receipts for AI-assisted analysis, including provider, model, prompt template version, redacted evidence hash, evidence event IDs, and supporting citations.
- Built privacy-first controls for rollout: Shadow and Alert require customer-managed provider keys, while Explain-only can use an AgentKeeper-managed fallback only with explicit admin consent.
- Added transparent coverage states so reviewers can see what was triaged, what was skipped, and when missing keys, provider errors, budgets, or circuit breakers limit AI analysis.
How to verify
- Open Settings > AI and confirm the mode ladder starts Off unless an owner/admin explicitly enables it.
- Enable Explain, Shadow, or Alert in sandbox and confirm the deterministic 'Why this fired' explanation remains the headline.
- Trigger the same test alert with AI off and on, then confirm verdict, severity, enforcement decision, and enforcement reason remain unchanged.
- Inspect an AI-assisted block and confirm every claim is cited with provider/model provenance, a redacted evidence hash, evidence event IDs, and supporting event IDs.
- Test missing key, invalid key, provider timeout, budget exhaustion, and circuit breaker states, and confirm AI coverage degrades visibly without changing enforcement.
June 14, 2026
Stronger runtime protection across agent workflows
Runtime ShieldInvestigationsPolicyReliability
What changed
- Expanded Runtime Shield coverage for high-risk agent behaviors and risky system interactions, giving security teams more confidence across the agent workflows they already monitor.
- Improved investigation evidence so suspicious activity is easier to understand at a glance, especially when risk appears in tool results or post-execution output.
- Made investigation summaries clearer and more actionable for security review, with readable context that helps teams move from alert to decision faster.
- Strengthened policy-mode consistency so Warn and Observe remain non-blocking unless an organization explicitly chooses blocking enforcement.
- Added more regression coverage to protect detection quality, policy behavior, and investigation clarity as the platform evolves.
How to verify
- Open recent investigations and confirm evidence, source, and outcome are clear enough to review without inspecting raw event JSON.
- Confirm Warn and Observe policies continue to allow activity while producing the expected investigation and activity context.
- Confirm Block outcomes appear only for policy rules or detectors that your organization has explicitly configured to block.
- Review the release in sandbox before broad production rollout if your team uses strict enforcement for agent runtime controls.
June 13, 2026
Model catalog controls for frontier-model retention risk
Runtime ShieldPolicyAI DiscoveryMCP Gateway
What changed
- Refreshed the known-model catalog across OpenAI, Anthropic, Google Gemini, Ollama, and Ollama Cloud so admins can make policy decisions against current frontier and coding models instead of stale model names.
- Added current catalog entries including Claude Fable 5, Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.5, GPT-5.5-Codex, Gemini 3.5 Pro, Gemini 3.5 Flash, and Ollama Cloud models.
- Clarified Other model entry guidance: admins should enter the provider's exact model ID. Matching is exact after normalization, not regex, glob, or substring matching.
- Normalized provider-prefixed IDs such as `openai/gpt-5.5` to the same model as `gpt-5.5`, reducing duplicate policy entries while preserving explicit audit evidence.
- Extended Runtime Shield model blocking evidence across Claude Code and MCP evaluate paths so blocked models or providers can be denied and audited when the runtime supplies model/provider evidence.
- Kept model controls opt-in and off by default. Existing customers continue to allow all models unless an owner/admin explicitly adds model or provider restrictions.
- Added this control surface for teams responding to rapid vendor data-handling changes, including Mythos-class and Claude Fable 5 retention requirements, without requiring a broad shutdown of every AI tool.
How to verify
- Open Policies > Base Policy > Controls > Model controls and confirm the catalog shows the expected current models for each provider.
- Confirm a newly created or existing policy profile has no model restrictions unless an owner/admin explicitly adds them.
- Add a temporary blocked test model, trigger a matching Claude Code or MCP evaluate event, and confirm Runtime Shield returns a model-blocked decision with model/provider evidence.
- Add an Other model using an exact provider model ID, then confirm provider prefixes and casing normalize into a single policy entry.
- Before allowing Mythos-class or Claude Fable 5 usage for sensitive workloads, confirm the vendor retention posture with security, legal, and procurement teams.
June 12, 2026
RBAC simplification and sealed prompt evidence
AgentKeeper AdministrationPrompt VaultMCP GatewaySettings
What changed
- Simplified dashboard access around Owner, Admin, and Developer. Legacy Member access is treated as Developer for compatibility, and invite/update flows no longer offer Member as a new role.
- Made prompt evidence sealed by default across sensitive dashboard surfaces, with owner/admin-only unseal that requires a reason and records an audit trail.
- Locked privacy settings, Deep Capture, AI analysis, notification management, API keys, connector credentials, sensitive exports, and MCP Gateway controls behind owner/admin capabilities.
- Updated Settings, Access, Prompt Vault, MCP Gateway, OTLP evidence, security model, and enterprise team management docs so teams can see exactly what Developers can and cannot change.
How to verify
- Open Settings > Access as an owner and confirm the role matrix explains Owner, Admin, and Developer access, with role dropdowns offering Admin and Developer only.
- As a Developer or legacy Member, confirm privacy, notification, connector, MCP Gateway, API key, and sensitive export controls show locked states or return 403 from the matching dashboard APIs.
- As an owner/admin, reveal sealed prompt evidence with a reason and confirm the prompt is returned only for that request and an access audit row is written.
- In sandbox, run RBAC route tests, Prompt Vault reveal checks, and MCP Gateway policy/export checks before promoting the same verified image to production.
June 8, 2026
Claude Code startup policy messages for managed fleets
Claude CodeRuntime ShieldPolicyMDM
What changed
- Claude Code Base Policy messages now appear at session startup for supported AgentKeeper plugin installs, giving developers visible organization guidance as soon as a new Claude Code session starts.
- Updated the Claude Code check-in path so AgentKeeper returns policy startup context using Claude Code-compatible hook fields.
- Updated the AgentKeeper Claude Code plugin to `1.1.5` so the command-based `SessionStart` hook passes the policy message through even when HTTP runtime hooks are also configured.
- Kept existing Runtime Shield behavior unchanged for prompt, tool, audit, and policy enforcement events.
- For managed fleets, Jamf, Iru/Kandji, Intune, or another MDM should refresh the user-level Claude Code plugin cache and installed plugin manifest so workstations move from AgentKeeper plugin `1.1.4` to `1.1.5`.
How to verify
- Confirm production is running image `sha-fd4a4aebb9a5` or later.
- On a pilot workstation, confirm `~/.claude/plugins/installed_plugins.json` points `agentkeeper@agentkeeper` at version `1.1.5`.
- Confirm `~/.claude/settings.json` contains only the expected production AgentKeeper hook URLs for the organization.
- Fully quit and reopen Claude Code, then start a new session.
- Confirm Claude Code shows `SessionStart:startup says:` followed by the configured policy message.
- Open Workstations or Activity and confirm the same workstation reports a fresh Claude Code check-in without creating a duplicate host row.
June 5, 2026
Copilot visibility, geo-backed activity maps, and safer runtime controls
Web BrowserAI DiscoveryActivityPolicyMDM
What changed
- Added Microsoft Copilot browser capture, so Copilot prompts and responses can now show up alongside the rest of your monitored AI usage instead of disappearing into a blind spot.
- Enabled GeoLite-backed location mapping in production so the Activity world map can resolve real country data instead of leaving more events unmapped.
- Made detector and exception behavior easier to reason about by surfacing clearer outcome controls, issuing exception links whenever the active policy pack allows them, and fixing duplicate-block and exact-session retry edge cases.
- Added a safe delete flow for non-base policy profiles, with confirmation copy that makes it clear assignments are removed without wiping groups, audit history, or past activity.
- Grouped rollout hardening for Claude Code installs: MDM, Jamf, Intune, SageMaker, and self-install paths now preserve existing developer hooks more reliably and avoid false sandbox requirement blocks from ambiguous telemetry.
How to verify
- Open Browser Extensions or Activity and confirm Microsoft Copilot events appear with the correct provider branding after a test Copilot prompt.
- Open Activity and confirm the world map resolves expected country data in production instead of showing the same events as unmapped.
- Open Policies and confirm detector outcome controls, exception-link behavior, and non-base profile deletion match your rollout plan before enabling them for broader admin use.
- Run one managed Claude Code install or repair path in your pilot environment and confirm AgentKeeper hooks merge cleanly without overwriting existing developer-owned hooks.
June 2, 2026
Google Antigravity IDE parity
Runtime ShieldIDE HooksMDMPolicy PacksDocs
What changed
- Added first-class Google Antigravity IDE source taxonomy, hook normalization, Runtime Shield decisions, Activity labels, Workstations filters, Policy Pack surfaces, and custom detector evidence mapping.
- Added Antigravity IDE hook installation through `install-hooks.sh --ide antigravity`, CLI detection, uninstall cleanup, setup status, and MDM scripts for macOS and Windows.
- Added Antigravity public setup docs, MDM rollout guidance for Intune, Jamf, and Iru/Kandji, and an Antigravity security marketing page.
- Documented current scope as IDE hooks only. Browser extension capture is explicitly not part of Antigravity support.
- Expanded control-integrity detection so managed Antigravity hook files and `~/.gemini/config/hooks.json` are protected from tamper attempts.
How to verify
- Deploy to sandbox and run one allowed Antigravity command, one blocked hook-tamper command, one file policy decision, one URL/domain decision, and one MCP or subagent simulation if enabled.
- Confirm Activity, Workstations, Security, Investigations, Policy Packs, custom detector evidence, and setup views show Google Antigravity instead of Unknown.
- Confirm Intune/Jamf/Iru/Kandji scripts install or repair hooks and that status output reports `antigravity=ok` for a healthy macOS profile.
- Confirm `/docs/antigravity-setup` and `/antigravity-security` state IDE-only scope with no browser component.
May 31, 2026
Governed exceptions and cleaner admin operations
Runtime ShieldExceptionsAgentKeeper AdministrationAI DiscoveryDocs
What changed
- Added policy-gated exception lifecycle docs covering default-closed eligibility, no-dashboard developer submission, admin review, scoped leases, expiry, and failure behavior.
- Documented the developer request paths: `agentkeeper exception request`, `agentkeeper exception status`, and signed `agentkeeper.dev` public request pages.
- Clarified that approved exceptions are scoped expiring leases that downgrade matching blocks to warnings, and that current policy eligibility is rechecked before a lease applies.
- Clarified Access around dashboard seats, invites, and owner/admin/member/developer roles so workstation-only evidence stays in Workstations and Activity.
- Improved AI Discovery usage views so top-user activity resolves to directory or detected identities instead of raw telemetry account IDs.
- Promoted the policy-gated exception lifecycle to production after sandbox E2E verification.
How to verify
- Open Policy-gated exceptions docs and confirm the workflow matches the organization's exception policy.
- In sandbox, run the policy-gated exception lifecycle E2E before enabling review for a real rule.
- In production, keep exception eligibility set to Never unless a security-admin authored policy allows review for the specific detector or policy reason.
- Open Settings > Access as an owner/admin and confirm the member roster shows dashboard access records, with admin assignment limited to owners.
- Open AI Discovery > Usage and confirm top users show Directory, Detected, or Unmapped identity labels.
- Trigger a non-eligible block and confirm no request path appears.
- Trigger an eligible test block and confirm the developer sees a CLI command and signed agentkeeper.dev request URL without needing dashboard access.
May 29, 2026
SSO launch, public setup docs, SageMaker install, and sandbox exceptions
AgentKeeper AdministrationSSORuntime ShieldDocsSandbox
What changed
- Added a copyable Okta tile URL for saved Okta SSO connections.
- Added an SSO start route that begins AgentKeeper SSO before redirecting to Okta.
- Updated SSO documentation to use an Okta Bookmark App as the visible launcher tile.
- Made the Claude Code setup guide available without dashboard auth so setup commands can be shared with deployment teams.
- Added a SageMaker Studio / cloud Claude Code installer path for headless and lifecycle-configuration installs.
- Reduced member roster noise by deduplicating member access by email and removing unassigned workstations from Members.
- Reduced false positives from normal AI agent workdir activity while keeping control/config files flagged.
- Prepared policy-gated exception lifecycle in sandbox for explicit promotion after end-to-end validation.
How to verify
- Open Settings > Single Sign-On as an owner/admin on an Enterprise org.
- Copy the Okta tile URL from a saved Okta connection.
- Create an Okta Bookmark App with the copied URL and launch it as an assigned test user.
- Open /docs/claude-code-setup while signed out and confirm the public setup guide loads.
- Open Setup and confirm SageMaker Studio / cloud appears as a Claude Code install path.
- Run the policy-gated exception lifecycle runbook in sandbox before enabling exception review for production policy rules.
May 28, 2026
Prompt privacy, gateway proof, settings cleanup, and workload inventory
Prompt VaultMCP GatewaySettingsInventoryRuntime Shield
What changed
- Added Prompt Vault privacy modes and hardened raw prompt surfaces so Visible Capture, Sealed Evidence, and Promptless behavior are clearer.
- Strengthened MCP Gateway bake-off posture with private deployment proof and repeatable buyer validation paths.
- Consolidated Settings information architecture so identity, notifications, managed runtimes, and access controls are easier to scan.
- Moved nodes, containers, and Kubernetes workloads into a dedicated Workloads inventory surface.
- Hardened Prompt Seal evidence UX, repaired runtime placeholders, and made runtime Prompt Seal evidence gating stricter.
- Added self-service Intune enrollment tokens for managed deployment workflows.
- Improved the AgentKeeper sensor chart release packaging.
How to verify
- Open Prompt Vault docs and confirm the selected privacy mode matches the customer rollout plan.
- Open MCP Gateway docs and run the bake-off or private deployment checklist when evaluating gateway-only control.
- Open Settings and confirm the expected enterprise setup surfaces are grouped cleanly.
- Open Workloads and confirm nodes, Kubernetes workloads, and containers are separated from workstation inventory.
- Open Intune deployment docs before issuing self-service enrollment tokens.
May 27, 2026
CISO-ready AI Discovery and cleaner security operations
AI DiscoveryNavigationInvestigationsActivityPolicy
What changed
- AI Discovery is now a top-level workspace for shadow AI inventory, with clearer review queues, evidence drawers, and decision states for approve, unsanctioned, accepted risk, and not AI.
- Review language now matches the workflow. Items that previously said Needs policy now say Needs review, so the page no longer implies policy enforcement where the product is asking for a security decision.
- Sessions now live under Activity, while Investigations stays focused on alert review and evidence triage.
- Workspace navigation is more consistent across Activity, Inventory, Policy, Settings, and related detail pages, with a refined collapsible sidebar for icon-only mode.
- Quick Connect is easier to scan from the sidebar and keeps setup accessible without overpowering the rest of navigation.
- Policy and scope pages were tightened so subnavigation, titles, and table headers behave more consistently across Profiles, Rules, Exceptions, Scope, Audiences, Repositories, and Package Safety.
How to verify
- Open AI Discovery and review the unreviewed queue, evidence drawer, and decision actions.
- Open Activity and confirm Sessions is available there, then open Investigations and confirm it remains a single alert-review interface.
- Collapse and expand the left navigation and confirm labels, active states, and icons remain legible.
- Open Policy, Scope, and Audiences to confirm title and subnavigation placement is consistent.
- Open the Setup or sidebar Quick Connect flow and confirm it is visually quieter while remaining discoverable.
May 26, 2026
Cowork rollout confidence and browser visibility
CoworkWeb BrowserInvestigations
What changed
- Cowork setup is easier to roll out across managed environments, with less local dependency friction on macOS and Linux.
- Windows Cowork status now separates a local self-test from real protected activity, so admins can tell when live protection is actually confirmed.
- The browser extension is ready for broader managed deployment, with admin-controlled provider monitoring, Perplexity visibility, and a dedicated privacy page.
- New signup confirmations now land users in onboarding, helping first-time teams get to setup faster.
- Investigations now resolve the responsible actor more clearly using runtime, session, workstation, and directory signals.
How to verify
- Install or update Cowork, relaunch Claude Desktop, run a real Cowork tool action, and confirm live status reports protected activity.
- Open Browser Extensions and confirm monitored providers match the rollout plan.
- Confirm a new signup email routes into onboarding.
- Open a recent investigation and confirm actor details are clearer where trusted identity evidence exists.
May 25, 2026
Faster setup and sharper activity attribution
SetupShield AgentReliability
What changed
- Quick Connect now gives admins one focused path to choose a tool, install the connector, and verify the first live event.
- Teams can copy a warning-aware setup prompt for agent-assisted installation.
- OTLP activity now resolves to the right user from reported email, with detected identities created when directory sync has not seen them yet.
- A broad reliability pass tightened validation, pagination, org scoping, notifications, device registration, billing, and setup flows.
How to verify
- Open Setup and confirm Quick Connect walks through install and first-event verification.
- Run one safe action from a connected tool and confirm Activity shows the expected actor and workstation.
- Spot-check core admin workflows for policies, notifications, identity, devices, and usage pages.
May 6, 2026
Customer SSO, login polish, and enterprise docs
AgentKeeper AdministrationSecurityDocs
What changed
- Added customer-defined SAML SSO setup for Enterprise organizations.
- Improved login UX with a dedicated Single Sign-On mode for work email or company domain.
- Expanded SSO documentation for Okta, Microsoft Entra ID, Google Workspace, and generic SAML.
- Clarified that SSO authenticates users while Directory Sync supplies users and groups for policy packs.
How to verify
- Open Settings > Single Sign-On as an owner/admin on an Enterprise org.
- Create a test SAML connection with a verified company domain.
- Run Test SSO and confirm the user lands in the expected organization.
May 4, 2026
Base Policy simplification
AgentKeeper AdministrationPolicy
What changed
- Simplified the policy model around Base Policy instead of exposing separate global guardrail and org-default concepts.
- Kept group-specific policy packs for audiences that need stricter or narrower runtime controls.
How to verify
- Open policy management and confirm Base Policy is the default policy surface.
- Assign a policy pack to a pilot group and confirm runtime events resolve through that group.
April 30, 2026
Cowork PASS activity remediation
Shield AgentCoworkActivity
What changed
- Restored expected Cowork PASS visibility when full tool-call logging is enabled.
- Kept blocked Cowork events logging regardless of full audit logging.
- Updated Activity realtime handling so fresh Cowork PASS events refresh without waiting for a BLOCK event.
How to verify
- Enable Log All Tool Calls in runtime policy.
- Run a benign Cowork tool action and confirm PASS appears in Activity.
- Run a blocked sensitive file read and confirm BLOCK appears in Activity.
By product area
Shield Agent
Endpoint runtime, IDE setup, Activity visibility, runtime hooks, and workstation validation.
MCP Gateway
Gateway install, MCP server inventory, tool policies, and proxy health.
Web Browser
Browser extension deployment, managed config, provider capture, and validation.
AgentKeeper Administration
SSO, Directory Sync, people, groups, Base Policy, integrations, and policy packs.
Security and reliability
Security fixes, fail-open behavior, audit posture, and action-required changes.