Changelog

• Gateway API: Publish a Runlayer instance with Kubernetes Gateway API, keep using Ingress, or run both. See Runlayer operator.
• Your own agent IDs on Claude Code sessions: Claude Code sessions sent over OpenTelemetry now keep sidekick.* attributes, such as sidekick.agent_id and sidekick.session_key set through OTEL_RESOURCE_ATTRIBUTES. They show as External metadata on the session, so you can tie a session back to your own agent. See Claude Code OTLP monitoring.
• Sessions: see which agent ran a session: Runlayer agent runs in Sessions now show the agent’s avatar and name instead of a generic Runlayer label, and the session panel links straight to the agent. See Sessions.
• Rename artifacts from the viewer: Editors can double-click an artifact’s title, or edit it while Edit text is open, to rename it. Renaming doesn’t create a new version, and a blank title falls back to the file name. Agent updates that don’t set a title now keep a title someone chose instead of resetting it to the file name.
• Teams: Admins can now open any team from the Teams page and see its members and shared assets without joining it. The page is read-only until they join.
• Agent chat on redacted runs: Opening a teammate’s agent run in chat now says why its messages are hidden instead of showing a wall of ***REDACTED***. People who can view unredacted content can reveal the messages right there, as they already could in the run timeline; each reveal is recorded in the audit log.
• Agent spend caps via Runlayer MCP: The Runlayer Assistant and MCP clients can now read an agent’s spend and run limits, including current usage and reset times, and set or remove daily and weekly spend caps. Only agent managers can change limits.
• Redesigned Security Scanners settings: Settings → Security Scanners now opens with tabs for Scanners, Security Response, Scan budgets and Overrides, a scanner list grouped by category with a detail pane for each scanner, and one page per connector or client override so you can see every rule that applies to a caller in one place. See ToolGuard Models.

• Suggestion policies: Admins can steer agents toward the tools your organization prefers without blocking them. For example, an agent that deploys through Vercel can be told to publish with Runlayer’s create_app next time. A suggestion policy lets the tool call run unchanged and adds your message to its result, once per session or on every call.

• Agent chat: a chat tab left open across a Runlayer update keeps rendering code blocks normally. Code blocks no longer depend on a file that loads on demand, so an update can’t strip their formatting.
• Uploaded icons: Agent, connector and organization icons you uploaded no longer flash to a loading placeholder when you switch back to the Runlayer tab.
• Runlayer CLI on macOS: The CLI deployment profile now allows the skill-sync scheduler and the hourly updater, so macOS no longer blocks them after install. If you already deployed com.runlayer.cli.mobileconfig, download it again from Settings → MDM configuration and re-deploy it. See Deploy the CLI on macOS.
• AI Watch browser extension on macOS: After a restart or an MDM profile update, AI Watch now restores the browser extension’s tenant settings within a minute, so the extension no longer falls back to asking for setup for up to 15 minutes. See Browser extension.
• AI Watch browser extension in Google Admin: The Chrome setup steps now tell you to set the extension’s Update URL to Installation URL. With Google Admin’s default, Chrome takes updates from a global Runlayer URL and ignores your Client Updates version. If you deployed the extension from Google Admin, change this setting. See Browser extension.
• AI Watch browser extension: The extension now keeps its tenant settings for up to 30 minutes when the managed browser policy briefly disappears, such as after a macOS restart or an MDM profile update, instead of falling back to asking for setup. The popup shows when it is using the last copy. See Browser extension.

• Kubernetes operator checks topic-cpu memory against the current model set: The Runlayer operator now requires at least 4096 MiB of memory per slow-pool worker on components.topicCpu (previously 2048 MiB), matching the ECS module, so a RunlayerInstance cannot pass validation and then run out of memory once the ToolGuard CPU image loads the session-topic model. The default shape (1 worker, 8192Mi) and 2 workers are unaffected. An instance that set topicCpu.gunicornWorkers to 3 or more without a matching resources memory override fails validation after the operator upgrade, and a failed instance is not reconciled at all (no backend, worker or frontend updates, including version bumps) until the memory is raised or the worker count lowered; check those instances before upgrading. See Runlayer operator.
• Edit artifacts directly: edit doc, CSV/TSV and HTML artifacts in place from the artifact page, without asking an agent. Untouched content is kept exactly as it was, and an agent’s search-and-replace edit (edit_artifact) that would overwrite your newer save is refused.
• Procedures: Runlayer now benchmarks a procedure draft on its own by replaying the agent runs it was built from, so the draft is ready to approve (or goes live, if your org skips approval) without anyone running the benchmark by hand. The review panel shows whether the benchmark is queued, running or failed, and why.
• Tunnel connector health checks: Kubernetes deployments can use optional liveness and readiness probes to distinguish a responsive connector from one with an established tunnel session.
• Tunnel connector metrics: Monitor connector readiness, endpoint connectivity and connection failures through an optional Prometheus-compatible metrics endpoint.
• Tunnel connector logs: Enable optional JSON logs with timestamp, severity and message fields for your log collector. Text remains the default and now uses key=value fields.
• Model per schedule or trigger: A scheduled task or trigger can run on its own model instead of the agent’s, for example a cheaper model for an hourly check and a stronger one for a weekly report. Pick it in the task or trigger dialog; it lists the models the agent’s AI provider serves. See Agents.
• API keys: The Organization API keys page now links to Personal API keys, so you can find a key tied to your own account without hunting through Settings.

• Regex length limits: Custom PII rule patterns can now be at most 1,000 characters, and a policy regex condition can be at most 500 characters when you edit a policy, the same as when you create one. Existing longer patterns keep working and stay editable.
• Policies on Runlayer-managed agents: Only an admin who manages security policies can now grant or restrict access to Runlayer-managed agents such as the Runlayer Assistant. The agent’s owner can no longer give anyone edit or View all runs access to it, which would show every employee’s Assistant runs. See Policies.

• OAuth connect: Connecting a server no longer fails when the identity provider returns token expiry as an absolute timestamp instead of a lifetime in seconds.
• Agent names: Detections and Agent accounts now show an agent by the same name as the Agents page (Adrian Bot, not agent-Adrian Bot).
• AI Watch on macOS: The macOS deployment profile now allows AI Watch’s background items, so macOS no longer blocks its scan agents or keeps the setup service from starting at boot. If you already deployed the profile, download it again from Settings → MDM configuration and re-deploy it, or change the Login Items rule in your own profile to the Runlayer team ID. See Troubleshooting.
• Usage overview: the ROI estimate on Usage → Overview now prices every session topic at the benchmark for the kind of work it describes. Topics that previously fell back to the default one-hour rate (for example debugging, deployments and document updates) are priced by their own bucket, and greetings, automated health checks and unclear sessions count as no saved work instead of an hour each.
• ChatGPT capture when signed out: AI Watch in the browser extension now records ChatGPT conversations when the user isn’t logged in to ChatGPT.
• Gemini prompt capture: The AI Watch browser extension now records each Gemini prompt once, instead of repeating its text twice in the session.
• Microsoft Copilot in the browser extension: AI Watch captures Copilot chats again now that copilot.microsoft.com redirects to copilot.com.
• AI Watch on v0: AI Watch now records v0’s full reply in browser sessions, not just its first word.
• Agent runs on some models: When a model such as Kimi K3 ends its turn without an answer, the agent now asks it to continue once, and the run fails with a clear error if it comes back empty again, instead of showing Succeeded with no reply.
• Sessions: separate records for Cursor tool calls: when Cursor reuses one tool call ID for different calls, each call now gets its own scan record, so one call’s findings and block label no longer show up on the others. Applies to calls recorded from this release on.
• Agent schedules and connector triggers: A user an org policy denies from using agents no longer has scheduled runs or connector-event trigger runs fire on their behalf.

• Agent run traces: get_agent_run_trace no longer returns a total count with a run’s raw events. Page with the new events_after_seq input instead: pass each page’s next_after_seq back until has_more is false.
• Agent runs API: While a run is still running, the run list and timeline (GET /agents/{agent_id}/runs and GET /agents/{agent_id}/runs/timeline) return its event_count as null, and its token counts and total_cost_usd as null until its usage is recorded. Treat null as not known yet: the event count is filled in after the run ends.

• Policies: Conditions can now read fields inside object arguments with payload.<arg>.<field>, for example payload.folder.id, so a Deny rule can keep an agent’s writes inside one folder.
• Agent runs: The run list no longer reads a running run’s events to count them, and get_agent_run_trace reads one page of events at any events_after_seq instead of every event before it.
• Manage agent GitHub access from Runlayer MCP: Workspace admins can read, grant and revoke an agent’s GitHub access from any AI client with get_agent_github_access, grant_agent_github_access and revoke_agent_github_access. See GitHub access for agents.
• Agent connector cards: when you own a connector, one click on Connect account signs you in and adds its tools to the agent. You no longer approve a second card.
• Agents: Deleting an agent can’t be undone, so the delete confirmation now suggests turning the agent off instead when you want to keep it for later. A turned-off agent keeps its setup, schedules and history, stops running, and can be turned back on anytime.
• Secret stores, agent webhooks and agent notification routes in Terraform: The next Terraform provider release adds runlayer_secret_store, runlayer_agent_webhook and runlayer_agent_notification_route, so you can manage external secret stores, an agent’s inbound webhooks and where its failures are posted as code. Secret stores and agent notification routes need those features turned on for your organization. See Terraform Provider.
• Agents: People without the Manage agents permission now see the agent’s Limits button greyed out on the Monitor tab, with a note that changing limits needs that permission, instead of no button at all.
• Runlayer Plugin: Claude, Claude Code, Cowork, Cursor, VS Code, ChatGPT and Codex now see connector tools directly by default, instead of searching for them through search_tools and execute_tool. Send X-Runlayer-Tool-Exposure: force-initial to keep a client on search. Self-hosted operators can turn this off with FF_DISABLE=plugins-flat-mode (deployments still on WorkOS feature flags turn it on with FF_ENABLE=plugins-flat-mode). See How connector tools are presented.
• Artifact design: HTML reports and dashboards that agents build read more clearly: figures line up in columns, numbers and their units stay together, status badges fit their label, and small accent labels and negative deltas now use text colors that meet WCAG AA contrast.
• Runlayer MCP whoami: The response now includes the actor making the call, so an agent acting on a user’s behalf can see both its own identity and the user’s.
• Spend map: The Analytics Spend tab now shows a treemap of spend by department, agent, model or user. Click a tile to drill in, and the last level opens that entity’s spend details.
• Session SIEM export event types: The session SIEM export docs now list every event_category and event_type value, with meanings and example events. See Event types.
• Agent Monitor: The Tokens tile now shows cache reads and cache writes separately, so you can see what an agent’s cost went to.

• Hint action for scanners: Set a scanner to Hint to let a flagged tool call go through while warning the agent that the output may be unsafe. Runlayer puts a warning in front of the tool output telling the agent to treat it as untrusted, then logs and notifies admins like Alert. Cursor, Codex, and Gemini CLI can’t replace tool output, so they get the warning as extra context beside it (update the Runlayer CLI; older versions follow the Hint fallback instead). MCP results also carry it in _meta["com.runlayer/hint"]. You can rewrite the warning under Edit security messaging. See Violation Actions.
• Choose Block or Alert where Mask or Hint can’t apply: Some clients can’t apply a Mask or Hint to tool output, such as Anthropic Inference hooks, Goose, and the TypeScript SDK. Two new settings under Security Scanners → Settings → Clients that can’t apply Mask or Hint decide what happens there. Block, the default, withholds the output. Alert lets the original output through and records an alert. The tool call’s audit record shows which one happened.
• TypeScript SDK blocks output it can’t mask: afterTool and runTool in @runlayer/hooks-sdk now throw RunlayerBlockedError when a Mask or Hint scanner would rewrite the tool output and the fallback is Block, because the SDK can’t apply the rewrite. Before, the original, unmasked output went through.
• Customer web gateways: Agent internet traffic can now pass through your HTTPS web gateway, applying its filtering and logging alongside Runlayer’s network policy.

• Past conversations: Switching agents resets the conversation filter so the next agent’s history remains visible.
• Agent creation policies: a policy that denies creating agents now blocks only creating them. People it names can still open, run and chat with the agents they have access to. To block agent use as well, deny use_agents.
• Connector cards: Agents can no longer ask you to approve connector tools that don’t exist. A card now only offers tools the connector really has, and an agent whose approved tools were renamed or never existed says so and proposes the right ones, instead of asking you to refresh.
• Agent sidebar tab: Resuming a run from Chat no longer switches the sidebar back to the Agent tab, so you stay on Monitor or whichever tab you had open.
• AI Watch Detect on Linux: Running AI processes now appear once, under the account that runs them, instead of once for every account on the machine (including system accounts like root and daemon).
• Procedures: Procedure tools with nullable inputs now show the right input type to the agent and reject a missing required nullable argument up front, instead of failing later with “missing required argument”.
• Agent thinking effort: Agents set to “Extra high” or “Max” thinking effort now use that level on the Pi harness instead of falling back to medium.
• Slack search triggers: A message whose text contains a line such as Permalink: ... no longer overwrites the real message’s details, so new matching messages are detected and dispatched reliably.
• Agent timeline: With Slack skips shown, a redelivered Slack message no longer appears as a skip next to the run it already started, so the count no longer double-counts it.
• Microsoft Teams: Code blocks render correctly when messages include inline backticks or nested code fences.
• Poll trigger account picker: A connector renamed to another connector’s name no longer shows up in that connector’s account picker; triggers bind to the server created from the right catalog entry.
• Agent follow-up runs: Fixed follow-up messages and scheduled wake-ups failing to start when the conversation’s idle session was shutting down.
• Single approval when an agent adds a subagent: When an agent proposes adding a subagent to itself, you now approve it once, in Runlayer’s approval prompt for that exact subagent, instead of being asked in the conversation first and then again.
• Top Tasks counts: An agent conversation now counts once in Top Tasks, however many follow-up messages it has, and agent runs that stopped before doing any work (for example, refused by a daily run limit) are no longer counted. This applies to past tasks too, once a background update finishes after the upgrade. Task counts for agents can drop, and ROI and per-task averages shift with them; spend is unchanged.
• Claude Desktop and LLM routing: AI Watch no longer switches Claude Desktop users who are signed in to Claude.ai into gateway mode. Gateway mode doesn’t show their Claude.ai chats and connectors, so the switch looked like lost data. Users AI Watch already switched return to Claude.ai sign-in at Desktop’s next launch, with nothing lost. AI Watch still adds a Runlayer gateway option that users can pick in Claude Desktop. To move users to the gateway, deploy the documented Claude Desktop MDM profile.
• Codex config on Windows: runlayer setup sync no longer corrupts ~/.codex/config.toml with doubled carriage returns on its second run, which stopped the ChatGPT desktop app from starting and made later syncs fail. The next sync repairs affected files, and configs saved with a UTF-8 BOM now sync.
• Agent cards stay clickable while the agent works: You can answer a card in the agent playground (approve a connector, pick an option) while the agent is still replying. Your choice saves right away and the agent picks it up as soon as its current reply finishes.
• Agents: Agents no longer schedule an empty follow-up after a plain answer and then tell you to ignore it. A follow-up now needs a note saying what to check, and agents are told to cancel one they don’t need.
• Agents: Connecting an OAuth connector from chat works again. After you approve “Connect account” and sign in, the agent can see the connector’s tools and propose them, instead of getting stuck on “auth required”.
• Chrome extension updates on macOS: Chrome on Macs managed by AI Watch can now take Runlayer extension updates from your organization’s update URL instead of staying on an older version. Turn on Chrome updates from your update URL in Settings → AI Watch → Manage settings → Browser extension (off by default). AI Watch then also sets Chrome’s ExtensionSettings policy on each Mac, which hides any ExtensionSettings you set in Google Admin or a per-user MDM profile, such as extension blocklists: if you set it there, leave the option off and use Chrome extension installed by your policy instead (in Google Admin, also set Runlayer’s Update URL to Installation URL). See Browser extension.
• Agents can attach files in the Slack thread they were asked in, with outbound messaging off: The Direct messages to people and Channel posts switches no longer block an agent’s say reply, files included, in the conversation that started its run. They still block every other DM and channel post, and blocked or unapproved channels stay off-limits.
• Microsoft Teams: a deleted agent no longer stays in Settings → Microsoft Teams → Connected Agent Apps, where its Manage link led to “Agent not found”.
• Microsoft Teams: deleting an agent now also removes its Teams bot, instead of leaving it registered after the agent is gone.
• ChatGPT web sessions: Replies captured by the browser extension on chatgpt.com are stored in full again. Sessions had been keeping only the first few words of each reply.
• ChatGPT web sessions: A new ChatGPT conversation now stays one active session from its first prompt, instead of ending right after it starts and leaving a session stuck as active.
• Chrome extension on Google Admin-managed Macs: on Macs where Chrome is enrolled in Google Admin (Chrome Browser Cloud Management) at the machine level, AI Watch now leaves Chrome’s extension policy to Google Admin instead of overriding it, so your Google Admin extension settings no longer get replaced on those Macs. Before updating, force-install Runlayer from Google Admin, or Chrome removes the extension from those Macs; the device health check then shows Chrome as managed by Google Admin. If you enroll Chrome with user-level profiles only, AI Watch keeps its force-install; turn on Chrome extension installed by your policy instead. See Install the Chrome extension from your own policy.
• ChatGPT web sessions: A new ChatGPT conversation now keeps its conversation link when the session ends, instead of reverting to the ChatGPT home page.
• Slack assistant pane: replies sent with say in the assistant pane no longer appear twice. The say tool’s default destination now points at the run’s conversation channel (the pane DM) instead of the viewed channel.

• New icon set: The app now uses one consistent icon style throughout, with clearer icons for Shadow AI and Policies.
• Session search: On Runlayer-hosted deployments, search your organization’s agent sessions from the Sessions page, and let agents search them through the Runlayer MCP tools. Results cover sessions from October 29, 2026 onward; earlier sessions aren’t searchable. Self-hosted deployments: search needs the session search indexer running in write mode; until you enable it, set SESSIONS_SEARCH_API_ENABLED=false on the backend so users don’t see an empty search. See Sessions.
• Agent configuration policies: Settings are now grouped under Memory, Capabilities, Network and Slack, and the Slack channel setting is renamed Slack outside approved channels to say what it controls: whether an agent may answer in channels not on its approved list.
• Microsoft 365 file reads: onedrive_read_file and sharepoint_read_file can now return a file’s exact bytes (format: "raw") and read files up to 50 MB (allow_large_file). Redeploy the connectors to pick this up. See Microsoft 365.

• Migrated connector deployments: Only admins with server management permissions can now edit, redeploy or delete the deployment behind a migrated stdio connector. Developers and organization API keys get a permission error, as they already did on the connector before migration.

• AI Watch hooks for VS Code and Copilot CLI: The Runlayer hook no longer runs twice per tool call when both VS Code and GitHub Copilot CLI are set up on one machine. VS Code’s hook file now lives in its own directory, and the old copy is cleaned up on the next sync.
• Agent accounts: An agent acting on behalf of a user could list a connector’s tools, resources and prompts through the Runlayer MCP tools without holding a session grant for that connector, using the user’s own connection. Those listings now require the same session grant as a tool call, and report the agent’s own policy status.
• Procedures: Agents no longer fail every code and procedure tool call when one procedure’s namespace contains a dot and another procedure’s name matches its first part.
• Procedures: Saving a procedure that reads inputs through rest destructuring (const { a, ...rest } = input) no longer fails validation with “declared parameter is never read”.
• Procedures: Procedures that use structuredClone now pass validation instead of failing with “Cannot find name ‘structuredClone’”.
• MCP Apps in local connectors: Interactive MCP App widgets now render for connectors run with runlayer run. Before, those tools showed text only.
• Artifact formatting: Bold and italic text in a document artifact’s table now stays at the table’s size, italics show as italic, and <u> underlines text.
• Fewer email false positives: PII detection no longer flags SSH git remotes such as git@github.com:org/repo.git, placeholder addresses on reserved example domains such as example.com, or the co-author addresses coding agents add to commits (cursoragent@cursor.com, noreply@anthropic.com, GitHub Copilot). See PII Detection.
• Fewer auth token false positives: Credential detection no longer flags placeholder token values from docs and sample payloads, such as "token": "token-value" or auth_token=your_auth_token_here.
• Agent run limits in settings search: searching settings or the command palette for “agent limit” or “run limit” now finds the workspace’s Agent Run Limits card and jumps to it, and the card says where to change one agent’s limits. See Usage limits.

• Agent DNS filtering: Self-hosted deployments that resolve agent destinations through their own DNS filter can list the filter’s block answers. The proxy then refuses a blocked name immediately and reports in its response and audit logs that your organization’s DNS filter blocked it. Deployments without a DNS filter are unchanged. See Sandbox egress proxy inputs.
• Claude Desktop through the LLM Gateway: With LLM routing on, AI Watch now also routes eligible users’ Claude Desktop through your LLM Gateway, with short-lived per-device tokens, budgets, and Sessions like Claude Code and Codex. To stop users from switching back to Claude.ai sign-in, deploy the documented Claude Desktop MDM profile.
• Spend breakdowns via the Runlayer MCP: Agents and MCP clients can now read the same Spend tab numbers you see on the Usage page: spend per provider and model (get_spend_cost_breakdown), the All users list (get_spend_people_usage), and spend by department (get_spend_department_usage). Each needs View company metrics. See Runlayer MCP.
• Runlayer Plugin: In nested mode, search_tools results now include the connector’s tool hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) as annotations, so an agent can pick read-only tools without listing every connector first.

• Agent run session shares: A share on an agent run’s session stops granting access while the user who made it is deactivated, and works again if they are reactivated.

• Session sharing for agent runs: The person who started an agent run can now share its session, including runs that execute as an agent account. Before, sharing those sessions failed with “not found”.
• ROI cost for custom date ranges: ROI no longer counts an extra day of spend when a custom range ends on a past day, so ROI cost now matches Spend for the same range.
• Spend for Claude Sonnet 5.5: Cache reads on Claude Sonnet 5.5 now cost $0.10 per million tokens, matching Anthropic’s October price cut. Spend had been showing them at twice that.
• Runlayer Plugin memory growth: Self-hosted backends no longer grow steadily in memory and restart workers under Runlayer Plugin MCP traffic.
• Strict MCP servers: Tool calls through Runlayer no longer fail with HTTP 400 on MCP servers that check request headers against the request body, such as UserVoice.
• Audit Logs: Session stop and stop cleared rows now show the stopped session’s AI client in the Client column instead of N/A, and stop applied rows show the client of the denied call.
• Agent tool images: Agents using OpenAI can continue after a tool returns an image with line-wrapped, URL-safe, unpadded or data URL-prefixed base64.
• Agent wake-ups: When an agent re-schedules a follow-up (a reminder, a check-in) from a later message in the same conversation, it now replaces the one it scheduled earlier instead of adding a second, so the follow-up arrives once.

• Share skills over the Runlayer MCP: the new update_skill_shares tool shares a skill with teams or people, changes their permission, or removes their access, under the same rules as the skill’s Share dialog, and list_skill_shares shows who has access today. Grants show in the dialog and in list_skills share counts. As in the dialog, sharing an organization-wide skill makes it private to its owner and the people and teams you name.
• Metric definitions: every number card on Control and Usage now has an ⓘ that says what it counts, and the trend arrow says what it compares to (for example “vs previous 7 days”). “Tasks completed” on Control is now “Actions”, and “Tasks” on Usage is now “Agent runs”.

• Spend for Cursor effort and thinking levels: Cursor usage on models with an effort or thinking level in the name (for example Claude Opus 5.5 at high effort, or Claude Fable 5.1 with thinking) now shows an estimated cost at the base model’s rate instead of Not priced. Fast variants stay separate.

• AWS: Connect the remote AWS MCP Server from the catalog and sign in with your AWS account through Runlayer’s OAuth broker.

• Shadow AI inventory for VS Code: Detect now finds MCP servers in every VS Code profile and edition (Insiders, Exploration, VSCodium, portable, and remote-server installs), the servers VS Code forwards to its agent host, including ones contributed by extensions, and user-installed agent plugins. See Detect.
• Shadow AI inventory for GitHub Copilot CLI: Detect now reads Agent Plugins mcp.json, MCP servers declared in custom-agent frontmatter, and the bundled Computer Use and Browser Use plugins. Plugins switched off in Copilot’s config, bundled or installed, show as disabled instead of as live servers. See Detect.
• AI Watch Enforce for GitHub Copilot CLI: The hook now resolves MCP servers the way the Copilot runtime loads them, including Agent Plugins, MCP servers declared by custom agents, plugin-root placeholders, and VS Code workspace and home variables in forwarded VS Code configs, so those calls get a policy decision instead of being blocked as unregistered. Process environment variables in server URLs are expanded only when the hook runs inline; on daemon-served devices they stay unresolved and Runlayer decides on the configured text. Disabled plugins no longer count as live servers. Copilot’s bundled Browser Use plugin and IDE bridge are now on the default built-in allowlist alongside Computer Use. See Enforce policy.
• Agents: Handing a task to another agent returns in about a second instead of about 20 seconds.
• Kubernetes audit consumer leases its Kinesis shards: if you wrote your own {instance}-audit-consumer IAM policy instead of using the published sample, make sure it allows dynamodb:Query and dynamodb:UpdateItem on the checkpoint table, and dynamodb:DeleteItem scoped to dynamodb:LeadingKeys = workers#*. A consumer missing Query or UpdateItem logs kinesis_consumer_missing_permissions at startup, naming the action, and exits. A missing DeleteItem only leaves lapsed worker registrations behind, and is logged once as kinesis_lease_cleanup_access_denied. See Workload identity.

• Approve agent changes made from chat: When an agent tries to change its own setup from a conversation (connectors, skills, instructions, subagents, schedules, triggers, webhooks, Slack settings or channel monitors) or to add a connector to your workspace, Runlayer now asks the person in the conversation to approve that exact change first. The agent then resumes to apply the approved change. Deleting the agent itself, starting evaluations and listing deployments or reading their details (which can repair stored deployment history) also require approval; removing individual connectors, skills or automation still applies right away. When a change is too long to show in full on the approval card, Inbox also sends you to the full request in Runlayer before approval; Slack and Teams runs then resume in the original conversation. In Slack, request agent changes through a direct message, app mention, assistant thread or follow-up in an invoked thread; ambient messages and channel-join introductions do not receive these controls. See Changes an agent makes to itself.
• Legacy macOS MDM scripts: The script-based AI Watch and Hooks scripts for macOS now run uv and the Runlayer CLI as the signed-in user instead of root, and keep the enrollment key off the command line. If you still deploy these scripts, regenerate them and redeploy. On a Mac where an earlier run was interrupted and left the Runlayer config file owned by root, the script removes that file and re-adds only its own key, so a Mac running both scripts re-enrolls on the other script’s next run.
• AI Watch Enforce in VS Code: MCP calls made from VS Code’s legacy Local chat harness are now blocked under Enforce and shown in Shadow AI Activity as an unidentified MCP server, because that harness gives the hook no trustworthy server identity: the tool name carries a prefix the server itself chooses. VS Code’s default GitHub Copilot harness is fully supported and gets the normal allow or block decision per server. See Enforce.
• Per-run LLM spend limit for agents: Agent runs that send their LLM traffic through the Runlayer LLM gateway now stop once they have spent $250, or whatever is left of the agent’s daily or weekly cost budget if that is lower, so one runaway run can no longer burn through the budget. The run fails with an error naming the limit, and the agent’s owner gets a Slack DM when Budget alerts are on. See Cost budgets.

• Agent conversation recovery: Follow-up messages recover automatically when the conversation’s runtime is unavailable, instead of failing the run.
• AI Watch Enforce in VS Code: MCP servers configured in VS Code (profile mcp.json, extension-contributed, or discovered) are now recognised when VS Code chat runs on the GitHub Copilot harness, so they get the same allow or block decision as any other server instead of a silent on-device deny. A server the hook cannot identify is still blocked, and the call now appears in Shadow AI Activity as an unidentified MCP server instead of failing silently on the device. See Enforce.
• Agents: Runs stopped by the session lifetime limit now show the correct shutdown reason in reused conversations. Shutdown messages explicitly identify the session’s age.
• Managed Slack apps: Agent owners whose Slack app was created through a teammate’s Slack connection are now added as collaborators on it when they connect Slack, so they can manage and delete their agent’s app with their own account.
• Plugin setup screenshots open full size: In the Runlayer Plugin “Add to Organization” guide, clicking a setup screenshot now opens it full size in a new tab, so the Claude and ChatGPT steps are readable.
• Agent conversations: An unanswered retry for a turn that failed to start no longer interrupts another turn running in the same conversation.
• Skill editing in chat: Agents can create and update skills directly in conversation without requiring an explicit Runlayer connector or handing you a ZIP file to upload. Existing skill editing permissions still apply.
• Agents in Slack: when an agent’s reply @mentions a person or a Slack user group, they now get a Slack notification, not just a blue tag.
• Agent model picker: An agent’s page now shows its current model after the model is changed in another tab, by an upgrade, or through the API, instead of the model the page opened with.
• Agent description: the fullscreen description editor now shows a saved description in Preview instead of an empty “Add a description…” field.
• Session safety chart: The Safety over Time chart in the session details panel shows again. It had rendered empty after the last release.

• Claude Code forks and resumes: Messages that Claude Code copies into a forked or resumed session are no longer ingested a second time, so Sessions, Usage and token billing count each message once.

• Kubernetes Deploy enable_db auth: The operator no longer injects AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or AWS_CA_BUNDLE on MCP pods. ExtendDB SigV4 uses AWS profile extenddb via EXTENDDB_AWS_PROFILE (credentials under /etc/extenddb-aws, CA on the profile). Custom enable_db images must build the DynamoDB client from that profile when the env var is set; Runlayer connector images pick this up via the mcps-by-runlayer release paired with this operator bump. IRSA on the same MCP ServiceAccount is allowed again for other AWS APIs. ECS and local Docker are unchanged. See Deploy auth and Workload identity.

• Client IP can no longer be chosen by the caller: Rate limits, the ip_address on audit events and the meta.request.ip policy field now use the address your own proxy appended to X-Forwarded-For, never an earlier entry a caller sent. Behind a corporate forward proxy that address is the proxy’s egress, so IP-range policies and per-IP rate limits (including device enrollment) now see one address per office or fleet rather than per workstation. See Platform policies.
• Self-hosted client-IP settings: Deployments with more than one appending proxy set PRE_AUTH_TRUSTED_PROXY_HOPS (Terraform trusted_proxy_hops) to match, and CLIENT_IP_HEADER is honoured only when it carries a single IP address.
• Session block and stop: A tool call that sends someone else’s session ID (in a hook payload or the x-runlayer-session-id header) can no longer block that session through “Block later tool calls when any scanner blocks”, add its scan results or security events to that session’s history, or mark an operator’s Stop as having taken effect. Hook events that name someone else’s session aren’t recorded into it either, even after that session has gone idle. This holds for Runlayer Agents runs too, which belong to the person who started them (or the agent account they run as). The scanner still blocks and audits the call itself, and an operator’s Stop still denies every call that names the stopped session. See AgentGuard.

• Managed Slack apps: When you delete an agent’s or your organization’s managed Slack app, or add a collaborator to it, Slack now shows you as the one who did it, instead of the teammate whose Slack connection originally created the app.
• Claude Haiku 5.5 on AWS Bedrock: Agents on Claude Haiku 5.5 through an AWS Bedrock provider no longer fail on their first message with “thinking.type.enabled is not supported for this model”.
• Spend for Cursor Grok models: Cursor usage on Grok 4.7 at high effort, Grok 4.7 Fast at high or xhigh effort, and Grok 4.5 now shows an estimated cost instead of Not priced.

• Schedule delivery: A schedule an agent sets up from a Slack thread now posts each run’s result back in that thread, and one set up over iMessage texts you instead. These go out whatever the agent’s Slack Run results setting says, since that setting only covers the default DM. Agents can also send results to iMessage, keep the Slack DM, or send nothing and post the results themselves.
• Outlook folders: The Microsoft Outlook connector can now create mail folders, move folders, and move messages between folders, so agents can file mail for you. Redeploy the connector to get the new tools. See Microsoft 365.
• Refreshed colors: Light mode uses warmer neutrals, and badges, charts and status colors share one palette. Severity reads the same everywhere: one color per level on every page, and Critical badges carry an alert icon. Charts, including artifact charts, use a softer fill that fades toward the card.
• LLM budget alerts: Usage rules with a total budget can now email organization settings administrators when spend reaches chosen percentages, once per percentage per budget window. Set them in Email alerts under Settings → LLM Gateway → Usage rules.
• ToolGuard score API: Tool Call Guard and IO Guard score responses now include model_version, the model version this release expects to score the request. Include it when reporting scan results to Runlayer. See Runlayer ToolGuard.

• Agent accounts: When an agent account acting on behalf of a user calls a connector it has no access grant for, the reply now links the agent account page and gives the right fix: sign in to the connector again when it’s on the agent account, or ask an admin to add it when it isn’t.
• Sessions: session length now reads 1m 23s instead of a clock-like 01:23, and hovering it explains that it measures time from start to end. See Sessions.
• Agent account activity: the Activity section on an agent account now says when you only see your own events, and that admins with org audit-log access see the calls the account makes, instead of looking empty.
• Time zones: Dashboards, including Shadow AI, and agent schedules work again for users and schedules set to older time zone names such as Asia/Calcutta, Europe/Kiev or Asia/Saigon. Dashboards no longer fail with an internal server error, and those schedules run on time again.

• Google Docs templates and comments: Copy existing templates with native formatting preserved, inspect document structure and styles, and attach comments to specific text ranges. Redeploy existing Google Docs connectors to receive these capabilities. See Google Workspace.
• Keep agent harnesses on compact tool discovery: send X-Runlayer-Tool-Exposure: force-initial from any client to keep Runlayer Plugin on search_tools / execute_tool instead of listing every connector tool. Use it for agent harnesses that load all tool definitions up front. See How connector tools are presented.
• Skills in Terraform: The next Terraform provider release adds runlayer_skill, so you can manage a skill and its complete set of files as code. Changes made in the app show up as a plan diff, and a file set your skill risk policy blocks fails the apply. Changing namespace or path replaces the skill. See Terraform Provider.
• Buttons and form controls: Buttons have cleaner edges, subtler shadows and consistent hover and pressed states across every style, in light and dark mode. Checkboxes, radios and switches follow the same hover states, have larger click areas, and checkboxes are dark instead of blue. Inputs show a stronger focus edge and a hover state. Segmented tabs slide between options.
• Table pagination: Pagination looks the same on every list page, and on full-page tables like Users, Groups, Policies, Connectors and Skills it stays pinned at the bottom of the table while you scroll.
• Page headers: Page titles, tabs and actions now share one header row on every page, with Refresh, Filter and the date range always on the right in that order. Policies, User mapping and Endpoint configuration show their tabs in the header too.
• Catalog filters: Connectors, Skills, Agents, Plugins and Artifacts filter through one Filter menu, like Incidents, and show each active filter as a removable chip.
• Security API Usage: The page uses the same date range picker as other pages, so you can pick custom dates as well as the last 7, 30 or 90 days.
• Artifact cards: Titles now show on two lines instead of one, and every card in the catalog grid is the same height.
• Clearer agent account access: The agent account access page and the sign-in approval screen now show the agent account’s name instead of an opaque ID. Both also say the agent acts with your identity, not a shared or service account, and stays limited to what your policies allow. The access page now shows Revoke access even before any connectors are added. See Agent accounts.
• Slack artifact links: HTML artifacts no longer open as an interactive preview inside Slack. Slack link cards still show an artifact’s details to people with access; open the link to view the artifact in Runlayer. See Link previews.
• Agent accounts: After you tap Grant access on an agent account’s access page, the page now says access is granted and that you can close the tab and go back to your agent.
• Agent account owner: Each agent account page now shows who owns it, with a link to their user page in Settings → Users.

• Caller-sent identity headers are dropped: Runlayer now drops X-Runlayer-User-Email, X-Runlayer-Identity-Token and the other identity-forward headers when a client sends them, so an upstream server only ever sees the ones Runlayer injects. Other custom headers, like a correlation id, still pass through on each call. See Per-request headers from the caller.
• Skill risk policy on API writes: creating or updating a skill’s files through the API (for example from Terraform) now runs the security scan first and is rejected when your skill risk policy blocks the content, the same as uploads in the app. Nothing is saved when a write is blocked.
• Deactivated users on managed devices: A tool call that AI Watch allowed just before an admin deactivated the device’s user can no longer be retried under the same request for up to 15 minutes: Protect and Enforce now block the retry as soon as the user is deactivated, and Monitor keeps recording it.
• Redacted session timeline: When content redaction hides a session, the API and the Runlayer MCP get_session tool now still return its event timeline (times, event types, tool names, model, tokens), with ***REDACTED*** in place of prompts, responses, tool input and output, and page URLs. In the session drawer, viewers who can unredact see the placeholder timeline blurred; everyone else still sees the redaction notice. Redacted session list and search rows in the API and the MCP list_sessions and search_session_events tools no longer include the first prompt or generated title. Redacted agent run details, in the API and the MCP get_agent_run_trace tool, keep their steps the same way, with placeholder text. See Sessions.
• Kubernetes Deploy enable_db + IRSA: The operator now rejects MCP servers that combine enable_db with an IRSA annotation (eks.amazonaws.com/role-arn) on the MCP ServiceAccount (ExtendDBReady=False / IRSAConflict) and leaves ExtendDB AWS env off the pod. GKE Workload Identity is unchanged. See Deploy auth and Workload identity.
• Server OAuth secrets redacted in Terraform: manual_oauth_client_secret and broker_vendor_client_secret on runlayer_server are now marked sensitive, so Terraform hides them in plan and apply output. Module outputs that reference them need sensitive = true. Needs the next Terraform provider release. See Terraform Provider.

• Server config env vars: Pasting a .env file into a server’s environment variables no longer deletes existing secret values.
• Claude Code spend: Analytics no longer counts a Claude Code session’s earlier usage again when the session is resumed or forked, so Spend totals match what Claude Code actually used. A resumed or forked session now shows only the work done in it. See Analytics.
• Usage: Token totals for Cursor sessions metered by Runlayer’s tokenizer now include reasoning tokens, so Usage matches billing for those sessions.
• Agent instructions: Keep your draft open while saving, so a failed save doesn’t lose your edits.
• Agent account auth failures are errors: When an agent account’s tool call fails because the connector needs authorization or rejects its credentials, the agent now gets a machine-readable error, including whether a retry can succeed, instead of an “authorize this connector” message, and the audit log records a tool call failure.
• VPC peering in the ECS Terraform module: vpc_peering_connections now works with the Terraform CLI. Before, any peering connection failed terraform plan with “Call to unknown function”. See VPC peering.
• Agent runs: Runs that cannot create their working directory now fail promptly with a clear error instead of waiting for a startup timeout.
• Usage page on busy organizations: opening the same Usage view again within a minute now loads at once, and a date range too large to total quickly now shows a “narrow the date range” message after about twenty seconds instead of loading for half a minute and failing.
• Tool call approvals: When a tool call needs approval in Claude Code, Cursor, Codex, or VS Code, the prompt and the approval page now tell you to come back to your AI client and retry once it’s decided.
• Terraform provider plan drift: terraform plan right after apply is now empty for runlayer_policy, runlayer_agent, and runlayer_agent_account (unless identity_attributes is left unset; set it to {} instead). A runlayer_agent with memory_scopes can now be created, and removing enable_memory from its configuration no longer turns Memory off: set memory_scopes = [] to turn it off.
• Runlayer Assistant model: A model and provider an admin picks for the Runlayer Assistant now stay in place across Runlayer updates instead of reverting to the default. If that provider is removed or stops serving the model, the Assistant goes back to your organization’s default.
• Read-only policies from the policy assistant: Asking the assistant to make connectors read-only now drafts a policy that blocks every tool the connector doesn’t mark as read-only, instead of granting every tool. Tools with no read-only mark are treated as writes.
• Token masking: Microsoft Graph pagination cursors ($skiptoken, $deltatoken) in nextLink/deltaLink URLs should no longer be masked as credentials, which was breaking paginated Teams/Graph reads after page 1. Credential keys such as skip_auth_token are still masked.
• Sessions list connector icons: a connector used in a session now shows once, with its icon, even when its name has spaces.
• Security dashboard names: The Denied Actions and Security Violations cards now show a connector’s or user’s current name within minutes of a change, instead of the old name for past days. The shared Runlayer connector and built-in connectors also show their name and icon on the connector usage cards.
• Dashboard names: The AI Watch activity, blocked agent hooks, most active users, top skill creators and top plugin users cards now show a user’s or connector’s current name within minutes of a change, instead of the old name for past days.
• Dashboard Connectors count: The Connectors count now includes the shared Runlayer connector and your organization’s built-in connectors, matching the Connectors page.
• Spend for Cursor models: Cursor usage on Grok 4.7, Kimi K3, Gemini 4 Argon and GLM 5.3 Flash now shows its provider and an estimated cost instead of landing under Unmapped.
• Spend by vendor for IDE and CLI usage: Cursor, Claude Code, and Codex usage whose model has no list price now appears under its vendor in Spend instead of “unmapped”. Cursor’s Auto mode shows as “Cursor Auto”.
• Artifact embed view: Notifications such as the new-version notice no longer appear on top of an artifact opened through its chromeless embed link, so screen shares and wall displays stay clean.
• Artifact participants: Avatars in an artifact’s participant list now fill their circle, and initials fit inside avatars at every size.
• Agent connectors: Signing in to a connector you added before connecting your account now gives the agent its tools, and the confirmation says how many. A connector with no tools selected is flagged on the agent with a Choose tools action.
• Audit Logs: skill events now say what they are. “Skill Read via Runlayer” is a skill read through Runlayer or a plugin, “Skill Found on Device” is AI Watch finding a skill on a device, and “Skill Invoked” is a client’s own skill tool. See Audit Logs.
• Claude Desktop connectors under Enforce: Claude.ai connectors used from Claude Code inside Claude Desktop (including the Runlayer connector) are now recognized as connectors instead of being blocked as unknown built-in MCP servers, and are audited under the connector’s display name. Claude Desktop’s ccd_turn plan and wrap-up server joins the Claude Code safe defaults. See Enforce policy.
• Catalog toolbar: The sort dropdown shows a hover state in dark mode, and the search field now matches the height of the filter buttons beside it.
• Tooltips: Tooltips fade and scale in place instead of sliding in, and fade out when they close, so moving between buttons feels smooth.
• Cursor Auto spend: When Cursor names the model Auto picked for a turn, Spend now prices that turn at the model’s rate instead of listing it as Cursor Auto with no cost. Turns where Cursor doesn’t name the model still show as Cursor Auto.
• Claude Code org-library plugins under Enforce: Plugins your Claude organization pushes to members’ Claude Code, including the Runlayer plugin, are now recognized, so their tools run under Enforce instead of being blocked as unregistered MCP servers. Detect also inventories these plugins and their MCP servers. See Enforce policy.
• Agent runs stuck on a failing tool call stop early: When an agent makes the same tool call with the same arguments and it fails five times in a row, the run now stops with an error naming the tool and its last error, instead of retrying until the runtime limit hours later and running up model cost.
• Agent schedules: when a schedule stays off because its agent is still an unpublished draft, the Runlayer MCP create_agent_schedule and update_agent_schedule tools now say how to publish the agent and turn the schedule on, instead of returning a bare draft_disabled_by_gate flag.
• Apps: App owners can update their app’s page again; publishing a new page no longer fails with “Access denied”.

• Kubernetes Deploy enable_db auth: Docs cover how MCP pods reach ExtendDB today (SigV4 via env-injected keys + AWS_CA_BUNDLE on the default AWS SDK chain — do not combine with IRSA on the same MCP ServiceAccount in v1; GKE Workload Identity is fine) and the planned Kubernetes profile-scoped path (EXTENDDB_AWS_PROFILE selects the named profile; ECS/local stay on the default chain). See Deploy auth and Workload identity.
• Connector tool lists: A policy change in one workspace no longer refreshes cached connector tool lists in other workspaces, and policy changes in different workspaces no longer wait on each other.
• Sessions topic filter: For organizations on the Clio v1.0 session-topic model (session-topics-clio feature flag), the topic filter on the Sessions page now also lists the Clio topics (63 subtopics, for example Research and prepare for sales engagements) next to the existing ones, so sessions labelled with either topic set can be filtered by name; other organizations see the filter unchanged. See Sessions.
• Session compaction self-heals after upgrades: a session whose background compaction repeatedly failed used to stay parked until support reset it by hand. Each upgrade now retries parked sessions automatically (at most once a day, and up to three retries per session), so in most cases deploying a release that contains the fix is enough. A session that still fails after its three retries stays parked until support resets it.
• Session block setting: The “Session kill-switch” toggle in Security Scanners is now called “Block later tool calls when any scanner blocks”, and its description says what it does: later tool calls in the session are denied while the agent keeps running. Sessions whose only block is one nothing enforces (the toggle is off) now show “Flagged” instead of “Blocked”. See AgentGuard.
• Faster incident activity: The events and sessions of a security incident no longer load slower the longer the incident has been active. Through the API or the Runlayer MCP incident tools, a time range longer than 7 days now returns the 7 days ending at its end date. To cover a longer range, request it in 7-day steps. See Incidents.
• GPT-6.1 Terra for agents: OpenAI’s GPT-6.1 Terra is now in the agent model picker for OpenAI providers, with reasoning, image input and Spend pricing. See Agents.
• Waterfall view for agent runs: The agent run drawer now has a Timeline / Waterfall switch for everyone. Waterfall charts each tool call as a bar at its real offset from the run start, with subagent steps nested under their call, so slow steps stand out at a glance.
• Artifact auto-delete policies for every workspace: Admins with Manage Agents can now open Settings → Artifacts in any workspace to set a workspace-wide auto-delete rule and per-folder overrides (for example Keep forever for Reports). Idle artifacts are archived first and deleted 30 days later unless someone restores them; nothing changes until an admin saves a policy. See Archived artifacts.

• Artifacts: Publishing an artifact whose content holds an obvious API key, access token or private key is now refused, so an agent can’t accidentally share one through an artifact link. The agent is told to redact it and publish again.
• Rate-limit policies: Admins can cap how often tool calls run on a connector, such as 100 calls per hour per user or 30 calls per minute per session. Pick Rate limit as the policy’s action or start from one of the two rate-limit templates; the policy list shows each limit as a badge, and calls over the limit are refused and appear in the audit log as Tool Call Rate Limited.
• Deactivated users on managed devices: When an admin deactivates a user, AI Watch hooks on that user’s MDM-managed devices now block tool calls in Protect and Enforce instead of letting them through (Claude Code’s interactive AskUserQuestion prompt stays allowed, as it is for stopped sessions); Monitor keeps recording them. Devices Runlayer can’t match to a user now get the organization’s Enforce tool-type blocklist.
• Org-scoped install and connector metrics: The plugin and skill install cards on the Metrics page and a connector’s most-active-users list now count only your organization’s activity. The active-users list also rejects date ranges older than 90 days, like the other audit-backed metrics, and no longer comes back short when agents are among a connector’s busiest callers.

• Approved tool calls after a handoff: After you approve a blocked tool call, the agent now retries that exact call instead of asking for approval again when the call’s arguments are long, such as a detailed handoff to another agent.
• Approvals in agent chats: Approving a blocked Runlayer action, such as creating an agent schedule, in the agent chat now finishes it. Before, the run that resumed after your approval could no longer reach the approved tool.
• Agents that hand off work can check other agents’ runs: With “Can hand work to other agents” on, an agent can now list the recent runs of the agents you can see, so it can report a run’s status and result instead of saying it can’t see the history. See Agents.
• Custom PII rules in Terraform: Custom PII rules created in the app no longer make every plan show an update when your Terraform config doesn’t set pii_custom_rules. Needs the next Terraform provider release. See Terraform Provider.
• Connector tags on create: Tags sent when creating a connector through the API or Terraform are now saved. Before, they were dropped until the next update.
• Back to app from an artifact: Back to app on an artifact’s page now returns to the page you opened it from, such as the agent, instead of always landing in the Artifacts list.

• Connector badges: Connector cards show fewer, quieter badges: small gray icons for hosting (Local, Remote, Runlayer Deploy) and interactive tools, plus a Beta chip. The Official badge is replaced by a Third-party icon that marks connectors not built by the service’s vendor. The Secure badge was based on catalog metadata, not a security scan result; it has been removed.
• Hosting filter: On the Connectors page, filter connectors by hosting type: Local, Remote, or Runlayer Deploy.

• Cookie masking in approvals: Approval requests in the web app, Slack, and Microsoft Teams now apply the same cookie masking to every cookie field, including names such as auth_cookie and session_cookie.
• Federated agent accounts: Agent accounts that sign in through an identity provider now always enforce server scoping, so their tokens only work on the servers they were issued for. The setting shows as on and locked for these accounts, and existing API keys on them are refused. The keys are not revoked: if an account is later unbound from its identity provider and an admin turns the setting off, its old keys work again, so revoke any you no longer need.
• Connector URL redirects: Runlayer now follows a connector’s redirects only within the server’s own origin. A connector whose URL redirects to another host (for example apex → www., or a different domain), to another port, or from https:// down to http:// reports that address at connect time instead of following it; a same-host http:// → https:// upgrade is still followed. Enter the final URL as the connector URL. See Connectors.
• MCP request size: Requests sent to Runlayer’s MCP endpoints with a body larger than 36 MiB are rejected with HTTP 413. The limit is sized so a full 25 MB artifact upload through create_artifact / update_artifact still fits.
• Local stdio servers: Runlayer no longer starts a local stdio server on its own servers when it’s called through the proxy URL. Local servers run only on your machine through the Runlayer CLI.
• Stop blocks skill access: Stopping a session now also blocks skill reads through a skill’s MCP endpoint that carry the stopped session’s ID. See Sessions.

• Connector sign-in from AI clients: After you sign in to a connector mid-conversation, your AI client is told the connector is connected instead of getting an error or another sign-in prompt.
• Plugin, skill and agent lists: Filters such as Editable by me and Full access no longer miss items or include items based on outdated settings right after a workspace’s access settings are first set up or upgraded. After this upgrade, each workspace’s filters use the previous access check until the next background sweep reaches the workspace and recomputes its access. A list can still trail an access change by a few seconds while it is recomputed.
• Sharing lists: the “Editable by me” and “Full access” filters no longer show a plugin, skill or agent to its former creator once ownership moves to someone else. Items a team owns now follow changes to the team’s owners, and leave the lists when the team or the item is deleted, without waiting for an unrelated change.
• Skill access through plugins and agents: linking or unlinking a skill on a shared plugin or agent with the Runlayer MCP tools now updates who can use that skill, as the web app already did. People the plugin or agent is shared with can use newly linked skills and lose use of unlinked ones. Skill access inherited through earlier unlinks of this kind stays in place for now, and skills linked this way before this release are still not shared with those people; a later release reconciles both.
• Connector tools right after sign-in: If your AI client still shows a connector’s sign-in tool after you sign in, calling it now lists the connector’s tools and, for a day, runs its read-only tools for you, so you don’t have to restart the conversation first.
• Connectors page loading: On large screens, the next connectors now load in place inside the grid instead of under a separate block of loading cards, and cards fade in smoothly as they arrive.
• Agent tool calls with structured inputs: Agents now call connector tools whose inputs include nested objects, such as previewing an artifact in chat, instead of failing with “must be object”.
• Scheduled agents: A schedule no longer fires twice for the same run when many schedules are due at once.
• Artifacts that save edits in the browser: Artifact pages can’t keep data in your browser. When a page tries to, it now shows a notice that edits won’t be saved, instead of failing silently and losing your changes on reload. Agents are also told to build an app when a page needs to save input.

• Owned by me tabs: The personal tab on the Agents, Skills, Plugins and Artifacts pages is now called Owned by me and lists the items you own. See Agents.
• Delete a connector from its page: Admins can now delete a connector from the ⋯ menu on its connector page, not only from Manage connectors. The confirmation makes clear it removes the connector for everyone in your organization. See Connectors.
• Agent triggers in Terraform: The next Terraform provider release adds runlayer_agent_trigger, so you can manage an agent’s event and poll triggers as code. It needs agent triggers turned on for your organization. Changing trigger_type, event_key or account_id replaces the trigger. See Terraform Provider.

• MCP resource templates: Clients can now list a connector’s resource templates (resources/templates/list) through Runlayer. Previously the gateway answered “Method not found”, so templates from upstream servers never reached the client.
• Agent schedules: scheduled agents no longer run in a workspace where Agents is turned off. They pick up again on their next scheduled time once Agents is back on.

• Change owner on agents moved before early September: Some agents transferred to a new owner in early September kept showing the previous owner in the share dialog, and picking the real owner in Change owner failed with “New owner is already the owner”. That transfer now goes through and fixes the owner shown everywhere.
• Add connectors: Click a connector’s name or icon in the Add connectors picker to select it, not just the small checkbox.

• Claude setup says who gets the connector: The Claude step in Add to Client now says that a connector a Claude Team or Enterprise owner adds is available to everyone in the Claude organization, and that each member still signs in with their own Runlayer access.

• Detach skills from their source: A skill’s owner and skill admins can now detach a skill published with runlayer skills push from its source repository and edit it in Runlayer. Editors it’s shared with can detach it once its owner is deactivated, so a skill whose publisher left isn’t stuck. Files, version history and sharing are kept. Later pushes from the repository no longer update it, automatic updates from its source are turned off, and pushing a skill with the same name fails until one of them is renamed.

• ToolGuard tool-removal recommendations: The tool-removal model was retrained so recommendations are scoped to the tools your deployment actually sends and are proportionate to each agent’s tool set, instead of occasionally suggesting removing every tool. Agents that previously received no recommendations may now receive some. Topic classification and SkillGuard scans also complete more reliably under heavy load. See ToolGuard model versions.

• PDF artifact previews: PDFs now preview inline reliably, including in browsers that cached the affected preview worker.

• Emoji agent faces in Slack: An agent whose face is an emoji now shows that emoji as its Slack app icon, instead of the Runlayer logo.
• Agent access hints: When you can’t add a trigger, scheduled task or connector to a shared agent, the tooltip now says what access you have and who to ask for Can edit.
• Shared environment variables: Hover the info icon next to Shared on a hosted connector’s environment variables to see what it means: checked, everyone uses the value you enter; unchecked, each user enters their own when they connect.
• Compliance imports: Settings → Agent session monitoring now says a Claude or ChatGPT compliance import covers every user in the connected organization or workspace, including people who never signed in to Runlayer. See Who a compliance import covers.
• Delete disabled agents in bulk: On the Agents Inventory tab, select agents and choose Delete to remove the disabled ones in one go, with their schedules, webhooks and any Slack app. Agents that are still enabled are left alone; disable them first. See Agents.
• Spreadsheet previews: Excel workbooks (.xlsx) now open as a read-only spreadsheet in the artifact viewer, with a tab for each sheet and the workbook’s number formats, colors, and merged cells, so you can read an agent’s spreadsheet without downloading it. See Manage artifacts.
• Setup checklist: Admins can now skip every remaining step in the setup checklist at once, instead of one by one.
• Chrome extension installed by your policy (macOS): With this option on, the AI Watch browser extension settings now show the Runlayer extension ID, your organization’s update URL and the ExtensionSettings entry, ready to copy into your Chrome policy. Google Admin’s force install works as is; only a computer-level MDM Chrome profile needs the ExtensionSettings entry instead of the forcelist. See Browser extension.

• Stop shows its effect: before you stop a session, the Stop dialog in the Sessions drawer now says what Stop will do for that session’s client, such as blocking every next tool call or that the client can’t be stopped. After you stop it, the dialog shows the first tool call the stop blocked, and the stop’s audit event records what was promised. See Sessions.

• Agent connector OAuth reconnect: Fixed a bug where a shared connector grant from another user could mask your own expired OAuth session, hiding the reconnect prompt you needed.
• Search boxes: Search boxes on the Agents, Skills, Plugins, Teams, Connectors and Manage pages respond faster while you type; the page no longer reloads its results on every letter.
• Agent reliability: A refused AI request no longer causes an unrelated agent run sharing its connection to fail with a request-parsing error.
• AI Watch: Device heartbeat contention no longer blocks otherwise permitted enforcement requests.
• Usage spend cards: Spend, Spend per day and Cost per session now show a rising trend in red and a falling trend in green, so higher spend no longer reads as good news.
• Node.js security update: The backend image now runs Node.js 24.22.1 (the web app is also built with it), which includes the October 2026 Node.js security fixes for Brotli decompression, TLS hostname checks, HTTP, DNS, and the bundled OpenSSL, c-ares, and undici. Stdio connectors that run through npx use this Node.js version.
• Agents hand over the files they make: When you ask an agent for a deck, document, spreadsheet or PDF, it now publishes the finished file to Artifacts and replies with the link, instead of saying it has no way to share it.
• Connect from Missing auth: After you connect your account from a connector’s Missing auth banner, the page now shows the connector as connected right away instead of needing a refresh.
• Slack agents: When Slack’s API is slow, agent threads no longer collect duplicate or empty progress cards.
• Sessions search: the search box no longer jumps down the page when a search finds no sessions. See Sessions.
• HTML artifact encoding: Previews of non-UTF-8 HTML artifacts (Windows-1252, Shift_JIS, and similar) no longer render as mojibake. The viewer sniffs <meta charset> / BOM like a browser before decoding.
• ChatGPT and Claude web sessions: tool calls captured by the browser extension now show in the order they ran. A tool’s result no longer appears above the call that produced it.

• Artifact search in Launcher: Find accessible artifacts by title or filename from the Launcher, open them directly, and return to recently opened files.
• Install the AI Watch Chrome extension from your own policy (macOS): If you already manage Chrome extensions in Google Admin, Chrome Enterprise Core, or your MDM, turn on Chrome extension installed by your policy in the AI Watch browser extension settings and add the Runlayer entry to your Chrome policy. Chrome takes each extension policy from a single source, so the force-install AI Watch writes could hide yours and remove extensions such as Okta, signing users out. With this on, AI Watch writes no Chrome policy and the device health check confirms your policy installed the extension. See Browser extension.

• Agent run cancels in the audit log: Stopping a running agent, from the API, the web app or Slack, now writes an audit log entry that names who stopped it and whether its sandbox stopped.
• Stop ends Runlayer Agents runs: Stopping a session now also cancels the Runlayer Agents runs running in it, including runs you don’t own. Stop says “Terminated” only once the agent’s runtime confirms; if the runtime keeps going, the session’s tool calls stay blocked.
• Evaluation replay isolation: Evaluation replays stay inside your organization. A replay can no longer list or call a connector that belongs to another organization.

• MDM setup sync ownership: When runlayer setup sync runs as root (MDM Custom Script), client MCP configs and backups are re-owned to the console user instead of left root-owned. Root writes also resolve the console user’s home and stay link-safe, so MDM scripts with HOME=/var/root don’t miss or corrupt configs.
• MDM enrollment username: runlayer credentials enroll without --username now uses the MDM-managed Username (com.runlayer.cli or com.runlayer.aiwatch) before falling back to the OS user.
• macOS MDM connector sync: The Iru/Jamf/Mosyle/SimpleMDM sync script now drops uid with sudo -u, skips cleanly at the login window, and can take enrollment username from the managed Username preference. See Iru/Kandji Deployment.
• Connector catalog search: Typing in the Add connector and Connectors → Discover search boxes no longer lags; each letter shows up right away instead of after a pause.
• Agent triggers: On a shared agent, triggers someone else created no longer show as “Disconnected”. The card now says whose account the trigger watches.
• Skills search: Typing in the Skills search box no longer lags on long skill lists; each letter shows up right away.
• Manage connectors search: Typing in the Manage connectors search box no longer lags on large connector tables; each letter shows up right away.
• My connectors search: Typing in the Connectors search box no longer lags on long connector lists; each letter shows up right away.
• Connector permissions: Searching the tool list when adding or editing connector permissions no longer lags on connectors with many tools; each letter shows up right away.
• Plugin tools search: Searching a connector’s tools on a plugin page no longer lags on connectors with many tools; each letter shows up right away.
• Renamed connector tools on agents: When a connector stops offering a tool an agent was set up to use (for example after the vendor renames it), the connector’s settings on the agent now name the missing tools so you can pick the replacements. Before, they disappeared from the picker without a trace and runs stopped getting them. See Agents.
• Agent triggers: On a shared agent, duplicating a trigger someone else created now asks for your own account instead of failing with “Account not found”. Editors also see a note that triggers only watch the accounts of the people who created them.
• HTML artifact links: Table of contents entries, footnotes, and “back to top” links inside HTML artifacts now scroll to their targets on iPad Safari (and in auto-height embeds).
• Secret store references in hosted env: a secretref:// value in a hosted stdio connector’s env or in Runlayer Deploy env is now rejected with the key name, instead of reaching the server as the literal string. References resolve in remote connector headers; for hosted servers, read the secret with AWS cross-account roles. See Secret Stores.
• Connector tool lists: Connectors whose server returns its tools in pages, such as Atlassian, now show every tool. Previously only the first page appeared, and which tools appeared could change from one refresh to the next.
• AI Watch inventory: Fixed inventory failures during concurrent skill or plugin submissions.

​

Artifact notifications

• Auto-sync API: Read, set, or remove one connector, plugin, or skill’s device auto-sync setting by its type and ID, with an idempotent PUT.
• v1 API deprecation header: API-key calls to v1 endpoints the Runlayer web app uses now return a Deprecation response header, so you can find scripts that depend on them. v1 is unsupported for API-key automation, and a supported v2 API is coming.
• Artifact comment notifications: When someone mentions you, replies to your comment, or comments on an artifact you own, you’ll now get a Slack (or Teams) message from the Runlayer assistant linking straight to the artifact.

• Jira agent trigger: The “New Jira issue” trigger works again on the older Atlassian connector (v1), and a blank site ID is now looked up instead of failing the poll. See Agents.
• Slack files in agent threads: when you ask an agent about a text or code file (.csv, .md, .txt, .json) posted earlier in the same Slack thread, including one the agent posted itself, the agent now reads it instead of acting as if it isn’t there. Files over 500 KB are reported as skipped. See Files an agent can read from Slack.
• Certificate validation: TLS connections now reject certificate chains containing intermediate CA keys distrusted by Go’s security update for CVE-2026-111943.
• Tunnel setup is harder to get wrong: After you create a tunnel connection, a callout above the docker run command now tells you to replace each CHANGE-ME.internal with the private host the connector should forward that port to. The Ports field explains that each port is mapped to a host in that command, and the dialog notes the command is for bash, with the PowerShell change to make. See Connectors.
• Azure AI Foundry and OpenAI-compatible agents no longer fail on long runs: GPT-5 deployments on these providers could fail mid-run with “max_tokens or model output limit was reached” once a run grew past about 28k tokens, because the output limit sent to the model shrank toward zero. Runs now use the model’s real context window, and an output limit set in the agent’s OpenAI-compatible options (max_completion_tokens or max_tokens) is honored.

​

Sharing API and MCP session stops

• Sharing API: Read, set, or remove one principal’s access to an agent, skill, or plugin with a single idempotent call keyed by principal.
• PrivateLink connections: Runlayer Deploy connectors can use more than four PrivateLink connections alongside up to four tunnels. Connections that fit the four attachment slots retain shared access; additional PrivateLink connections use AWS rule capacity shared across deployments. See ECS networking.
• Agent tool suggestions: Tool-removal suggestions now wait until an agent has a prompt. Without one the model has nothing agent-specific to go on and could suggest removing nearly every tool on agents with many connectors; saving a prompt triggers the suggestions as before.
• Sessions keep up under load: Session storage compaction now runs in its own service on ECS deployments, so heavy compaction no longer slows down or interrupts new session activity showing up in Sessions.
• Agent run reviews: Switch between Auto-review and Your review tabs in the run drawer. Draft notes stay intact when switching tabs.
• Team members and group bindings in Terraform: Terraform provider 1.8.1 adds runlayer_team_member and runlayer_team_group_binding, so you can manage who is on a team, with their role, and which directory groups are bound to it as code. Applying either one adopts a membership or binding that already exists. See Terraform Provider.

• Session stop from the Runlayer MCP: Agents and automation such as SOAR playbooks can now stop a session and clear the stop with the stop_session and clear_session_stop tools. They need the same permission as stopping through the API and a reason, and the audit log shows whether a stop or clear came from the API or the MCP. Stopping now needs a session Runlayer has recorded, through the API too: an unknown session id is refused instead of creating a stop that nothing will ever use. An organization can have up to 1,000 stopped sessions at a time. See Runlayer MCP.

• Jira agent trigger: The “New Jira issue” connector trigger now works when it’s set up from the trigger form. It used to fail every poll because Atlassian’s MCP server needs a site ID the form never asked for. Runlayer now looks the site up when your Atlassian account has one, and reads the issues Atlassian returns correctly. Atlassian accounts that reach several sites aren’t supported yet, and the trigger’s activity says so. See Agents.
• Cloning agents: a cloned agent now runs on the same runtime as the agent it was copied from. Cloning an agent that runs on OpenCode no longer gives you a copy that runs on Pi. See Cloning an agent.
• Terraform detection resources on older self-hosted releases: With the Detections feature on, Terraform provider 1.8.1 could report the feature as off on some older self-hosted releases, so creating runlayer_detection_rule_setting or runlayer_detection_outbound_entry failed. Provider 1.8.2 fixes this. See Terraform Provider.

​

Session layer tags and bulk artifact delete

• Bulk delete artifacts: Select several artifacts in the Artifacts library and delete them in one step, instead of opening each one. See Manage artifacts.
• Capture layer tags in Sessions: When a session was recorded by more than one layer, each prompt, response and tool card in the conversation now shows which layer captured it (Agent runtime, LLM gateway or Client hook), so a turn that appears twice explains itself.
• Build commit in Settings: Settings → General now shows the exact commit next to the version, with a copy button, so support can match what you’re running.
• Session materializer on Kubernetes: The Runlayer operator now runs session compaction in its own Deployment next to ingest, so a heavy session no longer stalls ingest, and Kinesis installs can scale both past one replica. See Runlayer operator.

• Agents search: Typing in the Agents search box no longer lags on long agent lists; each letter shows up right away.
• MCP connector connection test: Adding a connector no longer fails for MCP servers that don’t implement ping, such as Bitly.

​

Eval replay and dictation app detection

• Agent accounts: Admins can add an OAuth connector to an agent account without connecting it with their own account. Each user then grants the agent access with their own credentials. See Agent accounts.
• Replay recorded tool results in agent evals: A new Replay recorded results option under Tool mocking gives a replayed call the original run’s recorded result when the call matches one the original run made, so every replay sees the same data. Other calls are still simulated, and replays stay side-effect free. See Agent Evals.
• AI Watch Detect: Detect now inventories AI dictation apps, the tools that turn speech into text in any application and read the surrounding on-screen text for context: Wispr Flow, Superwhisper, MacWhisper, Aqua Voice, Typeless, Monologue, VoiceInk, Whispering and Spokenly. They appear as presence-only clients in Shadow AI from their app bundle, uninstall entry, install path, Store package or per-user state directory; Detect never reads audio, transcripts or dictated text. See Detect.
• Agent adoption milestones: agent owners get a Slack DM celebrating their agent when it reaches 3, 5, 10, 25 (and onward) people using it besides them, with a different message at each milestone.
• Run reviews save as you go: In the run drawer, your Pass or Fail, note and expected output now save on their own a moment after you click or stop typing, and when you close the drawer. There is no Save button, and a “Saved” mark shows when your review is stored. See Agents.
• Offline eval run picker: Picking runs for an offline eval is faster. Search and filter runs by status, start date, or topic, shift-click to select a range, or start from a quick pick such as recent failures or a spread across topics. You can also describe the runs you want and click Ask AI to get matching runs, each with a reason. See Offline evals.

• Detections and smart rules in Terraform: Terraform provider 1.8.1 adds runlayer_detection_rule_setting, runlayer_detection_outbound_entry, runlayer_smart_rule and runlayer_smart_rule_test_case, so you can manage detection rule settings, the Outbound list, smart rules and their test cases as code. The detection resources need the Detections feature on your organization and the smart rule resources need the Smart rules feature. Self-hosted deployments need backend 1.28.1238 or later for runlayer_detection_rule_setting, 1.28.1227 or later for runlayer_detection_outbound_entry, and 1.28.1236 or later for the smart rule resources. See Terraform Provider.

• Session block status: Newly recorded sessions now include violation-only scanner findings in outcomes across Sessions, shared views, Slack, and the Runlayer MCP, and show the same Blocked or Block bypassed status in session lists, session details, and each tool call.
• Audit log organization actors: The audit log now shows actions performed by your organization as “Organization” instead of “Org API Key”.
• Plugins search: Typing in the Plugins search box no longer lags on long plugin lists; each letter shows up right away.
• Turned-off agents: Chat on a turned-off agent now says the agent is turned off and how to turn it back on, instead of failing with “Agent is unavailable”. The On/Off switch and its messages no longer say you can still chat with a turned-off agent. See Agents.
• Agents created before an AI provider: Agents saved while your workspace had no AI provider now switch to the first provider you add that serves their model, instead of failing every run with “Model credentials are not configured”. See LLM providers.
• AI Watch Jamf setup: Step 3 of the macOS MDM wizard now leads with the signed .pkg, the only file you deploy after the profile, and marks the MDM deployment bundle as optional. The Jamf guide also lists the Jamf Pro package and policy steps. See Jamf Pro.
• Offline evals: The Run offline eval dialog no longer lets you pick runs hidden from you by workspace redaction, so starting an eval no longer fails with “Unredact run before evaluating”. If you can view hidden content, unredact a run right from the picker to include it. See Offline evals.

​

Recorder detection and GitHub agent access

• Release version numbers: Customer releases now carry their own semantic version, starting at 1.29.0, with one number per release you receive: a new major for breaking changes, a new minor for new features, a new patch for fixes only. Earlier releases keep their old numbers, which counted internal builds.
• AI Watch Detect: Detect now inventories AI meeting recorders and ambient notetakers, the apps whose product is recording the user’s meetings, screen or conversations: Granola, Otter, Fathom, Fireflies, tl;dv, Read AI, Circleback, Plaud, Jamie, Cluely, Interview Coder, Final Round AI, Screenpipe, Rewind, Limitless, Run It Back, LUCI and Alter. They appear as presence-only clients in Shadow AI from their app bundle, uninstall entry, install path or per-user state directory; Detect never reads recordings, transcripts or notes. Apps where recording is one feature among many (Notion, Grammarly, Krisp, Zoom) are not reported on presence alone. See Detect.
• ExtendDB sizing and upgrade guidance: self-hosted Kubernetes operators enabling ExtendDB now get Postgres connection-budget sizing guidance and an image-bump/recovery runbook. See External dependencies and Runlayer Operator.
• GitHub access for agents: Workspace admins can connect a GitHub App and grant agents access to selected repositories with short-lived tokens. See GitHub access.
• Agent monitoring: Removed the separate Goal achieved tile. Workspaces with Agent Insights can review goal outcomes and failure reasons there.

• ExtendDB network isolation: self-hosted deployments now get an ingress NetworkPolicy that scopes ExtendDB to only the linked MCP namespace, and can override its init/reset Jobs’ helper container images (kubectl, Postgres client, AWS CLI) through the RunlayerInstance CR instead of waiting on an operator release.
• Teams: Members can no longer remove themselves from a team; a team owner or a workspace admin removes them. This closes a gap where leaving a team also dropped the member out of an AI Watch policy that targeted it. See Teams.

• Session search: sessions that were missing from search results, or whose indexed text was stale, are now repaired automatically from the session archive within the next coverage sweep, so a transient indexing hiccup no longer leaves a session unsearchable.

​

Computer-use detection and session stop

• ExtendDB init recovery + Postgres-aware Ready (Preview): A one-shot automatic reset recovers from partial extenddb init failures without manual DB drops. Readiness now periodically verifies catalog/data Postgres (cached ~5 minutes) so enable_db is not accepted on a dead data plane. (ENG-7247, #15608)
• App links: every app now has its own link that opens it full window, without the Runlayer frame, plus a separate manage link that opens its Admin view. On an app’s page, Go to published app replaces Download.
• AI Watch Detect: Detect now reports what an installed AI client can do, not just that it is installed. Each client’s Shadow AI detail gains Capabilities chips backed by on-disk evidence: Computer use when ChatGPT Desktop has its Computer Use plugin enabled or Cursor’s self-hosted computer-use worker is installed, and Messaging channel when Claude Code has a Telegram, Discord or iMessage channel configured. Chips are re-evaluated every scan and clear when the feature is turned off; devices still on an older AI Watch leave them unchanged. Google’s native Gemini desktop app is now inventoried as a client. See Detect.
• Connect missing apps from agent chat: When an agent needs an app it doesn’t have, it now offers a connector card you can approve right in the conversation, instead of sending you to the agent’s settings.
• Faster AI Watch fleet check-ins: Device check-ins, inventory reports and scans no longer write to the shared MDM configuration record, so large fleets reporting through one configuration no longer queue on the shared MDM configuration row. The configuration card’s “Last connected” label and status badge are gone; device liveness is the “Devices seen in last 24 hours” count, which reads per-device heartbeats. The “Turn on Shadow AI detection” onboarding step was removed. See Shadow AI.
• AI Watch Detect: Detect now inventories computer-use desktop agents, the apps that let a cloud or local model watch the screen and drive the keyboard and mouse: Manus (Manus Studio’s “My Computer” mode), UI-TARS Desktop, Highlight, Agent! (AgentiLoop), Fazm, Peekaboo and the rabbit OS3 agent. They appear as presence-only clients in Shadow AI from their app bundle, Store package, install path or per-user state directory; Detect does not read their screenshots, recordings or sessions. See Detect.
• AI Watch Detect: Detect now inventories the pip- and npm-installed computer-use tools Browser Use, Skyvern, Cua (cua-driver), Agent S and OpenAdapt as presence-only clients, from their package metadata, command-line binaries and per-user state directories. Projects that embed Browser Use as a library are also classified as agent definitions. See Detect.
• Similar agent hint: While you describe a new agent, Runlayer points to an agent you can already use that does the same job, with options to use it, duplicate and edit it, or create yours anyway. See Set up an agent.

• Agent run credentials end with the run: The token an agent run uses to call connectors, whether delegated from its creator or the agent’s own, is now revoked the moment the run finishes, instead of staying valid until it expires.
• Agent run streaming respects redaction: Resuming an agent run’s live stream, or retrying it, now follows the same workspace redaction rules as the run detail page. Viewers of another user’s run must hold the unredact permission and confirm before the content is replayed, and a live replay stops when that confirmation lapses.
• Scoped agent tokens stay on their servers: An agent or on-behalf-of token scoped to specific servers or plugins (requested with resource) is now rejected with 403 invalid_target on any other server, for every agent account, not only those with Enforce server scoping on. Exchanging a scoped agent token for an on-behalf-of token now requires a resource inside the agent token’s scope (400 invalid_target otherwise). Tokens requested without resource are unaffected. Self-hosted operators can turn this off with FF_DISABLE=agent-token-audience-enforcement (deployments still on WorkOS feature flags turn it on with FF_ENABLE=agent-token-audience-enforcement). See Agent Accounts.
• Stop a session from Sessions: Security, IT and Super Admins can now stop a live agent session and resume it from the session drawer on the Sessions page, or with Shift+K while the session is open, with a required reason. A stopped session shows a Stopped badge in the session list, and its drawer shows who stopped it, when and why. See Sessions.

• Sign-in error page: If Runlayer can’t load your account while you’re signed in, the “Authentication Failed” page now stays on screen with a Sign Out button. Before, it reloaded over and over.
• Agent connection recovery: Agents detect silent event-connection failures and reconnect so status updates can resume.
• GPT models on OpenAI-compatible gateways: Agents bound to an OpenAI-compatible gateway provider now run on GPT-5, GPT-6 and o-series models instead of failing before their first token with “‘max_tokens’ is not supported with this model”. Other gateway models keep working as before. See AI Providers.
• Slack agent names: Agents with their own Slack app now show clean @mention names. Apostrophes, accents and underscores no longer turn into _ (for example, “Rafal’s Intern” shows as @Rafals Intern, not @Rafal_s Intern).
• Apps admin panel: Reviewing a pending app version with long code lines no longer pushes the whole page sideways; long lines now scroll inside their own block.
• Runlayer connector tool list: AI clients connected to the Runlayer connector no longer see tools for features your workspace doesn’t have enabled, so agents stop picking tools that can only fail.
• Artifacts in agent chat: An artifact an agent shares by its custom link name (like /artifacts/kpi-dashboard) now shows in the chat under the answer, the same as a link by ID.
• Handoffs to disabled agents: An agent that tries to hand work to an agent you’ve disabled is now told right away, instead of asking you to approve a handoff that then fails. See Agents.
• Runlayer Assistant without an agent runtime: On self-hosted deployments that have no agent runtime, Runlayer Assistant now says so before you send a message instead of failing afterwards, and links admins to the setup steps. See Troubleshooting.
• Agent webhook input errors: When a webhook call sends an input field that isn’t a non-empty string, the 400 now says what type arrived and that you can leave input out to send the whole JSON body to the agent. See Agents.
• Clearer message in unapproved Slack channels: When an agent is restricted to approved channels and someone mentions it elsewhere, it now explains that the channel isn’t on its approved list and links the agent so the owner can add it, instead of a bare “not enabled in this channel”. See Outbound messaging controls.
• Session search indexing: Session search catches up faster after a stream is resharded or the indexer restarts; a backlog on one shard no longer waits behind idle shards.
• ChatGPT web sessions: A new ChatGPT conversation, for example one that generates images, no longer shows up as two sessions in Sessions.
• Browser extension claude.ai capture: Chats on claude.ai are recorded in Sessions again, after claude.ai began compressing prompt requests.

• Microsoft 365 (Work IQ): Connect Microsoft’s unified Work IQ endpoint for mail, calendar, files, Teams, people, and Microsoft 365 Copilot, with no environment ID. See Microsoft Agent 365.

​

Slack stop button and ADK telemetry

• Stop agents from Slack: Agents with their own Slack app now show Slack’s stop button while they work. Anyone who can use the agent can click it to stop every reply in progress in that thread.
• Google ADK session telemetry: Python agents can register a native plugin to capture prompts, assistant responses, and tool activity in one conversation, with local tool enforcement and correlation to Runlayer MCP audits. See Hooks SDK.
• Connector search: Searching in Manage connectors now highlights what matched. Connectors that matched only on their description show the matching part of the description under the name.
• You first in user filters: When you filter Sessions, Incidents, Audit Logs, and other lists by user, you’re now listed first, marked “(you)”, so you can narrow to your own activity without searching for yourself.

• Runlayer Deploy connector OAuth settings: A Runlayer Deploy connector’s Settings tab shows its OAuth settings again while the connector is in Draft, when any are saved, or when it needs a pre-registered client. You can enter a Client ID and Secret before the first deploy and clear stale OAuth Scopes. See Deploy OAuth.
• MCP client sign-in with Entra SAML: Connecting an MCP client (such as Slack’s) while signed out of Runlayer no longer fails at Microsoft Entra with “Requested query string is too long”. You no longer need to sign into Runlayer first.
• Agent tool failures: Agents now detect unresolved write failures inside code mode on the default runner, even when the script catches the error. See Platform Agents.
• Browser extension downloads: Chrome on macOS and Windows rejected the downloaded .crx with CRX_REQUIRED_PROOF_MISSING. Settings → Client updates → Browser extension now offers an unpacked zip you install with Load unpacked in Developer mode. See Browser extension.
• Agents on Claude 5.5 via Amazon Bedrock: Runlayer Assistant and agents running Claude Opus 5.5 or Sonnet 5.5 on Amazon Bedrock no longer fail with “Invalid signature in thinking block” after they load tools partway through a run.

​

Supported clients and card detection

• Supported clients for AI Watch: The “View supported clients” dialog under Manage → Endpoints now lists every client AI Watch hooks can protect and enforce, with each client’s minimum version and whether it blocks before the tool runs only. The Enforce and Protect built-in policy pickers offer the same full client list. See Enforce supported clients.

• Token masking: 13-digit Visa cards are now caught in every common grouping (4-4-4-1, 4-6-3), and American Express cards in their printed 4-6-5 grouping. Spaced or dashed digit runs that fail the card checksum, such as reference numbers, are no longer blocked as card numbers.
• PII scanner accuracy: ToolGuard’s PII scanner now detects 13-digit Visa cards written with spaces or dashes, and American Express cards in their printed 4-6-5 grouping.
• Slack search triggers: Upgrading no longer runs the agent once for every message an existing “New Slack message (search)” trigger had already seen.
• Tool activity on split-tunnel VPNs: When your IP allowlist blocks one of a device’s network paths to Runlayer, AI Watch in Monitor mode now keeps the tool activity it could not send and delivers it once a working path is found, instead of dropping it from the session.
• Agent Slack app not installed: When an agent’s Slack app has been created but isn’t installed in your Slack workspace, for example while a Slack admin still has to approve it, the agent page now says so under the Slack switch instead of just showing Slack as off. Turning Slack on finishes the install. See Agents.
• Windows one-command installer: Re-running the hosted install.ps1 on a device that already has the selected AI Watch or CLI version now repairs the install and re-applies the host and organization key instead of failing with Windows Installer exit code 1603. The script also writes a verbose Windows Installer log to %TEMP% and quotes the first error on failure. See Test Device.
• Connector requests: Approve a new connector request with a connector you already built and shared. Existing connectors the requester can already use now show up as “Has access” and approve the request without adding another policy. See Inbox.

​

Detect agents inside IDEs

• AI Watch Detect: Detect now inventories the agents built into IDEs: the Claude and Codex agents Xcode 26.3+ runs from its own CodingAssistant folder, Visual Studio’s Copilot agent mode, JetBrains AI Assistant, Gemini in Android Studio, GitHub Copilot for Xcode and Eclipse, Firebender, Positron and PearAI. Their MCP servers were invisible before because none of them read the standalone Claude Code, Codex or VS Code config files. Codex for VS Code, CodeGPT, Qoder CN, Bito, Zencoder, Tabby, twinny, Verdent, Pieces and the Firebender JetBrains plugin are now recognized AI extensions. See Detect.

• Microsoft 365 connector setup: The deploy form for Microsoft 365 connectors now reminds you to grant admin consent in your Entra app registration before anyone connects. Without it, users who aren’t admins get a “Need admin approval” error at sign-in. See Microsoft 365.
• Agent session monitoring: Turning off Runlayer Agents or Full session scanning APIs under Settings → Agent session monitoring now stops agent runs from being recorded in Sessions, as documented. See Set up Sessions.
• Connector icons: Connectors added from the catalog before an icon refresh show their icons again instead of a broken image.
• Runlayer connector policies: Runlayer MCP tools now appear individually in the policy editor, so admins can allow or deny specific ones instead of only “All tools”.

​

Gateway spend tracking and session stop

• Artifacts in Runlayer Plugin: Agents using Runlayer Plugin can now publish, find, read, edit, and delete artifacts directly, without connecting the Runlayer MCP server separately. They can also delete skills and agents directly. See Runlayer Plugin.
• LLM Gateway spend: A new Settings → LLM Gateway → Spend tab lists every LLM call the gateway reported, with its cost, tokens, and charged usage rule, and totals spend by agent run, device, or model over a time range you choose. Calls the gateway could not price show as unpriced rather than $0.
• Idle connectors stay connected: Runlayer now renews an unused connector’s sign-in every few days, for up to 90 days without use. Users who come back after weeks away no longer have to reconnect connectors whose provider expires sign-ins that sit unused.
• AI Watch Detect: Detect now recognizes 22 open-source coding harnesses, including forks and re-wraps of Claude Code, Codex and Pi: Claw Code, Claurst, Free Code, Kode, jcode, Codebuff, Every Code, oh-my-pi, Oh My OpenAgent, ForgeCode, Nanocoder, Neovate Code, Groq Code CLI, Open Interpreter, Codewhale, Reasonix, Deep Agents Code, Prime Agent, gptme, Ante, Orca (echoVic) and mini-SWE-agent. Each is reported from its own install signals, and MCP servers in files a fork shares with Claude Code or Codex stay attributed to that host instead of being credited twice or laundered under the host’s name. See Detect.
• Upstream client identification: Runlayer now names the AI client behind each request in the User-Agent it sends to Streaming HTTP and SSE connectors, and identifies itself as Runlayer on their OAuth requests, with no support request needed. Connectors to servers that check which client is calling, or that reject OAuth requests without a User-Agent, now connect out of the box. See Client User-Agent.

• Connector approval intake: Workspace admins can direct employees to an external approval form with custom instructions. Keep native connector requests available alongside this guidance or disable native submissions to use the external process.
• Session stop: Security, IT and Super Admins can stop a live agent session through the API with a reason. Later MCP tool calls that carry that session’s id are denied until an admin clears the stop, and each stop, first denied call and clear is recorded in the audit log. A stop can take up to 5 seconds to apply everywhere, and it does not yet cover local Claude Code, Cursor or Codex hook tool calls.

• Agent account permissions: Developers editing an agent account’s connector permissions now see the connector’s tools to choose from, instead of “No tools available.” See Agent accounts.

• Looker and LaunchDarkly connectors: The Looker and LaunchDarkly MCP connectors are now generally available and no longer show a Beta badge.

​

Secret stores and agent eval scoring

• Longer policy descriptions: Policy descriptions now hold up to 3,945 characters, up from 255, from the dashboard, the API, and the Runlayer MCP tools. See Policies.
• Expected outputs for agent evals: When you review an agent run you can now save the answer it should have given. The new “Matches expected output” eval scorer grades replays of those runs against it, so a set of reviewed runs works as a small golden dataset for regression-testing prompt and model changes. See Agents.
• AI Watch organization default: The organization-wide AI Watch policy is now an editable default (Monitor with Sessions off until you change it) rather than a value computed from your deployments. Edit it with PATCH /ai-watch/policy-rules/{id}; the rule list now shows which deployments still differ from it. Devices keep receiving their own deployment’s settings until policy rules are enabled for your Runlayer deployment. See Policy rules.
• Unique skill names: Each skill name can be used once per workspace, matching the way devices install it (Code Review and code-review count as the same). Creating, renaming or publishing a skill with a taken name is blocked, and the Add skill dialog lets you pick a new name before you create it. Skills that already share a name get a Same name badge and a Rename prompt. See Skills.
• Multiple-choice chat cards: Agents can now ask you to pick several options at once, in the agent chat, Slack and Microsoft Teams.
• Change the model of many agents at once: On the Agents Inventory tab, select agents and choose Change model to move them all to a model you pick. This works for agents whose model has no newer version to upgrade to. Model settings the new model can’t use are dropped. See Agents.
• Deploy enable_db on Kubernetes (Preview): Self-hosted / operator Deploy can provision DynamoDB-compatible token storage via ExtendDB on the instance Postgres (opt-in components.extendDB). Preview: not yet recommended for production token storage. Requires botocore >= 1.31 / boto3 >= 1.28 (or JS v3 / Java 2 / Go v2) so AWS_ENDPOINT_URL_DYNAMODB injection works. See Deploy and runlayer-operator.
• AI Watch Detect: Detect now recognizes the second wave of vendor coding agents, whose default endpoints sit in China: Tencent CodeBuddy Code, iFlow CLI, Baidu Comate Zulu, MiniMax Code, Xiaomi MiMo Code, Z.ai ZCode, DeepCode CLI, Kimi Desktop and Chatbox have their MCP servers inventoried from their configs, and DeepSeek Harness and NextChat are reported when installed. See Detect.
• Sign-in & provisioning settings page: Single Sign-On, directory sync, external allowed emails, and permission attribute selectors now live together under Settings → Sign-in & provisioning instead of General. Directory sync shows its status and last run at a glance, with reconcile and connection tests in its menu. See SCIM Role Sync.
• Policy version history: Comparing policy versions now shows only the configuration changes between them.
• Slack Inbox Manager template: Create a Slack triage agent that groups messages by urgency and drafts replies for your review without sending them. Uses your workspace’s default AI model.
• Plugin-scoped tokens for strict-mode agent accounts: Strict-mode accounts can now scope an on-behalf-of token to a plugin. The token reaches the OAuth connectors inside the plugin that already have a session grant, and never outlives those grants. See Agent Accounts.
• Plugin device sync: Admins can now see and change whether a plugin syncs to managed devices from the plugin’s Share menu, including turning off sync that was enabled through the API. See Plugins.
• Central Grok Bot setup: On Cursor Enterprise, roll out Grok Bot monitoring to every member from the Cursor dashboard. Team Setup installs the hooks and Team Secrets supplies the key, so members don’t enter anything. See Central Grok Bot setup.
• Agent Monitor: Run and spending limits now appear on the Runs and Cost tiles, with a warning once an agent nears a limit that says when it frees up again. Each metric shows its trend, and clicking a tile opens its chart.
• Connectors: admins without the Developer role now see “Deploy an MCP server on Runlayer” in Create a connector, marked with the role it needs, instead of the option being hidden. Profile now lists your roles.

• Policies hold when tool details can’t be loaded: If Runlayer can’t load a tool’s details from the connector right before a call, the call is now stopped with an error. Before, a deny or approval rule based on tool annotations (for example, blocking destructive tools) could be skipped and the call ran anyway. See Policies.
• Secret stores: Keep connector credentials in your own AWS Secrets Manager and use secret references in connector headers and environment variables. Workspace admins can add, test, edit, and delete secret stores in Settings. See Secret Stores.
• Agent memory: Agents can no longer save a PGP private key into memory. Memory writes that contain one are refused, the same way SSH and other PEM private keys already were. See Agents.
• Custom PII rules: A custom PII rule whose pattern can match empty text (such as \d* or (secret)?) is now rejected on save with a message explaining the fix. Existing rules of this kind are skipped and flagged to admins instead of matching every request.
• Agent chat redaction: Workspace content redaction now also applies when you open another member’s live agent chat. See Agents.
• Disconnecting Runlayer Assistant stops its follow-ups: After you disconnect Runlayer Assistant, a follow-up it scheduled for itself no longer reconnects you and acts on your behalf. The follow-up fails instead. See Agents.
• Terraform-managed org scanner defaults: Terraform provider 1.6.0 adds a runlayer_security_scanner_settings resource that manages your organization’s security scanner defaults as code. Servers, clients and local tools inherit these defaults. Self-hosted deployments need backend 1.28.1220 or later. See Terraform Provider.
• Terraform-managed AI Watch list entries: Terraform provider 1.6.0 adds a runlayer_ai_watch_enforce_entry resource that manages each AI Watch Enforce allowlist or Protect denylist entry as code: a remote MCP URL, a stdio package or a built-in. Self-hosted deployments need backend 1.28.1171 or later. See Terraform Provider.
• Claude Code MCP servers under Enforce: When a server name is defined both for you in one project (local scope) and in the project’s .mcp.json, Enforce now checks the local definition, the one Claude Code actually connects to. Previously it checked the .mcp.json definition, so a local server could run without matching your allowlist. See Enforce policy.
• Exposed paths on deployed servers: Paths a deployed MCP server lists in service.expose no longer receive users’ Runlayer cookies or set cookies, and their responses run in a sandbox that blocks scripts and forms. Standard OAuth endpoints work as before, so serve redirects and JSON there, not login pages. See OAuth expose paths.
• Tool Output Offloading: jq filters that AI clients run on offloaded outputs are now sandboxed and cannot read server environment variables or files. See Tool Output Offloading.
• Runlayer support access: Diagnostic access now accepts only sign-ins from Runlayer’s own ops organization, from the ops console and over MCP alike, with no configuration needed. See Runlayer support access.
• Local connectors: Connectors configured for local deployment now run only on the user’s machine through the Runlayer CLI. The gateway refuses to start or dial them on every proxy path. A direct POST /api/v1/proxy/{id}/mcp call to one is also recorded as a security violation (Connector launch refused, visible in audit logs and incidents), and when End session when any scanner blocks is on and the session named in the request is the caller’s own, that session is ended. See Local MCPs.
• Connector environment variables: stdio connectors no longer accept dynamic-loader variables (LD_*, DYLD_*, GCONV_PATH) in their environment or inherit list. The gateway refuses to start a connector that still carries one and logs the attempt; the CLI drops them before launching a local MCP. See Local MCPs.
• Hosted stdio connectors: npx, uvx and uv connectors now accept only package-selection options before the package (-y for npx; --from, --with, --python, index options and a few behaviour flags such as --isolated, --no-project, --offline for uv). File-reading options such as --env-file and --userconfig are refused, option values may not be filesystem paths, and the package arguments are passed behind --. The connector’s environment may not re-enable those options through the runner’s own variables: only a short allowlist of UV_* / npm_config_* names (index URLs and credentials, cache locations, timeouts, behaviour flags) is accepted, HOME, PATH, PREFIX, XDG_*, NODE_PATH and PYTHONPATH are refused for hosted runners, NODE_OPTIONS may only carry tuning flags (--max-old-space-size=<n>, --no-warnings and the like), and the launch pins uv’s config and .env discovery off. Other names are refused on save and at launch.

• AI Watch: Deleting a managed skill now returns its discovered copies to shadow, so they show up again as skills you can make managed instead of pointing at the deleted skill. See Shadow AI.
• Server request approvals: Approving a server request by linking an existing server no longer fails with “Server not found” when the person who created that server has since moved to another workspace.
• AI Watch user auto-provisioning: A person who signs in with SSO shortly after an AI Watch scan, and whose device username matches only their name (for example jsmith for Jane Smith), is now linked to their existing account instead of getting a duplicate user. See AI Watch.
• Agent connection future-dated delegation reuse: Connecting an agent account to a server now returns 409 instead of 201 when reusing a delegation that hasn’t started yet, so a connection that can’t mint an on-behalf-of token until that start time is no longer reported as ready. See Agent accounts.
• OAuth connectors: Fixed a rare race where an automatic client-secret rotation could leave a connector unable to refresh its token, so it stopped working until you reconnected.
• Token masking: Credentials stored under keys that begin with a pagination word, such as next_auth_token or cursor_bearer, are now masked instead of reaching tools and audit logs unredacted. Pagination cursors such as pageToken still pass through unchanged.
• OAuth policy conditions with multiple accounts: Policy rules on meta.oauth.scopes and meta.oauth.token_expires_at now check the connected account the call actually uses. Before, a user or agent with several accounts on one connector could be allowed or denied based on a different account’s scopes. See Policies.
• Audit log for agent connector approvals in Slack: Approving or denying an agent’s request to use your connector credentials from Slack now records the decision in the audit log, alongside other tool call approvals. See Audit logs.
• Token masking: 13-digit Visa card numbers in tool calls are now caught and masked or blocked. 11-digit IDs that start with 4, like order numbers, no longer get blocked as card numbers.
• Approval previews hide more credential fields: Approval previews in Slack, Teams and the webapp now hide values under field names written without separators, such as accesstoken, clientsecret, privatekey or secretaccesskey, the same way they already hid access_token and accessToken.
• Hosted stdio connectors: Editing an existing hosted stdio connector no longer fails when its server process crashes once on startup. Runlayer now restarts it and retries.
• Cookies hidden in approvals: Approval requests in the web app, Slack, and Microsoft Teams now hide cookie jars sent under a cookies or set_cookies field, the same way they already hid a single cookie.
• AI Watch: Claude Code’s AskUserQuestion is now always allowed in Protect and Enforce and recorded as observed when delivery succeeds, since it only shows a question in the client and runs nothing on the device. It is no longer blocked by a pending verification, an unreachable API, or a session block. See Enforce.
• Stop in the builders and policy chat: Stop in the agent, skill, plugin and connector builders and in the New policy chat now cancels the assistant’s run, so it no longer keeps creating things in the background after you stop it. Your next message continues the conversation instead of failing.
• Dialog close buttons for screen readers: Dialog and drawer close buttons now read as “Close” instead of an unnamed button, including the Usage “See more” dialogs.
• Slack search triggers: The “New Slack message (search)” agent trigger no longer runs the agent a second time when a matching message gets a thread reply, and no longer runs when a matching message is deleted or edited so it stops matching.
• Connector setup form: Values you enter while adding a connector from the catalog are no longer cleared when you switch back to the browser tab or reconnect.
• Users list paging: Paging through Settings → Users no longer shows the same person on two pages, or skips someone, when many users share the value you sort by (such as no recent activity).
• Renaming agent environment variables: Renaming a saved environment variable without re-entering its value no longer deletes the stored secret. The agent page now asks you to re-enter the value before it saves the rename. See Environment variables.
• Agent chat activity: While an agent runs, its tool calls now stay grouped in one activity block instead of splitting into a separate block per tool, and subagent steps no longer repeat once per tool they call.
• AgentGuard scores parallel tool calls: When an agent runs several tools at once, AgentGuard now scores every tool’s output instead of only the last one. See AgentGuard.
• Images in Sessions: Images whose base64 data is split across lines, as many tools and libraries encode it, are now stored with the Session and shown in its timeline. Before, they showed as “Image unavailable” and were not stored.
• Artifact previews: Editing an artifact’s tags, alias, folder, or public link no longer reloads its preview, so videos keep playing and embedded previews keep their scroll position. See Manage artifacts.
• Slack replies sent to the channel: Agents now answer thread replies posted with Also send to channel, the same as replies typed in the thread. Before, Slack delivered those replies but agents never saw them.
• Slack Artifact previews: Interactive HTML Artifact previews in Slack keep loading after Runlayer updates your workspace’s Slack app configuration. Removed in 1.41.0: artifacts no longer open inside Slack. Slack shows a link card with the artifact’s details; open the link to view it in Runlayer. See Link previews.
• Connector preview sign-in: After you save a client ID and secret while previewing a connector like Salesforce, Connect account now appears so you can review its tools before adding it.
• Hook verification on split-tunnel VPNs: When your IP allowlist blocks one of a device’s two network paths to Runlayer, the CLI now retries once and uses the path that works instead of failing with “Blocked by Network”.
• Agent policies: An agent’s Policies section now says when policies made in Settings → Policies also apply to that agent, with a link to see them. Before, those rules were enforced but the section looked empty.
• List page filters: On Agents and other list pages, filters no longer wrap awkwardly beside the search box at mid-size browser widths. They move to their own row until everything fits on one line.
• Microsoft 365 connector setup: When you deploy a Microsoft 365 connector, each field now says which Entra value it needs. For example, the client secret field asks for the secret’s Value, not its Secret ID. See Microsoft 365.

​

Vendor agent detection and thread replies

• Session grants API: You can now fetch a single session grant by ID, in the same shape that creating or updating it returns, so automation can read back one grant without listing an agent account’s grants.
• AI Watch Detect: Detect now recognizes the first wave of vendor coding agents: Mistral Vibe, Atlassian Rovo Dev CLI, Snowflake Cortex Code, Command Code, Letta Code, Blackbox CLI, Poolside’s pool, Rowboat, Eigent and Verdent have their MCP servers inventoried from their configs, and Cline Desktop, CodeRabbit CLI, Google Jules Tools, Docker Agent and Qodo CLI are reported when installed. See Detect.
• AI Watch Detect: On Windows hosts with WSL, Detect now also reads per-user MCP config files that clients keep at the same path on every OS (for example Gemini CLI, GitHub Copilot CLI, OpenCode, Kimi Code, Junie and Kilo Code) from inside WSL distros, matching how it already reports those clients as installed there.
• Thread follow-ups in threads the agent started: With Thread follow-ups set to “Anyone in the thread”, agents now answer replies to their own Slack posts (for example a scheduled run’s update) without needing an @mention.

• Slack agent buttons: When you click a button on an agent’s message in a Slack thread, any private reply (for example, why the click was refused) now appears in that thread instead of at the top of the channel.
• CLI connection diagnostics: runlayer doctor now correctly checks local HTTP and SSE connectors that use a configured Authorization header, without reporting an OAuth failure or recommending unnecessary OAuth setup.
• CLI connection diagnostics: runlayer doctor now reports a failure when a local HTTP or SSE connector rejects its configured Authorization header, with guidance to update the credential.

​

Bot thread monitoring and unified sessions

• Slack channel monitors can evaluate bot replies in a thread: With “Respond to messages from bots” on, the new Also evaluate their replies in a thread option lets a monitor act on a bot’s or app’s reply inside a thread. It stays off until you turn it on, and then only one reply in a thread starts a run. A person’s reply in a thread still follows the thread follow-up setting, and a bot that posts as a Slack user keeps that user id, so a condition can match it.
• Bulk skill sharing: Select multiple skills and share them with people, groups, teams, or roles in one action. Existing permissions are preserved, and skills that fail stay selected for retry.
• Add yourself as a Slack app collaborator: Workspace admins can now click Add me as collaborator in an agent’s Slack settings to become a collaborator on its Runlayer-managed Slack app, so Manage Slack App opens in Slack even when someone else created the app.
• Skills API: Set a skill’s tags, and (for skill admins) mark it verified, when you create it, instead of with a follow-up update.
• Servers API: Creating or updating a server through the API now returns the same response as fetching it, including your access to it and its allowed clients, so you no longer need a follow-up read.
• Agent webhooks API: Read a single agent webhook by its ID. Creating a webhook now returns its fields at the top level of the response, and the nested webhook object is still returned for existing integrations.
• Headless OAuth: You can authorize local HTTP/SSE connectors on a host without a browser using runlayer run --no-browser, then complete the login with curl on that host. See Local MCPs.
• Hidden clients in the organization API: Set which MCP clients are hidden from everyone in your workspace in the same request that updates your other organization settings, so you can manage them alongside those settings in automation.
• Client and local tool scanner settings API: New endpoints return the stored scanner overrides for an MCP client, a local tool family, or a single local tool in the same shape that updating them returns, so automation can read back exactly what it wrote.
• LLM gateway routing rules API: You can now set a routing rule’s evaluation position when creating or updating it, so automation can manage rule order one rule at a time instead of reordering the whole list.
• Teams API: Fetch a single group bound to a team, and bind a group in one idempotent call, by group ID.
• One session view everywhere: Sessions opened from Audit Logs now use the same view as the Sessions page, with key moments, the full conversation and tool calls, security verdicts, sharing, and activity. See Sessions.
• Larger Slack channel lists for agents: An agent’s approved and blocked Slack channel lists now hold up to 1,000 channels each, up from 100. The docs now cover approved-channels mode and note that the lists apply to every run, including scheduled and webhook runs. See Slack notifications.

• Runlayer CLI deployments: A device running both AI Watch and the Runlayer CLI now stays listed under its configuration on Settings → Runlayer CLI and Settings → AI Watch. Before, it moved to whichever one checked in last, so the CLI device list went blank for most of every hour. See Deploy the Runlayer CLI.
• Agent chats: Chats no longer keep showing “working” after a run fails or is stopped elsewhere while the agent is writing.
• Clearer Microsoft Teams setup errors: When connecting or installing the Teams app fails (blocked custom app uploads, expired auth, insufficient permissions), admins now see what went wrong and how to fix it instead of a generic server error.
• Microsoft Teams install status: The admin install panel no longer shows a user or team as having the bot installed when we couldn’t actually confirm it, and install failures now surface instead of disappearing.
• Poll trigger status: Agent poll triggers no longer show “Connector disconnected” while their account is still connected and polling.
• Open groups from the keyboard: In Settings → Groups, each group name is now a link, so you can Tab to a group and press Enter to open it. Screen readers announce it as a link too.

• DoorDash: Find restaurants, build carts, and place orders through DoorDash’s Corporate Ordering MCP, with each user signing in to their own DoorDash account. Requires an OAuth client from DoorDash’s private beta. See DoorDash.

​

Claude subscriptions and policy impact checks

• Skills API: Create or update a skill with its complete set of files in one request, and read every file’s content back from the skill.
• Bring your own Claude subscription: devices can now use their own Claude (Claude Code) plan through the LLM Gateway — the subscription signs the provider call while gateway keys and session visibility still apply.
• AI Watch and per-tool security API: You can now read one AI Watch enforce entry by ID, and list, read, or delete a single user’s scoped AI Watch policies. A new endpoint returns one tool’s stored scanner overrides. Updating a tool’s security settings now returns those overrides (tool name plus the fields you can set) instead of the full stored settings row.
• AI Watch Detect: Detect now recognizes the “claw” family of always-on personal agents that connect chat apps such as Telegram, WhatsApp, Slack and iMessage to a shell and MCP tools: Nanobot, ZeroClaw, PicoClaw, NanoClaw, NemoClaw, OpenFang, IronClaw, NullClaw, QwenPaw and Paperclip, plus the OpenClaw-based desktop apps LobsterAI and ClawX. Nanobot, PicoClaw and NullClaw MCP servers are inventoried from their configs. See Detect.
• Muse Code hooks: AI Watch now installs its hooks into Meta’s Muse Code, so tool calls made from Muse Code, including MCP tools, appear in Sessions and can be blocked or rewritten under Protect and Enforce. Hooks install per user or through the MDM bootstrap, and your existing Muse Code settings are left in place. See Protect and Enforce.
• GPT-6.1 Sol for agents: Agents on the OpenAI provider can now run on GPT-6.1 Sol. See Agents.
• Terraform-managed plugins: A runlayer_plugin resource in the Terraform provider lets you define plugins, with their connectors and skills, as code. See Terraform Provider.
• Terraform-managed agent schedules: A runlayer_agent_schedule resource in the Terraform provider lets you deploy an agent’s cron schedules alongside the agent itself. See Terraform Provider.
• Terraform-managed teams and organization settings: New runlayer_team and runlayer_organization resources in the Terraform provider let you manage teams and your organization’s settings as code. See Terraform Provider.
• Terraform-managed policy attributes: A runlayer_policy_attribute_setting resource in the Terraform provider lets you define the attributes that policies can reference as code. See Terraform Provider.
• Teams API: Creating or updating a team now returns the same details as fetching it, including its shared skill, plugin, agent and artifact counts.
• Server security settings API: A new endpoint returns a server’s stored scanner overrides in the same shape that updating them returns, so automation can read back exactly what it wrote.
• LLM gateway usage rules API: A new endpoint returns a single usage rule by ID, in the same shape that creating or updating it returns, so automation can read back one rule without listing them all.
• LLM gateway virtual keys API: You can now fetch a single virtual key by ID, in the same shape the list and update endpoints return. The secret key is still shown only once, at creation.
• MDM configurations API: A new endpoint fetches a single MDM configuration by ID, returning the same details as updating it, so automation can read back one deployment without listing them all.
• Pre-registered OAuth clients API: You can now fetch a single pre-registered OAuth client by ID, in the same shape that updating it returns, so automation can read back one client without listing them all. The client secret is still shown only once, at creation or rotation.
• Private connections API: A new endpoint returns a single private connection by ID, in the same shape the list and delete endpoints return, so automation can read back one connection’s status without listing them all.
• AI providers API: You can now fetch a single AI provider by ID, in the same shape the create and update endpoints return. The API key is still never returned, only masked.
• AI providers API: You can now read and set your organization’s recommended agent model as a single setting, with the same shape returned by both calls.
• Binary package settings API: A new endpoint returns a package’s update policy in the same shape that updating it returns, so automation can read back the current settings, including defaults the org never changed.
• Teams API: Fetch a single team member, and add a member or set their role in one idempotent call, by user ID.
• LLM gateway routing rules API: A new endpoint returns a single routing rule by ID, in the same shape that creating or updating it returns, so automation can read back one rule without listing them all.

• Ask an agent what a policy change would do: The Runlayer Assistant, the policy builder’s chat and any MCP client can now test a policy before it exists: who gains or loses which access, by name, with the people affected differently from the rest called out first. The assistant checks every draft before it proposes one. See Policies.
• Policies written by agents come with their impact: Creating or editing a policy through the Runlayer tools now returns who gains or loses which access before the change is saved, the same check the policy builder runs. A change that moves some people’s access the other way from the rest is held back until the agent acknowledges it, so nothing is published without someone having seen the result. See Policies.
• Terraform-managed AI Watch and per-tool scanner settings: New Terraform provider resources manage AI Watch enforcement settings, per-user AI Watch policies, and per-tool scanner overrides on a connector, so security settings can live in code. See Terraform Provider.

• Fewer false reconnect messages: Runlayer no longer sends a Slack message or inbox item asking you to reconnect a connector after a single rejected request when the connection refreshes on its own. You still get them when the connection needs you to sign in again.
• Runlayer Plugin connections: Claude Code and other MCP clients can now connect to the Runlayer Plugin on new workspaces right away, without someone first opening the Plugins page.
• AI output costs: When some of the spend behind an output couldn’t be priced, its cost now reads as a minimum (≥$X) or “Unpriced” instead of a low figure that looked complete.
• AI output costs: When an output’s spend was only partly recorded, for example an agent run whose usage didn’t fully come through, its cost now reads as a minimum (≥$X) instead of a small figure that looked complete.
• Agent run costs: Usage from agent runs that go through the LLM gateway, such as OpenCode-based agents, now shows up in Spend and AI outputs instead of being almost entirely missing.
• Skill version history: Saving a skill file where only whitespace or Unicode normalization changed now records a new version, and restoring such a version brings back its exact text. See Skills.
• Sign-in: Opening Runlayer during a brief connection problem no longer shows an “Authentication Failed” screen to users who are already signed in. They go to their home page as usual.
• Agent chat follow-ups: When you send a follow-up, the agent’s working indicator now appears under your message right away. The previous answer stays as it was, so its artifacts no longer reload and its Copy button stays available.
• Agent chats: Reloading the page, opening a chat in another tab, or reconnecting after a network drop while an agent is answering no longer cuts the answer off mid-sentence or shows it twice.
• Agent replies when the AI provider blocks a request: When a model provider’s safety filter refuses a request, the agent’s Slack reply now says which provider blocked it and why, instead of showing the raw provider error, and links to the agent so you can switch it to a different model.
• Slack assistant replies: When you ask an agent from the Slack assistant panel while viewing a channel and its live reply gets interrupted, the recovered reply now posts in your assistant conversation instead of the channel you were viewing.
• Offline evals: An eval no longer stays on Replaying or Judging forever when one of its cases is interrupted mid-run. After 30 minutes that case is marked failed with the reason and the eval completes, so you can run it again. See Offline evals.
• Agent Monitor charts: The Runs and Goal achieved charts on an agent’s Monitor tab now stack their two series, so failed or missed runs no longer hide succeeded or achieved ones.
• LLM Gateway: image generation requests (/v1/images/*) now route through the gateway instead of failing with a provider-resolution error.

​

Slack bot triggers and Deploy autoscaling

• Choose which bots a Slack channel monitor responds to: With “Respond to messages from bots” on, a channel monitor can respond to any bot or app, or only the ones you pick (e.g. an alerting tool or a Workflow Builder flow). The agent never triggers itself, and a noisy bot is rate-limited per channel.
• Scale deployed MCP servers: run a Runlayer Deploy server as several replicas with infrastructure.scaling, at a fixed count, or autoscaled on CPU and network use once your infrastructure module release includes Deploy autoscaling, with each MCP session kept on one replica. See Deploy.
• Trust Slack bots by name: When choosing which bots and apps can trigger a channel monitor, pick them from the bots that recently posted in the monitored channels, or paste a link to one of their messages. No more looking up Slack app IDs.
• AI Watch Detect: Detect now inventories the Office add-ins installed for each account in Excel, Word, PowerPoint, Outlook and OneNote on Windows and macOS, and surfaces the AI ones on the Shadow AI page, including Claude for Excel, Word, PowerPoint and Outlook and the ChatGPT add-in. Each add-in reports its publisher, version, host application, whether it came from the store, and whether it was sideloaded. Only the add-in manifests Office caches are read, never document content. Upgrade the backend before the AI Watch endpoint so unrecognized add-ins stay hidden. See Detect.
• Readable names for Bedrock inference profiles: When an agent model is a custom Bedrock inference-profile ARN, the model picker now shows the model it serves (for example “Claude Sonnet 4.5 (inference profile)”) instead of the raw ARN. Needs bedrock:GetInferenceProfile on the provider’s role, the same permission cost tracking uses.
• Bedrock inference profiles in the model picker: a custom Bedrock inference-profile ARN is now also labelled with the profile’s own name (for example Claude Sonnet 4.6 · my-profile), so two profiles on the same model stay distinguishable, and it shows that model’s details (context window, prices) on hover. See LLM providers.
• Screen readers: The grid/list toggle, sort and status menus, filter remove buttons and connector type badges now have names that screen readers read out.
• Subagents on Pi agents: subagents of agents on the Pi harness now get the same sandbox guidance, memory context and skills as their parent agent, plus clear rules on reporting back. They can browse, use memory and recover connectors the way the parent does.
• Runlayer Assistant model: Admins can now pick the model and provider the Runlayer Assistant runs on, including an OpenAI-compatible gateway, from Settings → AI Providers, and tune its model settings on the Assistant’s page. See Runlayer Assistant model.
• Agents: The agent page now tells you what happened when you save, connect, share, schedule or remove something, and why it failed when it does. It asks before removing a connector or deleting a task, and uses plainer words throughout (for example “New chat” and “Spending limits”).

• Signed, encrypted Runlayer support access: Diagnostic requests now require an ops-console signature in addition to the Runlayer token, and verified responses are encrypted to that request. Before upgrading, ECS deployments must supply Runlayer’s trusted public signing keys through the Terraform debug_ops_request_signing_jwks input (keys are not bundled), and Kubernetes deployments must set DEBUG_OPS_REQUEST_SIGNING_JWKS in the runlayer-app Secret; replay protection uses the existing Postgres database and its normal deployment migrations. Missing or unusable keys disable diagnostic access—see Runlayer support access.
• OAuth Scopes policy conditions: Policies that check a connection’s OAuth scopes now always see the scopes the upstream provider granted. Reconnecting from an MCP client no longer replaces them with the scopes that client requested. See Policies.
• API keys for agent accounts: Admins can create long-lived API keys for an agent account from its Manage API keys menu item and use them on the MCP gateway in place of the client credentials flow. Keys are unavailable while Require DPoP, Strict mode, or Enforce audience is on. See Agent accounts.
• Prompt discovery in audit logs: Listing a connector’s prompts through Runlayer now records audit events, as listing tools and resources already does, so you can see who discovered which prompts and when listing failed. The events also appear in SIEM exports. See Audit Logs.

• App messages in Slack channel monitors: Agents and monitor conditions now read the content of messages from apps like PagerDuty and Datadog, including attachment fields and message blocks, instead of seeing them as blank.
• Local connector policies: Tools discovered by administrators using local MCP clients now appear individually in the policy editor.
• AI Watch hooks behind the ECS web firewall: After the Terraform module update, AI Watch hooks and scans, runlayer run local MCP checks and tool sync, and skill and plugin uploads and syncs on self-hosted ECS deployments go through even when their content looks like a known Java, Log4j or React exploit, instead of failing as a network block. See Terraform deployment.
• Azure Foundry Fetch deployments: Fetch deployments now adds only the chat models actually deployed on your Azure resource, instead of every model the resource could deploy, so the agent model picker no longer offers models that fail when an agent runs. See LLM providers.
• Slack agents in group DMs: With Thread follow-ups on, agents now keep answering replies in a group DM thread after someone mentions them, and they read the earlier messages in that thread. Agents set up with Runlayer-managed Slack apps update automatically; agents using a Slack configuration token need to be reconnected in Slack once. See Agents.
• Audit Logs: The pager no longer offers pages it can’t load. On very large result sets it stops at the last reachable page instead of showing “Could not load audit logs”. See Audit Logs.
• Old links and bookmarks: A link with an outdated tab or filter (for example on Audit Logs, Incidents or Teams) now opens the page with its default view instead of an error page.
• Settings: Opening a settings link that doesn’t exist now shows a “Page not found” page with the settings menu and a way back, instead of a blank “Not Found”.
• Broken links: Opening a link to a connector, user, agent account or team with a malformed or deleted id now shows a not-found page with a way back, instead of an error page with raw validation text.
• Connectors: A very long connector search now shows “Nothing matched your search” instead of a validation error. See Connectors.
• AI Watch devices: A stopped WSL distribution that shows “Last scanned: Never” now says why: AI Watch only scans a distribution while it’s running, and the next check-in scans it once it’s started. See Shadow AI.
• Tool governance: The Enforce policy and Per-user overrides now say that Runlayer-managed MCP servers are already allowed, so you only add exceptions for MCP servers outside Runlayer. See Tool governance.
• Settings lists: Opening Users, Groups, Agent accounts, Manage skills or Manage connectors with an out-of-date page number now takes you to the last page instead of an empty table.
• Broken links: A link to a page that does not exist inside a section, such as a mistyped connector or agent URL, now shows a “Page not found” page with the sidebar and a way home, instead of a bare “Not Found” line.
• Control: The summary cards no longer flash a “100%” trend while the previous period is still loading.
• Agents: Back on an agent you opened from a team’s Agents tab now returns to that team, not the Agents list.
• Agent run details on phones: The run details sheet now scrolls all the way to the last step, which was hidden below the screen.
• Agent Optimizer button: The “Create Agent Optimizer” button on Usage → Spend and Usage → Agents no longer shows when your workspace already has an Agent Optimizer, even an older one with an edited prompt.

• AI Watch Detect: Detect now inventories the extensions installed in every Chrome, Edge, Brave, Chromium and Firefox profile on a device and surfaces the AI ones on the Shadow AI page, including Claude in Chrome, the ChatGPT browser control, Perplexity, Grammarly, Browser MCP, the Playwright MCP Bridge and meeting recorders. Each extension reports its store, enabled state and whether it was installed from a store, forced by policy, added by another installer, or sideloaded unpacked. Only the browser’s own extension registry is read, never history, cookies or site data. Upgrade the backend before the AI Watch endpoint so unrecognized extensions stay hidden. See Detect.

​

Agent inventory and artifact folders

• Faster plugins: Plugin tool discovery (tools/list and search_tools on the Runlayer Plugin and custom plugins) spends less CPU per request, and the tool search index builds about three times faster. The Plugins page also loads with one request instead of two.
• AI Providers: Admins can set input, output, cache-read and cache-write prices for each custom model in Settings → AI Providers. Agent-run cost and agent budget limits use those prices for new usage, so custom models no longer show as unpriced. See LLM providers.
• Artifacts: Organize artifacts into folders. Choose Move to folder from an artifact’s menu, use / for nested folders, and browse them from the Artifacts page. Agents can file what they publish with the folder option on create_artifact or the new set_artifact_folder tool.
• Claude Haiku 5.5 for agents: Agents can now run on Claude Haiku 5.5, through the Anthropic API or AWS Bedrock, with adaptive thinking effort settings. See Agents.
• Run now for everyone a scheduled task runs for: People a scheduled task runs for can now use Run now on it to test their own run, even if they can’t edit the task. See Agents.
• Policies behind allowed calls: Audit log entries for allowed tool calls and resource reads now list the policies that allowed them, the same way denied calls do. Admins who manage policies see an “Allowed by” row in the tool call’s details, with a link to each policy.
• Legacy macOS Detect retired by the installer: The AI Watch .pkg and the uninstall package now boot out the old script-based com.runlayer.scan agent for every user and remove its wrapper, so migrating fleets stop double-scanning and decommissioned devices stop scanning, without a separate cleanup script. See Legacy macOS Detect Cleanup.
• Agent inventory: The Agents page’s new Inventory tab lists every agent you can edit with its owner, model, recent runs, and upkeep issues (idle, never run, newer model available, owner left), and lets you upgrade models or disable agents in bulk. It replaces the Unused tab. See Agents.
• AI Watch Detect: Detect now reports the Grok Bot desktop app (xAI) as an installed client on macOS, Windows, and Linux. See Detect.
• AI Watch Detect: Detect now reports Meta’s Muse desktop app as an installed client on macOS. See Detect.
• AI Watch Detect: Detect now scans Meta’s Muse Code terminal agent on macOS, Windows, and Linux: configured MCP servers in ~/.config/muse/settings.json, installed skills, and the install itself. See Detect.
• ChatGPT desktop version on Windows: AI Watch Detect now reports the installed ChatGPT desktop app version on Windows, where the Microsoft Store app previously showed up without one. See Detect.
• Browser extension: Visits to Meta’s Muse web app (muse.ai) now appear in Sessions as the Muse client, with best-effort prompt capture through the generic composer detector. See Browser extension.
• AI Watch hooks: Faster hook responses on macOS devices running the AI Watch daemon under heavy parallel agent use. The daemon now resolves the signed-in user once a minute instead of on every hook, and holds a burst of hooks for the next free worker instead of falling back to a slower inline run. Cursor and Goose hook entries now carry a 120 s timeout so those clients never cut a held hook off before AI Watch answers.
• AI Watch hook daemon on by default: Enrolled macOS and Windows devices now run a per-user hook daemon, so Claude Code, Codex, and other hook-driven clients see faster hook responses without starting a new process on every call. Check it with aiwatch daemon status. See Troubleshooting.
• Slack channel monitors: A channel monitor can opt in to messages from other apps’ bots. New monitors stay limited to human messages until that is turned on.
• Agent run failure alerts: Agents without their own Slack app now DM the person a webhook or scheduled run runs as when that run fails, not only when a scheduled run fails to start. The DM links straight to the failed run. The switch on the agent’s Slack card is now called Run failures and stays on by default.
• Agent model picker: Pick an agent’s model from one searchable menu that groups models by AI provider and lets you star favorites, with the reasoning effort menu right beside it. See Agents.

• Deactivated users’ agents stop posting to Slack: When you deactivate a user, agent runs they started can no longer post messages or add reactions in Slack through the agent’s Slack app, even if the run is still going. Runs that act as an agent account stop the same way once that account is disabled or deleted.
• workspace no longer trusted by default: A user’s own Claude Desktop MCP server can take the name workspace, so it is no longer a default allowed built-in for Claude Code and is removed from existing custom lists. Add it back only if you accept that. See Enforce policy.

• Runlayer Assistant sees new tools: Assistants provisioned before a Runlayer tool was added never offered it. They now pick up new Runlayer tools automatically on the next deploy.
• Cost for agents on a custom Bedrock inference profile: Agent runs that use a custom Bedrock application inference profile ARN now show their real cost, priced as the model the profile serves. Add bedrock:GetInferenceProfile to your Bedrock role (it’s in the permission policy shown in the provider form). See LLM providers.
• Agent run cost for unpriced models: Agent runs that call their model through the Runlayer LLM gateway on a model Runlayer has no price for, such as a custom Bedrock application inference profile, now show “Cost unavailable” instead of $0.00, and the Monitor counts them as unpriced.
• AI Watch deployment status: Organization-key AI Watch deployments now show as active when their devices report in but find no AI tools, instead of staying pending or turning inactive. See Deploy AI Watch.
• Claude Desktop tools under Enforce: Claude Desktop’s built-in tools, such as background tasks, the browser, Claude in Chrome, and scheduled tasks, are no longer blocked as unregistered MCP servers. Enforce now checks them against your allowed built-in MCP servers by exact name, so add the ones your teams use (for example ccd_session or scheduled-tasks). Requires Claude Desktop’s bundled Claude Code 2.1.281 or later. See Enforce policy.
• Agents list search: A very long search no longer replaces the agents list with a “Validation Error”. It is trimmed to 200 characters and searches normally. See Agents.
• Missing agents: Opening a link to a deleted or nonexistent agent now shows “Agent not found” with a way back to the list, instead of an empty chat that looked usable. See Agents.
• Stale run links: Opening a link to a run that no longer exists now says so, instead of “No session content for this run.” See Agents.
• AI Watch Detect: Detect now finds Antigravity MCP servers in Antigravity 2.x’s global and workspace config files, not only the pre-2.0 location. Grok Build MCP servers are now scanned from its config files, Perplexity and ChatGPT desktop are recognized by their current bundle paths, and Gemini CLI findings are documented as enterprise-licensed or stale installs now that Google has retired the individual tiers. See Detect.
• Artifacts search and missing artifacts: A very long artifacts search no longer replaces the list with a “Validation Error”; it is trimmed to 200 characters and searches normally. Opening a link to a deleted or nonexistent artifact now says “Artifact not found” with a way back to the artifacts list, instead of a bare “Not Found” and a Retry button.
• Plugins: A very long plugin search now shows “No plugins match your search” instead of a “Validation Error”, and opening a link to a deleted or invalid plugin shows “Plugin not found” with a way back to the list instead of an error page.
• AI Watch deployment settings: Devices again receive the settings of their own deployment. Previously an organization running one deployment on Monitor and another on Enforce saw the Monitor devices switch to Enforce after upgrading. Policy rules created through /ai-watch/policy-rules are now enabled per Runlayer deployment; contact Runlayer to turn them on. See Policy rules.

​

Agent usage feed and faster hooks

• AI Watch Monitor mode: tool-call hooks in Monitor mode now get their answer before output scanning runs, so coding-agent sessions no longer wait on scanner latency for every tool call. Scanning still runs and findings still appear in Sessions and audit logs.
• Agent usage feed API: Pull every agent’s creator, consumers, who it’s shared with, and token and cost usage into your BI tool or data warehouse with GET /api/v1/agents/metrics/usage. See API.
• Agent usage feed in Runlayer MCP: Ask your AI client for every agent’s creator, consumers, sharing, and token usage with the get_agent_usage_report and list_agent_usage_consumers tools. See Runlayer MCP.
• Sort artifacts by date: The Artifacts page can now be sorted by newest or oldest, or by most or least recently updated, so artifacts an agent republished recently are easy to find.
• Agents: On an agent’s Monitor tab, click the failed-runs count under Success rate to open Sessions filtered to failed runs.
• Faster AI Watch hooks on Windows: Hooks read the device serial directly from system firmware instead of launching PowerShell on every fire, so each hook completes sooner.

• OAuth reconnect race fix: Reconnecting a connector while its account was being revoked no longer shows a raw database error; you now get a clear “account not found” or “try again” message.
• Trigger audience picker: When choosing specific people for an agent trigger, each person you pick now stays selected right away, instead of briefly disappearing and sometimes dropping earlier picks.
• AI Watch hooks for Copilot CLI, VS Code and Grok CLI: AI Watch no longer leaves recovery copies of its hook file in directories these clients load wholesale, which could block every Copilot CLI prompt or run hooks twice. Copies now live in Runlayer’s own backup folder, affected devices clean themselves up on the next hourly reconcile, aiwatch setup hooks check flags any leftover copy, and uninstall moves them out as well.
• AI Watch Enforce for Qwen Code: MCP servers configured in Qwen Code’s own settings are now checked against your Enforce policy instead of being blocked as unregistered.
• AI Watch Windows updates: Devices deployed through Intune now install the AI Watch version your organization selects. Previously the hourly update downloaded the installer but stopped before running it on devices without the hook daemon, so fleets stayed on the version Intune first installed. Existing fleets need one push of this release to pick up the fix. See Deploy with Intune.
• AI Watch Windows updates with active sessions: The hourly AI Watch update on Windows now completes on devices where a coding assistant session is open. Previously a background AI Watch helper kept running for the whole session, so the update waited five minutes, gave up, and tried again the next hour without ever installing. See Deploy with Intune.
• AI Watch on Windows: Claude Code and Codex hooks no longer flash a console window each time they fire, whether or not the AI Watch daemon is running.

​

Scoped AI Watch policies, allowed agents

• One-request AI Watch scans: The runlayer CLI now reports a device’s MCP servers, skills, plugins, scan completeness and feature health in a single inventory request per scan, uploading skill or plugin content only when Runlayer has not seen it before. Scheduled scans on unchanged devices no longer generate a burst of requests, and older deployments keep working unchanged. See Shadow AI.
• Batched AI Watch hook telemetry: The AI Watch daemon now spools hook telemetry (session events and MCP usage) to disk and delivers it in batches of up to 100 per request, so a busy coding session no longer produces one request per hook. Telemetry survives daemon restarts and short outages instead of being dropped, and policy checks are unaffected. Older deployments keep receiving single requests.
• ECS Terraform module upgrade notes: Every ECS Terraform module release now lists its breaking changes and upgrade steps, in the module’s CHANGELOG.md and on a new changelog page, so you know what to change before bumping the module version. See ECS Terraform module changelog.
• Loading indicators: Loading states across Runlayer now share one indicator built from the Runlayer mark, and placeholder content loads with a softer, consistent shimmer.
• Session timeline: While a long session timeline loads, the loading indicator fills to show how much has loaded, and holds still if loading pauses.
• Loading placeholders: Lists, card grids and tables now show placeholders shaped like the content they are loading, so pages no longer jump when data arrives.
• Agents can wait without polling: Every agent can now call schedule_continuation to end its run and pick the same conversation back up after a delay (1 minute to 24 hours), for example once CI finishes or a person replies. See Agents.
• Agent limit requests: when an agent hits its run limit or cost budget, people who can’t change limits can click Send request on the banner to notify your agent managers in their inbox.
• Message new Slack agents right away: when an agent creates another agent with Slack enabled, its reply now @-mentions the new agent’s Slack bot so people can start messaging it directly.
• Artifacts: Share an artifact without the Runlayer header and frame. Present → Copy link without chrome gives you an /artifacts/<id>/embed link that opens the artifact edge to edge, for screen shares, demos, and wall displays. Viewers still need access to the artifact.
• Faster plugin tool calls under AI Watch Protect: In Protect mode the client hook no longer re-scans tool calls that already go through the Runlayer gateway (Runlayer Plugin and gateway-connected servers), where the same scanners run and apply their verdict. Each such call skips two synchronous hook round trips; local tools and directly connected MCP servers are scanned as before.
• Agents: The Memory context settings and the agent memory docs now explain what the Agent, Channel and User scopes each share, which runs get them, and that User memory follows a person into shared channels.

• AI Watch policy per team, group, user or device: Set AI Watch mode, session capture, browser controls, detection phases and scan bounds for a specific team, group, user or machine through the /ai-watch/policy-rules API, without a separate deployment. A device rule applies to the machine whoever is signed in and overrides user rules, which override team and group rules; when several team or group rules apply, or several people have used one machine in the last 30 days, the machine gets the strictest value of each setting. GET /ai-watch/policy-rules/check?device_id=… previews what a machine receives. The organization-wide baseline stays managed from your deployments. See Policy rules.
• Plugin-scoped agent tokens: Agent accounts can now scope an on-behalf-of token to a single plugin by passing the plugin’s MCP URL as resource (strict-mode accounts can’t yet). The token works on that plugin’s endpoint only, and is rejected everywhere else when server scoping is enforced. See Agent Accounts.
• Webhook source allowlists: Self-hosted ECS deployments can allow integration source ranges for agent webhook invocation while retaining network restrictions on other endpoints. See Terraform deployment.
• Allowed agents: Choose which agents an agent can hand work to on your behalf from the new Allowed agents section on its detail page. Each user of a shared agent makes their own selection. See Agents.
• Approve always for agent handoffs: When an agent hands work to an agent you haven’t allowed while you’re in the conversation, choose Approve once, Approve always (adds it to Allowed agents), or Deny from the web app, Slack, or Microsoft Teams. Handoffs to allowed agents no longer ask.
• Scheduled and triggered handoffs: Agents running with nobody present (schedules, webhooks, event triggers, channel monitors) hand off only to agents in Allowed agents, instead of waiting on approvals nobody sees. Handoffs scheduled and triggered runs made in the 30 days before the update are added to Allowed agents automatically, up to the 50 most recent targets per person and calling agent; older ones are refused until you add them.
• Breaking: external agent accounts can’t start Runlayer agents: An agent account with no Runlayer-hosted agent behind it (an external agent using client credentials) can no longer call run_agent; there is no agent to save under Allowed agents. Run the handoff from a Runlayer-hosted agent instead.
• Masked tool inputs on Pi agents: when a scanner’s Mask action redacts a secret from a tool call on an agent running on the Pi harness, the run transcript now shows the redacted input instead of the original value.
• Credentials hidden in approvals: Approval requests in the web app, Slack, and Microsoft Teams now hide tokens and keys in the task and arguments they show. Other long random-looking values show their first and last characters plus a fingerprint that tells different values apart; UUIDs, payment record ids, and commit SHAs in GitHub links or commit fields stay visible.

• Policy conditions on IDs: Conditions on Server ID, Subject ID, and Actor ID now match the ID as shown in Runlayer. Before, an “equals” condition on Server ID never matched. See Policies.
• Policy conditions on numbers: equals and not_equals conditions now match numeric fields against their plain text form, so a field of 5 matches a condition value of 5, typed or referenced with $payload. Before, these conditions never matched numbers, and not_equals always matched. See Policies.
• Slack reaction triggers: The “New Slack reaction” agent trigger now works. Pick an emoji and, optionally, a channel and message author, and the agent runs once when a message gets that reaction. The run includes which reaction matched. You can still edit the underlying Slack search directly, like has::eyes: in:#alerts.
• Faster hook response when the connection is refused: When a device’s network refuses connections to Runlayer, AI Watch hooks now respond in about a second instead of about six.
• Agent Slack notifications: After you save a Slack notification setting, the settings dialog no longer shows unsaved changes or re-enables Save while the page refreshes, and the Budget alerts and Scheduled run failures switches on the Slack card show their new position right away. A quick second click no longer sends the same change twice.
• Bedrock model discovery: Validate connection on an AWS Bedrock AI provider no longer lists models your AWS account is not yet subscribed to, so agents stop failing with access-denied errors on models that looked enabled.
• Agent Slack alerts: Budget alert and scheduled run failure switches now turn off and show a warning when no Slack app can deliver them, instead of looking on while alerts are dropped. Agents with their own Slack app now send budget alerts through that app, so the alerts still arrive while the workspace Slack app is disconnected.
• Agent voice messages: The microphone button in the agent chat now hides when your browser blocks microphone access, instead of showing an error on every click.
• Agent voice messages: Sending while a voice recording is still being transcribed no longer splits your message in two. Send and Enter wait until the transcript lands in the message box, so the text you typed and what you said go out together.
• Links from Slack: Buttons like Open agent in Slack alerts now open the agent after you sign in, instead of dropping you on the home page.
• Settings search: Settings search now finds buttons, headings and field labels on pages you’ve opened, such as “Add approval rule” on Policies, and highlights the match.
• Local HTTP connectors: Configured Basic authorization and custom headers now reach local MCP servers through the Runlayer CLI.
• AI Watch hooks: Claude Code no longer blocks with “AI Watch daemon stopped before returning a hook result” when the daemon hits an internal error on a healthy device. Monitor and Protect now allow the action, Enforce blocks it with the usual policy message, and the daemon keeps serving.
• Manage connectors: A hosted connector left in “Setup required” can now be deleted from its row menu or its page, which also removes its unfinished deployment. See Manage connectors.
• Sign-in error page: if a request fails authentication while you are still signed in, Runlayer now takes you back to your home page instead of stopping on an “Authentication Failed” screen.
• Agent chat thoughts: Opening a chat while the agent is still thinking (for example right after you approve a request) no longer shows a thought that starts mid-word above the full one.
• Agents from AI clients: Asking ChatGPT, Claude or another AI client to run a Runlayer agent no longer needs its exact name. A few words of the name, in any order, now find it, and agent search in Runlayer works the same way.
• Agent run cost for unpriced models: Runs on a model Runlayer has no price for, such as a custom Bedrock application inference profile, now show “Cost unavailable” instead of $0.00. Runs that mix a priced and an unpriced model mark their cost as excluding the unpriced model, and the Monitor cost total notes how many runs it leaves out fully or partly.
• Artifacts: Browse older artifacts as you scroll and search all accessible artifacts by title or filename, including those beyond the first page.
• Agents: When a Slack admin approves an agent’s Slack app, opening Slack’s approval link now brings you back to the agent with a prompt to finish connecting, instead of an error page.
• Filtered Sessions list pages: Filtering the Sessions list, for example by action, now shows the right sessions on page 2 and later instead of repeating earlier results.
• Agents: The Agent token usage chart on the Usage page now shows input tokens even when output tokens are higher.

• TheirStack: TheirStack MCP is available in the catalog for searching job postings, company tech stacks and hiring signals. See Connectors.

• Island Enterprise Browser: Admins can now deploy the Runlayer browser extension to Island. AI Watch settings show the extension ID, your organization’s update URL, and the configuration to paste into the Island Management Console. The browser extension docs also gain a supported-browser table. See Browser extension.
• Island Enterprise Browser: On macOS, AI Watch now registers its identity host for Island, so Island activity is attributed to the device’s user once an Island admin allows admin-installed native messaging hosts. See Browser extension.

​

Voice messages and agent handoff approvals

• Validate Bedrock connections and pick from enabled models: When you set up an AWS Bedrock AI provider, Validate connection checks the role and lists the models your AWS account has enabled in that Region, all checked by default, in place of Runlayer’s default model list. Uncheck any you want to hide, so people only pick models that actually run. Add bedrock:ListFoundationModels, bedrock:ListInferenceProfiles and bedrock:GetFoundationModelAvailability to the role to use it.
• Agent triggers: A scheduled task’s edit dialog now has a View runs button that opens the agent’s Sessions tab filtered to the runs that task started.
• Agents: You can now talk to an agent in the chat. Click the microphone in the message box, speak, then click stop. Runlayer transcribes your recording into the message box so you can edit it before sending. Transcription uses your workspace’s OpenAI provider, as Slack voice clips do.
• Agent detail page: The agent’s Settings tab is gone. Run limits and cost budgets now sit on the Monitor tab as a Limits card showing usage against each limit, with an Edit limits button. For agents with their own Slack app, run-result and budget-alert DMs moved to a new Notifications section in the app’s Slack settings, and Run results now also controls the scheduled run failure DM (sent by the agent’s app). Agents without their own app keep Budget alerts and Scheduled run failures switches on their Slack card. See Usage limits.
• Agent settings feedback: Changing an agent’s settings now confirms what was saved, explains side effects (like Code mode turning Procedures off), and shows the actual reason when a save fails. Capability, memory, and model settings also use plainer wording.

• Approve agent handoffs: When you’re in the conversation, an agent hands work to another agent only after you approve it. The approval shows the target agent and its owner, the task it will send (truncated with a notice when very long), and the agent’s summary of what it shares and what it expects back. Setting up or changing a schedule, trigger, webhook or Slack channel monitor from the conversation needs the same approval. See Agents.

• Connector token refresh: Fixed an issue where a slow or interrupted token refresh could lose the newly rotated refresh token, sometimes forcing you to reconnect a connector.
• Connector token refresh: Fixed an issue where a token refresh finished on one backend instance became visible to the others only after the refresh lock was released, so a second refresh could spend an already-rotated token and force a reconnect.
• Bedrock inference profiles on agents: Agents bound to your AWS Bedrock provider can now run on a custom application inference profile ARN. Previously these runs failed with a misleading “Model credentials are not configured” error before reaching AWS.
• Agent connector permissions: The agent’s connector permissions dialog no longer shows a “Connect your account” button that failed with an error when you hadn’t connected that connector yet. Use Connect on the connector row instead.
• Agent memory: When a run_agent_memory_sql result is too large to return in full, the call now fails with an error that tells the agent how to get the rows, instead of handing it a cut-off fragment it could mistake for the whole table. Agents can pass output_file to write every row to a workspace file. See Agents.

​

Agent handoffs and delegation review

• Agents that hand off work: Turn on “Can hand work to other agents” in any agent’s settings to let it find other agents and hand them tasks. With it off, the agent can’t start other agents. Agents that could already run other agents start with it on. See Agents.
• Cursor billing connection: Workspace admins can connect or disconnect a Cursor Team or Enterprise billing API key from Settings → Integrations. Runlayer verifies keys before saving them, erases the stored key on disconnect, and preserves any historical usage. Reconnecting an Enterprise account requires the same Cursor organization ID; Team accounts with imported usage need support before reconnecting. This connection is behind a dedicated organization feature flag; usage import is coming separately.
• Block bypassed explanations: Tool calls marked “Block bypassed” in a session now explain in plain language why the block didn’t take effect and what you can do to stop calls like it next time.
• Inherit named environment variables into local MCPs: On a local stdio connector, admins can now list variables such as GH_TOKEN or NODE_OPTIONS that runlayer run copies from each user’s own shell into the MCP. Runlayer stores only the names; values are passed to the local MCP process and never sent to Runlayer, and values set on the connector still win. See Local MCPs.
• Skill usage analytics: Ask connected agents for a skill’s usage totals, daily trends, and top users through the Runlayer connector. Access follows the skill’s editor permissions.

• Review agent delegation: Workspaces with approval policies can require approval for every agent-to-agent run, including scheduled ones, with the new “Review agent delegation” policy template. See Policies.
• Agent sandbox AWS role: On AgentCore, the AWS role whose credentials agent code can read inside its sandbox no longer has an unused sts:AssumeRole permission. It is now limited to pulling the sandbox image and writing runtime logs.

• Claude Code billed usage: A Claude Code session that reaches Runlayer through both the Runlayer CLI hook and Anthropic’s native inference hooks is now billed once instead of once per hook.
• Retry teammates’ agent runs: People with Can Edit on an agent, and workspace admins, can now retry a failed run that a teammate started, such as a webhook run that hit the cost budget. The retry runs as you.
• Long agent tool calls: Agent connector calls and Procedures that take longer than 60 seconds now finish. Before, they timed out and the connector stayed unavailable for the rest of the run.
• Session search: Searching inside a session’s Conversation now also finds text in tool inputs and outputs, such as a token a tool read from a file. Before, those turns showed “No turns match these filters.”

​

Interactive agent cards and private previews

• MCP audit logs by session: list_audit_logs now accepts rl_session_id, so agents can pull one session’s activity without paging the full window.
• Interactive cards in agent chats: Agents can ask you to make a decision, such as approving a plan, or to add and sign in to a connector, through a card you answer inline, and the conversation continues from your choice. When an agent changes its own instructions, the chat shows what changed with an Undo button that restores the previous version. See Agents.
• Private artifact previews: Agents can show a generated report or visual as a private preview in chat. Only you can see it, and it expires unless you choose Save artifact. See Artifacts.
• Agent cards in Slack and Teams: Agent cards and artifact previews now work in Slack and Microsoft Teams. Click a button to record your choice, and the agent continues in the same thread. See Agents.
• Attach files in the agent playground: attach images, PDFs, Office documents and text files to a playground message with the paperclip, paste or drag and drop. The agent gets them the same way it gets Slack attachments.
• Analytics by department and person: Group ROI artifacts by department or person (not just team), see which outputs an agent run produced, and drill into department or group spend to see what it produced.
• Skills: Importing a skill from a GitHub URL that is already in your workspace now says so on the review step. If you can edit the existing skill, Update from source pulls the latest version into it instead of creating a second copy.
• Edit agent schedules, triggers and webhooks from Runlayer MCP: New update_agent_schedule, update_agent_trigger and update_agent_webhook tools change an existing schedule, trigger or webhook in place, so agents can retime, pause or adjust them without deleting and recreating. Webhook URLs stay the same.
• Agents in Slack: agents can now open .zip, .mp4 and .mov files you attach in Slack (up to 100 MB). The file lands in the agent’s workspace, so it can unpack an archive or inspect a video.
• Model cost breakdown: Filter detailed calculations by provider and see the matching row count.
• Sessions: Running vs Idle: Open sessions only show Running while events are still arriving. Once a session has been quiet for a few minutes it shows Idle with its last activity time (e.g. “Idle · 3h ago”).
• Agent failure analysis: mark agent runs Pass or Fail with a note from the run drawer, then use Analyze failures on the Evals tab to group failing notes into categories with counts and start an offline eval from any category’s runs.
• Claude Code subagent usage: Sessions and the Usage page now include the tokens used by Claude Code subagents (Explore, Plan and custom agents), attributed to the parent session and priced per model. Previously only the main conversation was counted. Requires the updated Runlayer CLI / AI Watch hook.
• Terraform ECS module: The procedures_validator input is deprecated and ignored. Procedure validation now runs in the agent sandbox, so Procedures need enable_runlayer_agents with the AgentCore runtime. If you set procedures_validator, terraform plan warns and you can remove it; it still plans until the next major module version. See Terraform ECS inputs.
• PagerDuty triggers: Agents can now start when a PagerDuty incident is triggered, acknowledged, reassigned, or has its priority changed. See Agents.
• Top erroring agents: Clicking an agent in Analytics → Agents → Top erroring agents now opens that agent’s Sessions tab filtered to failed runs. Sessions also has a new Status filter.

• AgentGuard in Monitor mode: AgentGuard now scores sessions from devices in AI Watch Monitor mode. Detections show up as alerts, and tool calls are never blocked. See AgentGuard.

• Connector token refresh: Fixed an issue where some connectors (notably Notion) forced a reconnect after the provider rejected a token refresh for a mismatched resource; the refresh now retries without the resource instead of exhausting the connection.
• CLI token refresh: Fixed an issue where running two runlayer local proxies for the same server could refresh the same OAuth token twice and revoke the connection; refreshes are now coordinated across processes.
• Very large sessions: Very large sessions now open in the Sessions drawer and load page by page, instead of failing with a “too large” error. See Sessions.
• Inline approvals for Pi agents: Approve and Deny cards now appear in the chat when an agent running on the Pi harness hits a tool call that needs approval, instead of only a link to the approval page.
• Agent starter prompts: Starter prompts you save after this release stay in place when you edit an agent’s instructions, change its tools, or restore a version. Existing prompts continue to refresh automatically.
• Claude.ai compliance imports: Claude.ai chats keep importing from the Anthropic Compliance API after Anthropic’s September 22 change to how chats are listed. Setup needs only a claude.ai Compliance Access Key with the read:compliance_user_data scope. See Web chat and compliance imports.
• Claude usage: Tool activity now retains the model supplied by Claude inference requests, reducing unknown-model usage for newly captured activity.
• Usage cost estimates: Usage can estimate Baseten public Model API costs for GLM-5.2-Fast while keeping its Fast pricing tier distinct.
• Usage model attribution: Duplicate usage snapshots now retain an available model name when their timestamps, reported cost, and token counts match.
• Sessions: Tool calls blocked by the TypeScript and Python Hooks SDKs now appear as blocked in Sessions, instead of being marked as bypassed because no endpoint device is active.
• GPT-6.1 Sol pricing: Usage and Spend now price Codex and gateway sessions that run OpenAI’s GPT-6.1 Sol at OpenAI’s list rates instead of reporting them as unpriced. See Analytics.
• Agent spend attribution: Token usage from sandboxed Runlayer agents is now attributed to the model the run actually used instead of showing as “unknown” on the Usage page when the agent harness doesn’t report a model per response. See Usage.
• Usage page: Agent runs whose harness could not price the model used to show as free ($0, “provider reported”). They are now priced from Runlayer’s model catalog on every view, including hourly charts, the same way the daily rollup already did. Sandboxed Pi runs on a model newer than Pi’s bundled catalog no longer report a sibling model’s rates as the real cost.
• Responsive list controls: Search, filters, and layout controls stay usable at narrower browser widths across Agents, Connectors, Skills, Plugins, and Artifacts.
• Claude Code and Cowork sessions from Anthropic inference hooks: Sessions captured through Anthropic’s native inference hooks now appear under the Claude Code or Claude Cowork client instead of the generic Claude client, so they show up in Claude Code filters, hook settings, and usage reports. Capture still follows the Claude.ai hook client toggle for every Claude surface. If you run both the local Claude Code hook and Anthropic inference hooks, reported Claude Code spend can drop: the same turns were previously counted once per feed. See Anthropic inference hooks.
• Users page activity columns: “Activity (30d)”, “Security violations (30d)” and “Last active” now load on organizations with heavy audit volume instead of timing out, and the same data comes back from the list_users MCP tool. “Activity (30d)” now counts tool, resource, skill and plugin activity, matching the dashboards’ definition of an active user. See Users.
• Per-person usage via the Runlayer MCP: get_agent_token_usage with group_by=actor now returns an “Other actors” row for everyone past the top 30, so per-person spend always adds up to the organization total instead of silently dropping the tail.
• Agents reading images: Agent runs no longer fail with “Could not process image” when a connector returns an image in a format or size the model can’t read (for example a BMP, TIFF or HEIC file from Google Drive). The image is converted and resized automatically, or skipped with a note if it can’t be decoded.
• Agent run timeline: failed tool calls now show the tool’s actual error message instead of a generic “Tool failed”.
• AI Watch on Windows: AI Watch now finds the signed-in user’s real profile folder on Windows. Before, it assumed C:\Users\<name>, which broke for moved profiles and for domain users whose folder name differs from their user name.

• Skill usage & edits: The skill page now has a Usage & edits panel showing uses, unique users and edits over the last 7, 30 or 90 days, with edit markers on the usage chart, the edit history with a link to each diff, and top users. Your own uses aren’t counted.

​

Configurable invisible character detection

• Configurable invisible character detection: Invisible character detection is now split into categories, each with its own action — Allow, Alert, Mask, or Block — set globally and overridden per connector, client, local-tool family, or tool, the same way PII types work. Terminal colour and style codes printed by tools such as git, lefthook, and pytest were previously flagged as hidden characters and blocked; they now have their own ANSI colour codes category, allowed by default, so ordinary colourised output no longer raises an event. Concealing sequences (SGR conceal, background colours, OSC hyperlinks and clipboard writes), bidi overrides, and zero-width runs stay under Hidden characters, the one category that cannot be switched off. Control characters (cursor movement, erase) remain detected by default and can be set to Allow for connectors that return raw terminal output. Three stricter categories are available for connectors whose output should never carry invisible text: Isolated zero-width characters, C1 control characters, and Encoded hidden text (Unicode tags, invisible operators, unbalanced bidi isolates, dense zero-width sequences). All three are allowed by default and existing rules are updated to say so, so nothing new fires until you enable it; emoji sequences, subdivision flags, and right-to-left text are recognised and left alone. Incidents name the category that fired and can adjust its action in place; terminal-noise incidents now group under CONTROL_CHARS instead of HIDDEN_CHARS, so prior dismissals of those do not transfer. See ToolGuard — Per-Type Actions.

​

Agent web browsing and output analytics

• Connector search: Admins searching My connectors now get a link to search every connector in Manage connectors, including ones they can’t use themselves (for example, connectors granted only to agents).
• AI output analytics on for everyone: The Output view in Analytics now tracks the pull requests, documents, and other artifacts your AI sessions produce without an admin having to ask Runlayer to enable it. See Analytics.
• Kubernetes operator: extra environment variables: RunlayerInstance.spec.extraEnv appends environment variables to every backend-image workload (backend, worker, migration job, consumers) for settings the CRD has no field for. See Runlayer operator.
• Kubernetes operator: collector sidecar health export: the OpenTelemetry collector sidecar now exports its own health metrics (export queue depth, send failures, receiver refusals — no application data) to endpoints named runlayer-*, which must use protocol: http, so Runlayer can monitor your deployment’s telemetry export the same way it does on ECS. Endpoints with any other name never receive these metrics. See Runlayer operator.
• Runlayer MCP agent listing: list_agents can now filter by drafts, tags, disabled status, team and All Workspace, and sort by name, last used or run count. A new list_teams tool lists your teams.
• Web browsing for every agent: Agents always have a real browser now, so the per-agent Web browsing toggle is gone. Use the agent’s network access policy to limit which sites it can reach. The enable_web_fetch API and Terraform field is removed. See Network access policy.
• Judge agreement on agent evals: Each comparative scorer on an eval run now shows how often its verdicts match yours, with a confusion matrix and a warning when too few cases are labelled to trust it. See Agent evals.
• Least active accounts: The Top active accounts card on Analytics → Overview now has a Most / Least toggle. Least lists the people with the fewest actions in the selected range, including anyone with none, so you can see who to help get started.

• Agent connector tool selection: A connector with no tools selected on an agent now gives that agent no tools at the gateway, matching the “0 tools enabled” the agent shows. Before, requests made with the agent’s own credentials could still call every tool on that connector.
• Skill security scoring: Skill scans now use SkillGuard. When a skill is flagged, the security findings highlight the lines the model keyed on.

• Policy changes reach plugin tool search right away: When you allow or block a tool through a policy, or add someone to a group or role, the Runlayer Plugin’s search_tools reflects it on the user’s next search instead of up to ten minutes later. See Policies.
• Agent Accounts: Your own agent harness can now change Runlayer agents through Runlayer MCP after an admin connects its agent account to the Runlayer connector with those tools. It acts with the delegating user’s access, and tools that aren’t connected stay blocked. These calls used to fail with agent_scope_unresolved. See Agent Accounts.
• AI Watch: The MDM-managed org API key is no longer sent to an operator-chosen --host; aiwatch now releases it only for the host it was provisioned for, and no longer keeps it in the environment of the long-running hook daemon.
• Agent analytics names: The “Top agents by tool calls” card on Analytics → Agents now shows external agents (agent accounts with no Runlayer-managed agent) by name instead of by ID.

​

Organization LLM budget covers agents

• Organization LLM budget covers agents and virtual keys: The organization usage rule’s total budget now counts spend from agent runs and virtual keys, not only devices. Once it is spent, agent runs and virtual keys stop at the LLM gateway until an admin raises the budget or it resets. See Agents.

• Connector authorization: Fixed an issue where visiting a connector’s authorize flow could lose a rotated refresh token and bounce you back to reconnect.
• Windows scheduled skill sync: Fixed the Runlayer CLI’s scheduled task on Windows failing to start skill sync for the signed-in user, so managed skills now sync on schedule without a manual runlayer schedule. AI Watch’s scheduled scan on Windows now also runs as the signed-in user again instead of falling back to a system-level scan. Launch failures now log their Windows error code to C:\ProgramData\Runlayer\Logs\scheduled-task.log.
• PII scanner accuracy: ToolGuard’s PII scanner no longer flags private or loopback IP addresses (such as 127.0.0.1, 10.x, 192.168.x) or placeholder SSNs (such as 000-00-0000) as sensitive data, which cuts false-positive blocks and masking.
• Sessions: The Sessions page now moves security tabs to their own row earlier, preventing header controls from wrapping awkwardly at narrower desktop widths.
• AI Watch uninstall: The macOS uninstall script and the Windows uninstaller now remove LLM routing from Claude Code and Codex managed settings, so a retired device goes back to its normal provider instead of staying pointed at the gateway. Other settings are kept.

​

Shadow AI dashboard drill-downs

• Shadow AI drill-downs: Clicking a row on a Shadow AI dashboard card, such as a skill risk level or a managed connector, now opens the Details table with matching filters. Details filters are kept in the page URL so you can share a filtered view, and Back returns you to the dashboard tab you came from.
• Slack settings: the Connected Agent Apps list on the Integrations page is now collapsed by default, with a count, so large workspaces no longer get an endless page. See Integrations.
• Artifact custom links in Runlayer MCP: Assistants and agents can now set, change, or remove an artifact’s custom link, and open an artifact from its custom link, through Runlayer MCP. See Create and update.

• Test Connection with identity forwarding: Test Connection now sends the same identity headers and signed identity token as real MCP traffic. Connectors that authenticate on the forwarded identity no longer fail diagnostics with “Invalid or expired token”.
• Usage links: “Top agents by tool calls” rows now open that agent’s tool calls in the audit log instead of a page that wouldn’t load. “Feature adoption” rows keep your selected date range, and “Top plugin users” now correctly counts installs.
• Agent Stop: Stopping an agent run that has just finished now returns its final status without an error. Repeated Stop requests leave later runs untouched.
• Agent chat: Automatic chat title updates use less data, keeping long conversations responsive. Renamed titles stay consistent after you reveal a run’s hidden content.
• Artifact views and visitors: Reopening the views dialog now starts on the last 30 days, matching the counter you clicked, instead of the window you picked last time.
• Slack attachments stay with the message: When an agent sends a Slack message with files, the files are now attached to that message instead of arriving as a separate message with no text.
• Agent descriptions: Updating agent instructions no longer cuts off automatically generated descriptions at the character limit.
• Agents: Sessions, Evals and Artifacts load when opened, and polling pauses in hidden tabs while preserving tab state.
• Slack channel picker: When Slack limits directory requests, channel pickers use the available cached directory without waiting through repeated retries. Live channel membership checks still run.

​

Artifact view analytics and custom links

• Agent run token accounting: The Agent Monitor’s Tokens tile now counts cache read, cache write, and reasoning tokens alongside input and output, so long agentic runs no longer show a token count that cannot explain their cost. The model pricing hover card also lists the cache write price per million tokens.
• Artifact views and visitors: See how many people opened an artifact, who they were, and whether they came from Runlayer, Slack, or an MCP client, from the views counter in the artifact’s header. Admins get an org-wide Artifacts tab in Analytics with the most viewed artifacts.
• Agent run token totals: A finished agent run’s status strip now shows input, output, and cached token counts next to its cost; hover for the full breakdown including cache writes and reasoning tokens.
• Artifact custom links: Give an artifact a readable address like /artifacts/kpi-dashboard from its ⋯ menu. The original link keeps working, and Copy link shares the custom one. See Share and control access.
• Edit LLM Gateway routing rules: Admins can now edit the pattern, target, and condition of an existing routing rule in place, without deleting and re-adding it.
• Slack DMs from any agent run: Agents started from the playground, a webhook, or a schedule can now DM people on Slack by email, so asking an agent to “DM me when you’re done” works outside Slack too. See Slack notifications.
• AI-generated agent icons: The agent icon picker has a Generate tab that creates an icon from the agent’s name, instructions and your workspace. Requires an OpenAI API key.
• Edit LLM gateway virtual keys: Admins can now change a virtual key’s name, spend budget, and what happens when the budget is spent, from Settings → LLM Gateway. The key itself does not change, so clients keep working.

• Slack agent error messages: When an agent run fails inside Runlayer, Slack now shows the actual error instead of telling you the AI provider is temporarily unavailable.
• Agent account connector permissions: Anyone who manages agent accounts can now choose which tools and resources an agent account may use on each connector, and remove connectors, without security-policy admin rights. Saving tool changes no longer switches the connector to your own account. Conditions stay editable by security admins only. See Agent accounts.
• Policy compare pane default tab: Comparing a skill or agent policy now opens on the Changes tab instead of Impact, since Impact only has data for connector policies.
• Agents: Agent cost by model now shows each subagent’s own model, instead of adding its cost to the agent’s main model.
• Claude Code cache costs: Usage estimates reported 1-hour cache writes at the hourly rate and other cache writes at the base rate when the provider has not supplied a cost.
• Complete session history in MCP tools: get_session and unredact_session now return the whole session for sessions resumed a week or more after they went quiet, instead of only what happened after the resume.
• AI Watch keeps your Claude Code provider settings: AI Watch no longer removes your own Claude Code settings, such as Bedrock or Vertex switches, API keys, or a custom base URL, from the managed settings file when LLM routing is off or AI Watch is uninstalled. Managed settings saved with a byte-order mark no longer cause an LLM routing error, and with routing off a settings file AI Watch can’t read is left alone.
• Plugin skill tools: get_skill and get_skill_file now behave the same across every plugin and client: they no longer accept the old query and skill/file arguments, only skill_id (plus file_id for files). Use search_skills to find a skill by text; clients holding an older tool list get an error that says so.
• Connector disconnect notices: Runlayer no longer sends repeated “isn’t connected” Slack DMs when an MCP client reconnects or refreshes its tool list in the background. You’re notified when a tool call, resource read, or prompt actually needs the connector, at most once a day per connector.
• Slack setup is opt-in on MCP agent create: The Runlayer MCP create_agent tool creates a Slack app only when the call passes enable_channels=["slack"]. Agents created without it no longer get a Slack app or a slack_app_created event. Add Slack later with update_agent or from the agent page. See Agents.
• Agent instructions: Opening the Markdown editor in Safari preserves pending edits without interrupting editing.
• Agent chat: Responses remain readable and unsent drafts stay available if message formatting fails to load.
• Fewer connector prompts in Slack: Agents now ask you to connect a connector only when they actually use it, not for every connector attached to the agent, and each connector gets a single prompt. The prompt copy is shorter and plainer.
• AI Watch hooks: When the network path to Runlayer is down, hooks now fail over within their stated timeout instead of stalling up to six times longer (once per Runlayer IP address) before blocking the tool call. Set RUNLAYER_HAPPY_EYEBALLS=0 to restore the previous connect behaviour.
• Agent connectors: Agent pages skip unnecessary credential checks for connectors that do not require OAuth.

​

Event triggers and Claude Sonnet 5.5

• Fetch Azure Foundry deployments: When adding or editing an Azure Foundry AI provider, a Fetch deployments button now lists the models your endpoint serves and adds them to the deployment names, so you no longer have to copy names across by hand. See Platform agents.
• Obs-only flow metrics: With observability OTLP export on and tooling export off, backend flow-metric collection now defaults on (same consent as any Runlayer sink). Set flow_metrics_collection_enabled = false to opt out. See Terraform ECS inputs.
• AI browser detection: AI Watch Detect now inventories 16 standalone AI browsers built on Chromium, including Perplexity Comet, Dia, Opera Neon, ChatGPT Atlas, Norton Neo, and BrowserOS, on macOS, Windows, and Linux. A browser counts as installed only when its own installation is found, never from a leftover profile or browsing data. See Detect.
• More AI browsers detected: AI Watch Detect now inventories 16 more standalone AI browsers, including Fellou, Strawberry Browser, Kahana Oasis, and kweo, on macOS, Windows, and Linux. See Detect.
• Claude Sonnet 5.5 for agents: Agents can now run on Claude Sonnet 5.5, through the Anthropic API or AWS Bedrock, with adaptive thinking effort settings. See Agents.
• Connector event triggers for all workspaces: Agents can now be triggered by events in connected apps, such as a new Gmail label, Linear issue, or Google Drive file, in every workspace without asking for access. See Agents.

• AI Watch shadow classification for remote catalog servers: Remote MCP servers listed in the catalog are now recognized as managed instead of flagged as unknown shadow servers, eliminating false-positive shadow alerts for catalog-listed remote servers.
• Account reconnect: While a connection is being revoked, its card now shows a Revoking badge and keeps Reconnect and Force reconnection disabled until the revoke finishes, so you can no longer start a reconnect against an account that is going away.
• Slack trigger on retried and continued runs: A run that is a retry of a continued run, or a continuation of a retried run, now shows the Slack channel monitor that started it, like every other run in that conversation. See Agents.
• People spend list paging: Sorting people by cost no longer skips or repeats a person between pages when their usage includes token corrections.
• Policy edits kept while editing: Unsaved changes to a policy’s action or conditions no longer reset when group or role data refreshes in the background, for example after you switch back to the browser tab.
• Slack channel monitors: agents watching a Slack channel now trigger within seconds of a message again. See Agents.
• Codex token usage: Usage now includes cache-write tokens for new Codex sessions when Codex reports them. See Analytics.

​

Faster scans and named agent chats

• Faster, lighter AI Watch scans: The runlayer CLI now reports the skills and plugins found on a device in batched requests of up to 25 artifacts instead of one request per artifact, so scans finish faster and generate far less traffic against your Runlayer deployment. Older deployments keep working unchanged. See Shadow AI.
• Plugin re-submit throttle: Unchanged plugins that the server already holds are skipped for the same window as skills, cutting repeat uploads from every scheduled scan tick.
• Clearer connector accounts on agents: Each OAuth connector on an agent now says whose account its runs use: “Runs as each user”, or “Always runs as” the person who shared theirs. The Account used setting uses the same words. See Agents.
• Pi integration guide: Govern agents you build on Pi: route their MCP tools through Runlayer, enforce policy on local tools like bash, and record their activity in Sessions. See Agent Platforms.
• Oh My Pi setup guide: Oh My Pi (omp) now has its own tab in the connector setup guide, with a one-line /mcp add command that signs you in and saves the connector.
• Agents: Session lists and the runs API respond faster for agents with heavy tool use, and each page puts much less load on the database.
• Name your agent chats: An agent’s chat list now shows each chat’s generated title instead of its first prompt, and you can rename any chat you started from its ⋯ menu.
• Redirect URI approval: When a connection is waiting for an admin to approve its redirect URI, the approval screen now shows where admins approve it (Settings → General → OAuth redirect URIs) and lets members copy a link to send their admin. See OAuth redirect URI controls.

• OTLP Telemetry organization API key: A new write-only key permission for OpenTelemetry ingestion (logs, metrics, traces) from AI clients such as Claude Code, Claude Cowork, and Glean. Create it from the Organization API keys page; it must be the key’s only permission and cannot use the AI Watch scan or hook endpoints. Exporters already configured with a Shadow AI Scan key (hand-created or from an MDM configuration) keep working. See Claude Code OTLP monitoring and Claude Cowork monitoring.
• Shadow AI Scan keys come only from MDM configuration: The Organization API keys page no longer offers the Shadow AI Scan role, and the API rejects hand-created keys with it. AI Watch keys are minted by the MDM configuration wizard, so every key links devices and scan data to a configuration card. Existing keys keep working and can still be revoked. See Deploy AI Watch.

• Slack monitors on Amazon Bedrock: Self-hosted ECS deployments can evaluate Slack monitor conditions using saved Bedrock providers after applying the Terraform module update. See Terraform deployment.
• AI Watch: Managed (MDM) reconcile no longer replaces client config files or directories that are symlinks inside the user’s home — for example a VS Code settings.json linked from a dotfiles repo, or a ~/.claude / ~/.agents directory that is itself a link. Runlayer’s hook settings are now merged into the linked file and the link is preserved. Backup copies of the previous config are kept beside the link; when the config directory itself is linked they are written under ~/.runlayer/config-backups/ instead, so they never end up inside a dotfiles repository, and backup copies earlier versions left inside a linked config directory are moved to ~/.runlayer/config-backups/ on the next user-scope run (runlayer setup, aiwatch … --user), keeping the newest five. Links that point outside the user’s home are left untouched instead of being overwritten.
• Analytics page loads when one card is slow: If a single card takes too long, the rest of the Analytics page now loads normally instead of the whole page failing. See Analytics.
• Agent chat scrolling: Scrolling up while an agent is still responding now keeps your place instead of jumping back to the newest message. Scroll back to the bottom, or send a message, to follow the reply again.
• Runlayer Plugin: The Runlayer Plugin now appears in the workspace’s Plugins tab, so you can open it and set up a client there.
• In-chat approvals: Approval cards load compactly while checking their current status, without briefly showing decision buttons for completed requests. Completed cards in Codex no longer reserve extra blank space below the result.

​

Enforce policy lists and Slack settings

• Agent Slack settings: An agent’s Slack settings are now split into four sections you switch between on the left: Replies, Channel access, Monitoring, and Sending. Channel monitoring shows its channels and condition only while it’s on, and you disconnect with the Slack switch on the agent page. See Slack notifications.
• Clearer hook denies when your network blocks Runlayer: When a firewall, IP allowlist, VPN gateway, or proxy rejects the hook’s verification request before it reaches Runlayer, the deny now says so and points you at your VPN or zero-trust client, instead of reporting a security-policy violation. Denies that Runlayer itself returns now include the request ID so support can find them.

• Enforce/Protect policy lists: Manage allowed and denied MCP URLs, local packages, and built-in servers one entry at a time, with search and pagination instead of a single bulk save. Adding an entry that is already on the opposite list moves it across, and the Shadow AI overview can add a discovered MCP straight to the allowlist. See Enforce policy.
• Minimal environment for local MCP servers: runlayer run now starts local MCP servers with only the connector’s configured variables plus proxy, TLS, and locale settings, instead of passing through the AI client’s entire environment.

• AI Watch: Manual scans on shared Windows devices no longer report a failed manifest submission (exit code 3) when another user’s scheduled scan ran during the manual scan. The scan now completes normally and notes which scopes a newer scan already covered, and warns about any device-scoped findings the newer scan superseded. Requires the backend from this release: against an older backend the CLI cannot tell another user’s newer scan from its own profile’s regression and reports the manifest as superseded (exit 0) in both cases.
• Spend for Bedrock agents: Spend now prices usage from agents on an Amazon Bedrock provider when they run current Claude models, instead of listing those models as not found in the pricing catalog. See Analytics.
• Runlayer Assistant file guidance: The assistant now gives steps that work when you want to build a skill from existing files: attach them in Slack, paste their text in the web app, or upload a skill package that contains a SKILL.md. It no longer points you to attach controls the web app chat doesn’t have.

​

Inline approvals and artifacts in chat

• Inline approval decisions in agent chats: Approve or deny an agent’s tool-call approval request directly in Agent Playground, Runlayer Assistant, or Home Build. In Agent Playground and Runlayer Assistant, the agent continues in the same conversation after your decision.
• Runlayer Assistant: Keep your assistant conversation as you move through Runlayer, then resume named sessions from History.
• On-demand agent tools: Pi agents discover connector tools as needed, keeping unused tool definitions out of the model’s context.
• Slack Artifact previews: Open interactive HTML Artifacts inside Slack using your existing Runlayer permissions. Requires embeds to be enabled for your workspace’s Runlayer app. See Artifacts. Removed in 1.41.0: artifacts no longer open inside Slack. Slack shows a link card with the artifact’s details; open the link to view it in Runlayer. See Link previews.
• Artifacts show up in agent chat: when an agent shares an artifact it made, the chat now shows the artifact right under its answer (interactive apps, images, videos, and documents) instead of only a link. Open it full page from the caption.
• Jump from a run to its Slack message: on an agent’s Sessions tab, the Slack badge in a Slack-started run’s details now opens the Slack message or thread that started it.
• Delete skills used by agents: You can delete a skill even when agents use it. The confirmation lists the agents that will lose it. Skills in plugins still need to be removed from those plugins first. See Skills.
• Quieter Slack channel monitors: Agents watching a Slack channel now reply only when they have something useful to add, instead of posting every run’s final response. Silent runs still appear in the agent’s activity, and the confusing reply-behavior setting is gone. See Agents.
• Why a Slack monitor started a run: Opening a run that a Slack channel monitor started now shows the channel, the message it reacted to, and why it matched the monitor’s condition (or that no condition is set). See Agents.
• Recommended security settings for 39 more connectors: Runlayer now recommends per-tool security scanner settings for 39 more connectors. After you add one from the catalog, a dialog on the connector page lets you review and apply them. See Policies.
• JumpCloud deployments: Deploy AI Watch to macOS and Windows through JumpCloud from the MDM configuration wizard. Pick the JumpCloud tile, switch between the macOS and Windows tabs, and copy the pre-filled configuration profile or the Private Repo Command Line Options for the signed MSI. See JumpCloud.
• AI Watch config inspection: aiwatch config show now displays each managed key the way the dashboard shows it — org API keys as a prefix (e.g. rl_org_Ab1C2d3...), enrollment keys as prefix plus last four characters — so you can confirm which key a device is using. See Troubleshooting.
• Agent run details: The run panel on an agent’s Sessions tab now leads with the run’s status: a live timer while it runs, how long it took and what it cost once it finishes, and the failure reason right next to Retry when it fails. Long run titles wrap to two lines instead of getting cut off.

• Agent account owners: Every agent account now has an accountable owner, shown in the account summary when you edit it. The creator is the owner; an account that backs an agent follows that agent’s owner. Ownership does not change who can edit or use the account. See Agent Accounts.
• Enforce binds runlayer run to your deployment: AI Watch Enforce now treats a local runlayer run MCP launcher as Runlayer-managed only when its --host points at your Runlayer deployment and it names an active connector. Launchers without --host, aimed at another host, naming an unknown or disabled connector, or carrying unsupported options are blocked, and they can no longer be allowlisted from the Shadow AI activity view. See Enforce.

• Analytics formatting: Large numbers in analytics stat cards now display with thousands separators for easier reading.
• Agent evals: Evals no longer fail for agents that use memory, artifact publishing, environment variables, or workspace files. The replay starts from empty, isolated state and the case shows a warning naming what couldn’t be restored.
• AI client config backups: AI Watch now backs up every client config file it changes (Cursor, VS Code, Codex, Gemini CLI, and the rest, not just Claude Code) and keeps only the 5 most recent backups per file instead of accumulating one for every change. See Enforce.
• Top spenders: The Top spenders card now links to a searchable, paginated view of every user’s model spend or token usage. See Analytics.
• Slack setup through Runlayer MCP: If you can edit an agent, you can enable Slack for it without an elevated role. When creating an agent through MCP, use enable_channels=[] to skip Slack setup. See Agents.
• Agent Slack apps: You can enable an agent’s Slack app without an extra confirmation when the Slack connector is unavailable to you. See Agents.
• AI Watch on Macs with email-alias sign-in: AI Watch now finds the signed-in user’s home folder when they log in with an email alias (Platform SSO, Jamf Connect), so setup, the hook daemon, and scans no longer fail with “console user lookup failed”.
• Agent sessions and the Back button: Opening a run from an agent’s Sessions tab now adds a browser history entry, so Back closes the run or goes back to the one you had open, instead of leaving the agent page.
• Slack channel monitors and threads: Channel monitors now react only to new top-level messages in a channel. Replies inside a thread reach the agent only when someone mentions it, or through thread follow-ups if you’ve turned them on, so an agent with thread follow-ups off no longer answers in threads. See Agents.
• Agent artifacts created through Runlayer MCP: Artifacts an agent creates with the Runlayer MCP create_artifact tool now follow that agent’s Artifact sharing setting, the same as files the agent publishes from its workspace. See Sharing.
• Missing connector links: Opening a link to a connector that was deleted or doesn’t exist now shows a “Connector not found” page with a way back to your connectors, instead of an error screen.

• Google AI Studio provider: Agents can now run on Google Gemini models through a dedicated Google AI Studio provider. Add your Gemini API key and model IDs under Settings → AI Providers. See Platform agents.

​

Claude Opus 5.5 and GPT-6 agents

• Claude Opus 5.5 for agents: Agents can now run on Claude Opus 5.5, through the Anthropic API or AWS Bedrock, with adaptive thinking effort settings. See Agents.
• Team and department spend drilldown: The drilldown now focuses on the Top 5 sessions by cost; the separate all-sessions list below it is gone. The full list is still available on the Sessions page.
• GPT-6 Sol and GPT-6 Luna for agents: Agents on the OpenAI provider can now run on GPT-6 Sol and GPT-6 Luna. See Agents.

• Shadow AI access controls: Saved Shadow AI skill and plugin files are limited to resource managers and security or analytics reviewers. Organization-wide Shadow AI REST APIs and MCP tools now require organization-wide audit log access.
• Channel-only Slack agents: admins can turn off direct messages to an agent in its Slack settings. People who DM it are asked to mention it in a channel instead. See Slack notifications.

• Salesforce connector: The catalog now carries the Salesforce server’s own tool schemas, so agents and triggers call its tools with the arguments they actually take. The setup guide also spells out the OAuth scope the connector needs and how to recover from INVALID_SCOPES. See Salesforce.
• Agents on Amazon Bedrock: agent runs that use OpenAI models on Bedrock (gpt-6 Astra, and any global./us./eu.-prefixed OpenAI model id) now complete instead of failing with “The model … does not exist”. A bare openai.gpt-6… id is served under its global. inference profile automatically.
• Agent Discovered audit events: Audit log rows for agents found by AI Watch device scans now show as “Agent Discovered” with their details instead of “Unknown Event”, including rows recorded before this fix. See Audit Logs.
• Policy filter labels: Deep-linked user and group policy filters now keep their email or name visible even when the principal is inactive or outside the initial picker results. See Policies.
• Model cost over time: the Last 24h spend chart now shows costs at their actual hours. Previously, organizations on the new usage pipeline saw a whole day of spend collapsed into a single spike at midnight UTC, with some in-window spend missing entirely.
• Artifact previews keep their state: switching browser tabs no longer reloads an open artifact preview, so scroll position, filters, and anything typed inside it survive. When an agent publishes a new version while you have the artifact open, a banner offers a refresh instead.
• Last 24h spend cards: the Spend by user, Departments, and IdP groups cards now show measured totals for the last 24 hours instead of time-based estimates, so they match the cost chart next to them.
• Gemini via OpenAI-Compatible providers: Agents can now use Google Gemini through an OpenAI-Compatible provider pointed at generativelanguage.googleapis.com. Runlayer sends the key the way Google API keys expect, instead of as a Bearer token that Google rejects.

​

Queued agent messages and Figma connector

• Queued agent messages: Send follow-ups while an agent is working; they run in order after the current response. Edit, reorder, or remove queued messages, and resume them when ready after stopping a response.
• Shareable policy filters: Admins can now bookmark and share filtered Policies views, and connector notices open Policies filtered to the relevant connector. See Policies.

• Policy conditions on client provenance and access path: Access policies can now key off how an MCP client obtained its Runlayer credentials (meta.client.kind: dcr, cimd, pre_registered, manual, ema, agent) and whether a connector is reached directly or through a plugin (meta.plugin.id) — for example, to keep self-registered clients off a connector on every path, not just its direct endpoint. See Policies.
• Recommended security settings dialog: After deploying a connector, admins with the Manage security policies capability now review and apply Runlayer’s recommended per-tool scanner settings from a dialog on the connector page instead of during the deploy wizard. See Policies.

• Agents Incomplete filter: The Incomplete filter on the Agents page now checks your whole agent list right away instead of only the agents already loaded, so it no longer flashes “No incomplete agents” while more results are still loading. Find it under the Status dropdown.
• Slack progress cards on long agent runs: Agents that spend more than a few minutes on one step no longer show a warning icon on their Slack progress card while still running; progress continues on a fresh card.
• AI Watch scan exit status: A scan the server accepted but could not fully attribute (for example a WSL or container surface) now exits 0 with a “Submitted; server marked surfaces incomplete” warning that names each surface and reason, instead of exiting 3 as “Could not submit”. Scheduled scans no longer read as failed for these runs, and the device log records the reason.
• Connectors analytics loading: The Connectors tab in Analytics no longer times out on workspaces with high MCP traffic. The connector activity chart now reads pre-aggregated data, and counts are unchanged.
• Policy connector filters: Admins can now find and select any matching connector in policy filters, including connectors beyond the first 100 results. See Policies.
• Azure Foundry agents on current deployments: Agents pointed at an Azure Foundry provider no longer fail before their first token on gpt-5-family deployments, which reject the legacy max_tokens parameter; the agent runtime now sends max_completion_tokens to Azure.

• Figma: Figma’s remote MCP server is now generally available in the catalog. Register a Figma OAuth app, have Figma approve its client ID, and paste the credentials into the connector; users then connect with their own Figma account. See Figma.

​

Richer session timelines and inline video artifacts

• Sessions timeline with skipped messages: The agent Sessions list now shows Slack messages the agent chose to skip alongside runs, and search covers both. See Agents.
• Inline video artifacts: Video artifacts play inline in the run view, and the artifact size limit is now 25 MB. See Agents.
• Tool call details: Clicking a trace header with a single tool call opens its details directly.
• Steadier runs: Transient Anthropic API errors are retried instead of failing the run, and the agent builder rejects invalid pending connector rows with clearer playground surfacing.

• Login-host badge on devices: Managed devices show a badge when a user’s login host differs from the MDM-managed host, and hooks target the managed host.
• OAuth token redaction: OAuth token keys are redacted in audit log details. See Audit Logs.

• Entra OAuth: The RFC 8707 resource parameter is omitted for all Microsoft Entra upstreams, fixing OAuth failures.
• Connector settings: Settings are editable on draft deployment connectors, and stored connector configs with null fields no longer break the connector detail page.
• Model picker: Model hover cards show pricing and context data from the LiteLLM catalog.

​

Slack thread following and on-demand schedules

• Follow a Slack thread: After being mentioned, an agent can keep following the conversation in that thread without needing another mention. See Slack notifications.
• Run schedules on demand: Run a schedule immediately and retry failed scheduled runs from the schedule list. See Agents.
• Claude Sonnet 5 default: New agents default to Claude Sonnet 5, and the managed assistant runs on Claude Opus 4.8. See Agents.
• Trigger management over MCP: Create, list, and delete agent triggers through Runlayer MCP tools. See Runlayer MCP.
• Slack file attachments: Office documents shared in a Slack thread are delivered to the agent sandbox, and files that can’t be delivered are called out instead of silently skipped. See Slack notifications.
• Quieter channel joins: The agent channel intro message is now off by default; turn it on per agent. See Agents.

• Agent DMs: The agent Say tool returns the DM channel correctly, fixing direct messages from agents.
• Recommended model on create: Agents created through the assistant pick up the workspace’s recommended model instead of a hardcoded one.

​

DPoP-bound agent tokens and calendar LLM budgets

• DPoP-bound agent tokens: Agent-account tokens can be bound to DPoP keys at token issuance and enforced at the MCP proxy, with a per-agent “require DPoP” flag and admin UI. See Agents.
• Calendar budget windows: LLM gateway usage rules support calendar-based budget windows (for example monthly caps). See Agents.
• Per-tool enrollment diff: Recommended security-setting enrollment shows the effective per-tool diff before you apply it, with scan-direction safety checks. See Policies.
• Recursive delete detection: Skill scanning catches combined short-flag recursive deletes such as rm -rf. See ToolGuard.
• Richer audit events: Managed Slack provisioning is audited, and agent-run tool-call audit events carry the agent and run IDs. See Audit Logs.
• View as permission group: Super Admins can view the workspace as any permission group. See Roles.

• Runs continue after approval: MCP- and REST-triggered agent runs continue after an approval decision, and you can continue your own run from any surface. See Agents.
• Zip skill import: Create a multi-file skill by importing one zip file. See Skills.
• Rejected requests explained: Rejected access requests now say why. See Agents.
• Steadier runs: Mid-turn follow-ups wait for the active run instead of cold-starting, transient Redis timeouts no longer kill sandboxes, and empty model turns are retried instead of ending the run silently.

• Google Docs set_cells: The edit_table tool can set multiple table cells in one call. See Google Workspace.
• Trigger fixes: Google Drive, Linear, and Gmail poll triggers parse their responses correctly, and trigger UI copy is clearer. See Agents.

• Spend accuracy: Last 24h spend renders correctly for all orgs, and sessions that only report Runlayer token counts are priced instead of showing $0. See Analytics.

​

Gmail trigger, Vercel, and fixes

• Approvals continue runs: Scheduled and webhook runs continue after a web-app approval decision instead of stopping at the pause.
• Gmail label-added trigger: A new poll trigger fires an agent when a label is added to a Gmail message. See Agents.
• Playground Stop cancels runs: Pressing Stop in the playground cancels the active run.
• Slack posts default to the bot: Agents post to Slack as the agent bot unless you explicitly ask them to act as the connected user. See Slack notifications.

• Monitor-mode hooks fail open: In monitor mode, hooks allow on credential rejection instead of blocking the editor.
• Grok cloud hooks opt-in: Grok cloud hooks now require explicit opt-in.

• Vercel: Vercel is available through the OAuth broker. See Connectors.

• Skill scan accuracy: Stale skill installs are excluded from adoption counts, and scans that exhaust their byte budget are marked incomplete instead of passing silently.
• Agent evals: Eval runs preserve the original invocation context and tool identities.

​

Webhook signing, scan budgets, and Windows auto-deploy

• Webhook signing: Agent webhooks support HMAC signing — create, rotate, and disable signing secrets from the webhook dialog, with scheme picker and curl examples. See Agents.
• Scan budgets: Configure latency and payload budgets for security scanning, with fail-open/closed behavior, allow/truncate/block payload actions, and budget-exceeded events in audit logs. See ToolGuard.
• OAuth hardening: Tokens from a mismatched OAuth client are rejected, and PII scanning catches İ/ı case-folding obfuscation.

• Windows browser extension auto-deploy: Chrome, Edge, and Firefox on managed Windows devices, with native identity hosts per browser. See Browser Extension.
• Edge on macOS: The AI Watch extension auto-deploys to Microsoft Edge on managed macOS. See Browser Extension.
• Extension health checks: Missing Chromium extension installations are detected, and managed browser policy caches refresh promptly.
• Skill removal tracking: Removed skills are reconciled from host scans, so skill installation counts reflect what is actually on devices.

• Connector Events: Event triggers unified into Connector Events with audience fan-out, an event volume signal, and chat-list visibility for event-triggered runs. See Agents.
• Terraform-managed agents: A runlayer_agent resource and data source in the Terraform provider, with a new “Manage Agents with Terraform” guide. See Terraform Provider.
• Triggers UX: A polished Add Trigger flow and Triggers page. See Agents.
• No artifact limit: The per-agent artifact limit is removed. See Agents.
• Steadier runs: Eager sandbox reconnects, immediate aborts on upstream rate limiting, managed-assistant self-healing, write-tool failures detected on succeeded runs, and session grants minted when a connector is added to an existing agent.

• Usage pricing corrections: Cursor sessions no longer over-priced ~7x, agent-run model spend no longer double-counted, Cursor’s own models priced. See Analytics.
• Spend breakdowns: Break down spend per person, team, and department — with clients drilling down to models — and browse Usage by current teams and departments. See Analytics.
• Units of work pricing: Priced as a time slice of the session; a work ledger shows how each unit’s cost was attributed, branch checkouts steer attribution, and Runlayer artifacts and skills count as outputs with in-app preview.
• Usage by IdP group: New usage APIs by IdP groups and departments.

• Drive PDF text extraction: The Google Drive connector extracts text from PDFs server-side. See Google Workspace.
• Google Docs table tools: New get_table, delete_between_text, and delete_table tools. See Google Workspace.
• X API: X API MCP is available in the catalog. See Connectors.
• Progress notifications: Upstream progress notifications are relayed through the proxy, so long-running tools report progress to clients.
• Plugin routing by client: Dynamic plugins route per client, with Codex configured for plugin routing and org installs learning client-routed tools. See Plugins.

• LLM gateway: Claude passthrough for every client; adaptive thinking downgrades gracefully on models without it.
• Connector auth: Auth-mode changes, custom stdio catalog deploys, and client-credentials token handling all behave correctly.
• Agent event triggers: Slack, Gmail, and GitHub PR poll triggers parse responses correctly.
• Open tabs survive rollouts: Frontend deployments no longer break open tabs with chunk 404s.
• CLI OAuth: The CLI waits for a sibling process’s OAuth login instead of failing on the callback port.
• UI polish: Incidents and recommendations dialogs, session drawers with audit links, and clearer device-key budget errors.
• Slack: Approval-card follow-ups repaired and clearer MCP disconnect notifications.

​

Amazon Nova models, inline skill editing, and units of work analytics

• Non-Claude Bedrock models: Agents can now run non-Claude Bedrock models, with Amazon Nova defaults, gateway routing, and catalog pricing so those runs report cost. See Agents.
• Agent sharing over MCP: Read an agent’s sharing configuration (owner and user/group/role/team grants) through MCP tools. See Runlayer MCP.
• Run-token expiry: Long-running clients can read run-token expiry and self-fence before it lapses.

• Inline skill editing: Edit skill markdown files directly in the skill view, with a new block markdown instructions editor. See Skills.

• Units of work: AI outputs are grouped into units of work with a rebuilt timeline, a unit’s cost is shown only when it is its own, and drafted Slack messages count as output.
• Redaction visibility: Super Admins can see everyone’s AI output changes under workspace redaction.

• Device LLM budgets: Device-key LLM budgets are derived live from the usage rule, so cap changes apply without re-issuing keys.

• Hosted stdio servers: Hosted stdio server creation is routed through the stdio-proxy-wrapper deploy for more reliable provisioning. See Deploy.
• Performance: Hook settings are reused within each request, device heartbeat writes are coalesced, dashboard-metrics cost is bounded by roster size, and session compaction memory is bounded with correct UTF-8 byte accounting.
• CLI 0.30.11 / 0.30.12: Compatible SDK pinning, published transport guard, and bundled dependency patches.

• Model registration fixes: Every selected agent model registers independently of thinking/reasoning settings, with a typed preflight check for unregistered models.
• Slack OAuth fix: Slack OAuth redirect base URLs are normalized, fixing installs behind non-standard base URLs. See Slack notifications.
• UI fixes: LLM Gateway settings page scrolls correctly, and block-editor menu commands stay available while a menu input holds focus.
• Plugin discovery fix: Shared plugins are found before connector discovery on plugin push.

​

Broader policy principals, agent poll triggers, and recommended security settings

• All-user and all-agent principals: Policies can now target every user or every agent in one principal, with principal expansion in authorization. See Policies.
• Policy v2 translation: Legacy PBAC policies translate to Policy v2, new organizations are seeded with role policies, and existing organizations are backfilled to the unified policy model. See Policies.
• Recommended security settings: Connector setup now suggests recommended security settings, and incidents can enroll recommended scanner defaults in one click — with recommendations skipped when a setting is already globally allowed. See Incidents.
• Incident recommendations: Incidents surface recommended tools, per-group adoption breakdowns, and shadow-skill hand-off candidates. See Incidents.
• Skill scanning: The skill heuristic scanner now decodes base64 blobs before scanning, and previously scanned skills are rescanned.
• Policy visibility: Policy tool names are shown even when the connector is not currently reporting them.

• Poll-based triggers (pilot): Subscribe agents to connector events via polling — manage subscriptions in the API and UI, with events dispatched straight into agent runs. See Agents.
• Slack file attachments: Agents can attach files to their Slack replies. See Slack notifications.
• Slack settings over MCP: Agent Slack settings can be read and updated through MCP tools, and blocked Slack channels are named explicitly in the REST API. See Slack notifications.
• Managed Slack installs: Managed Slack app installs are tracked centrally. See Slack notifications.
• Deployment logs over MCP: Container logs for deployments are available via the get_deployment_logs MCP tool.

• Output analytics: A new output analytics tab with business-function output inspection, now including output model participation. See Analytics.
• Session evidence: ROI artifacts now show what the model actually wrote from session evidence, your own sessions stay visible under workspace redaction, and PR extraction is gated on write context.

• Plugin manifest redaction: Headers and environment values are redacted in scanned plugin manifests, so API keys are never uploaded.
• LLM usage rules: Device spend settles onto usage rules with aggregate caps enforced.
• MCP approvals: Authorized MCP approval status is now exposed, inline approval controls are back, and pending approvals refresh automatically.
• AI Watch: Signed macOS uninstall package and clean MSI hook removal; device-token exchange with credential-helper LLM routing, now with device-token caching so tokens are minted only near expiry; Windows disk-read accounting fix.
• MCP config hygiene: The canonical .mcp.json is hardened at write time, with a single cleanup policy that preserves the shared canonical tree and guards stale Cursor entries.
• Deployments: Draft OAuth configuration and DRAFT status survive deploy registration, unknown paths on resource-scoped authorization-server metadata return 404, and runlayer.yaml env substitution skips comment lines.
• Agent UX: Schedule names stay independent of runtime, credential downloads include the client ID, deep links to plugin auth settings, view-instructions moved into the agent menu, agent account settings dialogs scroll properly, and back-button/run deep-link fixes.
• Session stability: Session compaction memory is bounded, with backoff on failing folds.
• Slack: Agent responses no longer unfurl, Slack user IDs are available in agent context, and installs refresh after sync.
• CLI 0.30.10: OAuth callback listener cleanup and a Cursor plugin install fix.

​

Human approval policies and one-click Slack agents

• Human approval policies (beta): Hold an agent’s tool call for a person to approve or deny before it runs. Based on flexible policies. Contact us to enable it for your workspace. See Human approval.

• One-click install Slack agents (rolling out): Set up Slack agents through Managed Apps without OAuth screens. Rolling out now — contact us to enable it for your workspace. See Managed setup.

​

Slack security alerts and policy overrides

• Slack security channel: Route security notifications to their own Slack channel, separate from general alerts, with device-status events included. See Slack notifications.
• Scanner recommendations on connectors: Connector security settings now surface the catalog’s recommended scanner defaults per tool, so you can see what Runlayer suggests before you change anything. See Connectors.
• Policy overrides from Shadow AI: Apply allow/deny policy overrides directly from the Shadow AI Activity tab. See Enforce policy.
• Deactivated grantors: Session grants no longer resolve for a grantor whose account has been deactivated. See Agent accounts.

• Unified connector policies: Connector policy management is consolidated with Global policies in one consistent UI. See Policies.
• LLM usage rules: Define usage rules that cascade across the LLM gateway, and manage them from the admin UI. See Agents.
• Claude Fable 5.1: New model option for agents. See Agents.
• Slack connector upgrades: Runlayer detects upgradeable Slack connectors and offers a one-click upgrade shortcut. See Slack.
• Slack Work Objects: Runlayer links shared in Slack now render as rich cards with viewer-authorized details, on by default. See Slack notifications.

• Nimble: Nimble MCP is available in the catalog. See Connectors.

​

Revocable tokens and approval fixes

• Revocable agent-account tokens: Downstream access tokens issued to agent accounts are tracked in a fail-closed registry, so you can revoke an agent’s downstream access immediately. See Agents.
• Strict ID-token mode: Turn on strict ID-token validation per agent account for tighter downstream authentication. See Agents.

• Artifact repo context: The artifact modal now shows which repo an artifact landed in. See Agents.

• Restrict policy filter: The Restrict filter works again when filtering policies. See Connectors.
• MCP approval prompts: Approval prompts now link back to their originating context and size to their content instead of clipping. See Connectors.

​

Bedrock routing fix for agent runs

• Bedrock inference profiles: Agent runs routed through the LLM gateway now resolve Bedrock inference-profile IDs correctly, so Bedrock-backed models start without errors. See Agents.

​

Reasoning effort picker and chat fixes

• Reasoning effort picker: Choose an agent’s reasoning effort from a compact menu on the agent tab. See Agents.

• Readable JSON messages: JSON payloads sent as user messages are pretty-printed in agent chat instead of rendered as one dense line. See Agents.
• Named provider errors: Agent run errors now name the LLM provider that failed, so you know where to look. See Agents.
• Stable tool names: Runlayer’s own MCP keeps canonical tool names when plugin names collide. See Connectors.

​

Scoped incident remediation and skill diffs

• Changed-file indicators: Skill version history now marks which files changed in each version, so you can spot edits at a glance. See Skills.

• Scoped incident remediation: Remediate incidents directly at local family/tool and MCP connector/tool scope instead of only broad-scope actions. See Connectors.

​

Agent Monitor and personal inbox

• Agent Monitor: Agents now have a Monitor dashboard tab, and the Runs tab is renamed to Sessions. See Agents.
• Personal inbox: A personal inbox collects items emitted when your requests are decided. See Agents.
• Skill card previews: Popular skills cards now show a content preview before you install. See Skills.

• Delegation lifetime caps: Set a per-agent-account cap on delegation and access-token lifetime. See Agents.
• DCR registration auditing: Failed dynamic client registrations are audited and successful ones stamped with the org. See Connectors.

• Live run streams: Agent run streams resume after a page refresh instead of going quiet. See Agents.
• Skill builder permissions: The AI skill builder is hidden from users without create permission. See Skills.
• Skill search: Kebab-case install names now match in skill search. See Skills.
• Resource types dropdown: The resource-types dropdown is org-scoped and time-bounded, so it loads reliably on large tenants. See Connectors.

​

Markdown approvals and LLM routing

• Markdown in approvals: Approval requests in the web app now render full Markdown — callouts, semantic entities, and formatted content instead of raw text. See Agents.
• Inline approval results: The outcome of an approval shows inline in the request, so you can see what was decided without leaving the page. See Agents.
• LLM routing for Claude Code and Codex: Runlayer can now write LLM routing config for Claude Code and Codex clients. See Agents.

​

Agent memory scopes and ownership

• Agent memory scopes: Configure and audit what an agent can remember — Notes and SQL memory are now scoped per agent, team, or workspace. See Agents.
• Runlayer Assistant on your AI providers: The Runlayer Assistant can now run on your org’s configured AI providers. See Agents.
• Popular skills: A Popular skills tab on the build home, ranked by real skill invocations. See Skills.
• In-app docs tools: Runlayer’s own MCP server now serves docs and help tools from your tenant. See Connectors.

• Slack channel allowlist: Restrict which Slack channels an agent may post in. See Agents.
• Resource ownership: Agents, plugins, connectors, and artifacts now record an owner on creation, with existing resources backfilled. See Agents.
• Memory actor binding: Agent memory is bound to verified runtime actors and enforces run-level authority. See Agents.
• Broader Detect coverage: TraeWork detection added, plus reliable detection of large JetBrains AI plugins. See Detect.

• OAuth discovery timeouts: Connector OAuth discovery is capped by one overall deadline instead of stalling. See Connectors.
• OAuth token refresh: Refresh locks are keyed by the resolved account, preventing cross-account contention. See Connectors.
• Agent run errors: Upstream LLM protocol errors surface instead of being swallowed. See Agents.
• Connectors table: Rows no longer remount on every refresh. See Connectors.
• Windows AI Watch service: The RunlayerAIWatch service only exists while the daemon gate is open. See Detect.

​

Consistent Usage day windows

• Usage reporting windows: Usage presets and custom ranges now align to whole UTC day cells across Overview, Spend, cost drawers and simulations, topics, managed-agent costs, and legacy analytics. “Last 24 hrs” means yesterday plus today so far in UTC, so it can include up to two UTC calendar days instead of a rolling 24-hour window. See Analytics.

​

Session key moments and broader detection

• Session key moments: The session panel opens in a drawer with a key moments rail. See Sessions.
• Skills in session timelines: Skill usage is visible in session timelines. See Sessions.
• Requests on Monitor: Pending requests now live on the Monitor page. See Agents.
• Agent analytics: Top erroring agents card, and agent names on the Usage page link to the agent detail screen. See Agents.
• Team artifact discovery: Add and discover team-shared artifacts from team and workspace pages. See Agents.
• Recommended skills intake: Recommend skills to your org with share-on-promote. See Skills.
• Linux legacy install: The one-command Linux install auto-selects the glibc 2.17 legacy variant on older distros. See Linux deploy.

• Broader AI Watch detection: Scans now cover the top-50 AI clients, global npm installs, IDE plugins, runtimes, containers, and disguised skills — including Claude Code installed via the VS Code extension. See Detect.
• AgentGuard sensitivity: Configurable detection sensitivity for the AgentGuard behavior scan. See Shadow AI.
• Allowlist-only OAuth redirects: Opt in to restrict dynamic client registration redirect URIs to an allowlist. See Connectors.

• CLI OAuth recovery: The CLI recovers from expired OAuth authorization codes. See CLI deployment.
• Skill import dropdowns: Import dropdown flows work correctly. See Skills.
• Looker managed MCP: Connects as a pre-registered public OAuth client. See Connectors.
• Fresh tool lists on reconnect: Stale tool-list cache reads after reconnect are prevented. See Connectors.
• Agent run resilience: Transient LLM provider errors are retried, with clearer Slack error messages. See Agents.

​

Agent Monitor filters and Zed skills

• Agent Monitor filters: Filter agent runs by user and source, with run source and actor shown on each card. See Agents.
• Zed native skills: The CLI now syncs skills to Zed. See Skills.
• One-command Test Device install: Hosted install scripts set up a macOS or Windows test device in one command. See Detect.
• Fetch artifacts in agent runs: Agents can fetch artifact content in the sandbox with the new fetch_artifact tool. See Agents.
• List AI providers over MCP: New list_ai_providers MCP tool.
• Device-sync filter for skills: Filter the manage skills list by device sync status. See Skills.
• Google Drive file metadata: The Drive connector supports writable file metadata. See Connectors.
• Model attribution in sessions: Token spans are attributed to the model that produced them. See Sessions.

• Config change auditing: LLM gateway and AI provider configuration changes are audited. See Audit logs.
• Claude Desktop and Cowork skills detected: AI Watch scans now find Claude Desktop and Cowork skills. See Shadow AI.
• Stricter OAuth redirect validation: Redirect URI allowlists are validated consistently at client registration. See Connectors.

• Sharing role clarity: The sharing dialog explains team permission overrides and marks the selected role.
• Slack Enterprise Grid notifications: Notification channels work on Enterprise Grid workspaces. See Agents.
• AI Watch false Inactive: Devices no longer incorrectly show as Inactive. See Shadow AI.
• Windows MSI upgrades: Upgrades no longer silently drop equal-version VC runtime DLLs.
• Resumed sessions render fully: Resumed sessions no longer show truncated history. See Sessions.

​

Session sharing and settings revamp

• Session sharing: Share a session with teammates using the same sharing framework as other resources. See Sessions.
• Revamped Personal and Org settings: Reorganized settings pages that are easier to scan and navigate.
• Agent traces in playgrounds: Inspect an agent run’s trace directly in the playground. See Agents.
• DeepSeek V4 Pro: New model option for agent runs. See Agents.
• One-click Slack consent: Approve a paused agent run from Slack and it mints the session grant for you. See Agents.
• Guided managed Slack setup: Onboarding walks you through connecting managed Slack. See Agents.
• Event trigger conditions: See and set the conditions that fire an agent event trigger. See Agents.
• AI ROI and agent cost cards: The usage page shows ROI cards and managed agent cost metrics.
• Public OAuth clients for MCP servers: Connect upstream MCP servers that use a public OAuth client with no client secret. See Connectors.
• Quieter toasts: Fewer noisy success toasts and a restyled toaster.
• Faster spend views: The Spend page and drawer make far fewer requests.
• Model hover cards: The agent model picker shows models.dev details on hover, one card at a time. See Agents.
• Run cost on monitor cards: Agent monitor run cards show what each run cost. See Agents.
• runlayer doctor: New CLI preflight that checks OAuth and connectivity before you deploy. See CLI deployment.
• Audit log vocabularies: Available audit log action and resource types are queryable over MCP. See Audit logs.

• Verified skills: Admins can mark a skill as verified so users know it’s trusted. See Skills.
• More AI tools detected: Detect now scans for Pi, Kimi Code, Kilo Code, Junie, and Devin CLI. See Detect.

• Skill import: SKILL.md frontmatter is preserved on import. See Skills.
• Spend activity cards: Restored on the usage page.
• AI Watch accuracy: Top connectors show the MCP name instead of the gateway domain, and device mode comes from reported claims. See Shadow AI.
• Manual OAuth credentials: Switching a connector’s auth type no longer leaves orphaned manual credentials behind. See Connectors.
• CLI OAuth errors: Clear guidance when dynamic client registration is rejected or a pending login times out. See CLI deployment.
• Slack agent routing: The Slack front door no longer routes messages to unused, toolless agents. See Agents.
• Directory sync: Sync no longer wedges on a bad event, and duplicate-email collisions are handled cleanly.
• Device counts: Configuration filters count each device once.
• Binary artifacts: Large artifacts download on demand instead of failing with a conflict error.

​

Slack progress cards and artifact versions

• Live Slack progress card: Agent progress appears as one live-updating card instead of a per-tool-call checklist. See Agents.
• Per-agent Slack suggested prompts: Give each agent its own suggested prompts in Slack. See Agents.
• Scheduled run audiences: Choose who a scheduled agent run posts to, with audience badges on each schedule. See Agents.
• Artifact versioning: Artifacts keep version history, mirroring agent and skill versioning. See Agents.
• Windows and Linux skill sync: Automatic skill sync scheduling now runs on Windows and Linux. See Skills.
• Grok hooks: Monitor local Grok CLI activity. Grok Bot cloud hooks are experimental, require separate setup, and have not passed end-to-end validation. See Grok Bot.
• Add team assets from the header: Create assets straight from the team header instead of per-tab dropdowns.
• Faster usage page: Usage data loads on demand and no longer re-polls historical queries.

• Session events to your SIEM: Stream session events to your own SIEM bucket. See Audit logs.

• Manual OAuth clients: New authorizations use your configured manual OAuth client even when manual setup is toggled off. See Connectors.
• Activity summary coverage: The activity summary now shows the latest 5,000 sessions. See Sessions.

​

Bedrock provider and artifact tags

• Amazon Bedrock inference: Use Bedrock as an LLM gateway provider for agent runs. See Agents.
• Artifact tags and filters: Tag artifacts and filter them by team or workspace, with the org tag vocabulary also readable over MCP. See Agents.
• Up to 50 subagents: Agents can define up to 50 subagents, and subagent tools now work in Claude Code and the playground. See Agents.
• Slack Enterprise Grid installs: Install the Runlayer Slack app through Enterprise Grid managed installs, and turn off Slack interactive planning when you don’t want it. See Agents.
• Most-used sort by default: The Agents and Skills pages sort by most used out of the box. See Skills.
• Run outcome rate per agent: The usage drawer shows each agent’s run success rate.

• Skill scan risk signals over MCP: Skill reads over MCP include scan risk signals. See Skills.
• Container and WSL detection: The MDM detection option now covers containers and WSL, not just Docker. See Detect.

• Custom OpenAI base URLs: The native OpenAI provider honors a configured base URL, and an ambiguous model name binds to your oldest matching provider instead of erroring. See Agents.
• Connector token auth: Connector clients negotiate supported token auth methods during registration. See Connectors.
• Deployment proxy responses: Public deployment proxy responses strip compression and hop-by-hop headers, fixing corrupted payloads. See Connectors.

​

Per-type scan actions and org tags

• Emergent org tags: Connectors, plugins, skills, and agents are automatically tagged so you can group and find related resources. See Connectors.
• Team-level default for skill device sync: Set whether skills sync to devices by default for a whole team instead of per user. See Skills.
• Clearer error messages: Blocked requests now say what went wrong — size, time, or kind. See ToolGuard.

• Per-type actions for scanning rules: Choose a different action per PII label and credential type instead of one action for the whole rule. See Policies.
• Cursor Cloud hook coverage: Cursor Cloud sessions run under hook enforcement like other clients.

• Anthropic tool scanning: Tool scans complete their full lifecycle, and Anthropic Cowork sessions are classified with the right provenance. See Sessions.
• Codex CLI config: The CLI writes the correct MCP config key for the Codex plugin. See CLI deployment.

​

Connector warnings and settings audit logs

• Shared connector deployment warning: The webapp warns you before deploying a connector that others also use. See Connectors.
• Scheduled runs use the schedule creator: A scheduled agent run executes as the identity of whoever created the schedule. See Agents.
• Slack user-identity sends in the agent UI: The UI shows when Slack MCP actions send as the connected user rather than the bot. See Agents.
• Skills filter bar: Filter the manage-skills page, with the same filters now available to agents over MCP. See Skills.
• Guided Slack agent setup: The Slack agent app workspace walks through prerequisites before install. See Agents.
• Usage token and spend reads over MCP: Agents can read usage-page token and spend data, and usage cost formatting is clearer.
• Plugin lists in Teams: Team and All Workspace plugin tabs load with infinite scroll and server-side search. See Plugins.
• Desktop tray: Admins see recent sessions and can approve access requests from the tray.

• Audit logs for organization settings: Settings changes are recorded in audit logs, with ATLAS techniques on MCP log summaries. See Audit logs.
• AI Watch activity in Shadow: Enforce and Protect block/allow activity is surfaced in Shadow AI. See Shadow AI.

• OAuth reauth dead ends: Stale upstream OAuth sessions are cleared before reauth, and shared-credential reauth routes to the credential owner. See Connectors.
• Skill scans: A skill that crashes the scanner no longer stalls the rest of the sweep. See Skills.
• Shadow AI collection: Collection runs no longer exit before writing results. See Shadow AI.
• Desktop access requests: The access-request row stays visible while the dashboard review is open.

​

CLI self-update and skill scan visibility

• CLI self-update: The CLI updates itself to the matching build for how it was installed, and safely no-ops when it can’t. See CLI deployment.
• Slack channel intro toggle: Turn the agent’s channel intro message on or off per agent. See Agents.
• Session volume timeline over MCP: Agents can read bucketed session volume over time. See Sessions.

• Skill scan failures in the webapp: Failed skill security scans are now visible in the UI, with a summary in CI output. See Skills.

• Policies and scanners UI: The policies action filter renders correctly and the security-scanners client picker no longer breaks. See Policies.
• Slack portal customizations: Manual edits to the long description and background color are preserved instead of being overwritten. See Agents.
• Shadow AI user charts: Charts key by username and device, so per-user activity is no longer merged incorrectly.
• Session grants and accounts: Unpinned session grants count toward the default account.

​

Skill auto-update and Anthropic scanning

• Imported skill auto-update: Opt in to hourly auto-updates so imported skills stay in sync with their source. See Skills.
• Full-screen skill builder: Create skills in a full-screen builder with templates to start from. See Skills.
• Browser extension manual download: Download the extension package directly instead of using the store flow. See Browser Extension.
• Session outcome summaries over MCP: Agents can read a session’s activity and business-outcome summary. See Sessions.
• Slack install outcome on agent create: create_agent now reports the result of the Slack install. See Agents.

• Anthropic tool-result scanning: ToolGuard scans tool results returned through Anthropic inference. See ToolGuard.
• Anthropic inference hooks: New hooks adapter brings Anthropic-based clients under hook enforcement.

• OAuth authorize errors: Authorize requests for an unknown resource return invalid_target instead of a confusing redirect failure.
• AI Watch on Chrome: Runtime Chrome policy is preserved, so monitoring keeps enforcing after a policy refresh.
• CLI MDM profile: The CLI reads its own com.runlayer.cli preference domain, so MDM-managed CLI settings apply. See CLI deployment.

​

Role visibility

• Directory-synced roles: The manage-user page now lists every role synced from your directory instead of only a subset. See Roles.

​

Extension targeting and MCP reads

• Browser extension update targeting: Choose which extension version rolls out to which devices. See Browser Extension.
• PBAC condition operators over MCP: Policy tools now enumerate the available condition operators, so agents build policies without guessing. See Policies.

• Agent run privacy: Runlayer MCP tools redact other users’ agent-run content, so run output is only visible to its owner. See Agents.

• Onboarding connector policies: Existing connector policies are preserved when onboarding runs. See Connectors.
• Deleted skills: Soft-deleted skills no longer show up in agent reads over MCP. See Skills.
• Agent builder: Draft edits apply correctly and live preview takes precedence. See Agents.
• Cursor CLI hooks: Live Cursor CLI hook data is preserved instead of being overwritten.
• OAuth rotation races: Stale rotation-race rejections no longer count as refresh-failure strikes, so connectors stay connected.

​

Cursor coverage and incident badges

• Cursor surface coverage: Runlayer now reports coverage for Cursor alongside your other AI surfaces, so you can see which developer tools are protected.
• Incident badges and compact rows: Incident rows are denser and ATLAS technique badges now open popovers explaining what was detected. See Incidents.
• Larger skill uploads: The skill upload limit is now 5 MB. See Skills.
• Agent management over MCP: New delete_agent tool, plus paging (has_more) on list_agents and list_skills. See Agents.
• Audit log drawer: Pinned table footer and tightened drawer layout when reviewing audit events. See Audit Logs.

• OAuth refresh handling: Connectors that return a nonstandard invalid_refresh_token rejection are now treated as terminal, so you get a clear reconnect prompt instead of silent retries.
• Anthropic model names: Model spellings resolve correctly instead of being inferred from the prefix.

​

Incident detail polish and OAuth fixes

• Incident detail view: Incident tabs, tables, and drawers have been reworked for easier scanning. See Incidents.
• Skill share counts: MCP list_skills now reports how many principals a skill is shared with. See Skills.

• Entra logins: Microsoft Entra OAuth connections no longer re-prompt for consent on every login.
• Firefox AI Watch: The Firefox policy persists outside managed preferences, so it survives restarts.
• CLI on Python 3.10: The CLI runs on Python 3.10 again.

​

Slack agent routing and MCP coverage

• Slack agent routing: Messages to your organization’s Slack app are routed to the best-fitting workspace agent. See Agents.
• Agent control from Slack: Slack runs can use Runlayer’s agent-control tools without extra configuration. See Agents.
• Dynamic plugin installs: The native install flow now offers and installs dynamic plugins. See Plugins.
• Searchable agents tabs: The team and All Workspace agents tabs now search server-side and scroll continuously. See Agents.
• Scanner settings coverage: MCP security scanner settings expose the full REST field set. See ToolGuard.

• MDM configurations: List your MDM configurations over MCP.
• Client blocking capabilities: Read which clients support blocking.
• Session topics and spend: Enumerate session topics and pull spend rollups, plus filter sessions by topic. See Sessions.
• Eval scorers: Discover the available agent eval scorers. See Agent Evals.
• Richer agent reads: Agent model settings, descriptions, skill import sources, and schedule active hours are now readable and writable over MCP. See Agents.
• Session IDs on audit logs: Audit log rows now include the session ID. See Audit Logs.

• CLI security floor: The CLI enforces a higher minimum MCP security level.

• Directory-synced roles: Manual roles can be removed from directory-synced users in the UI.
• Distilled skills: Distilled skills can be removed from the agent UI. See Skills.
• Hosted servers: Hosted uvx servers keep a writable tool directory.
• Slack streaming: Chunk-mode Slack streams stay alive correctly.

​

Device sync, MCP tools, Outlook mailboxes

• Skill device sync: Set an organization-wide device sync default, override it per skill, and let people opt in for their own devices. See Skills.
• Searchable skills tabs: The team and All Workspace skills tabs now search server-side and scroll continuously instead of paging. See Skills.
• Policy condition guidance: The policy builder shows a description and example for each condition field. See Policies.
• Incident scanner shortcut: The Scanner row on an incident links straight to its settings panel. See Incidents.
• Incident audit log filters: Filter incident audit logs directly in the drawer. See Incidents.
• Control navigation: The Monitor section is now called Control.

• Artifacts: Read artifacts and their contents over MCP.
• Skill import from URL: Import skills straight from a public repository URL. See Skills.
• Incident sessions: List the sessions behind an incident. See Incidents.
• AI Watch status: Read AI Watch client and status information.
• Agent starter prompts: Read and update an agent’s starter prompts. See Agents.

• Outlook shared mailboxes: Outlook connections can now use shared mailboxes. See Microsoft Outlook.

• Recursive delete detection: Skill scanning catches split-flag recursive deletes such as rm -f -r. See ToolGuard.

• Codex plugin tools: Dynamic plugin tools now appear directly in Codex. See Agents.

​

Policy builder rework and wider client support

• Policy builder rework: Rebuilt policy builder, including Ask AI drafting that turns a plain-language description into a draft policy. See Policies.
• Teams catalog: Teams now have a catalog page with nested navigation; public/private teams are removed.
• Session timeline filters: Filter and keyword-search the session timeline directly in the drawer. See Sessions.
• Editable starter prompts: Edit an agent’s starter prompts in agent settings. See Agents.
• Per-OS installer downloads: Grab the right installer for each operating system from the Client Updates page. See Updates.
• Guided onboarding: New organization setup flow with a deep-linked checklist, clearer labels, and connector-complete policy defaults.

• Windsurf, Qwen Code and Gemini CLI: Session hooks and enforcement now cover Windsurf, Qwen Code and Gemini CLI. See Sessions.
• Scheduled CLI tasks: runlayer schedule runs per-user tasks on a schedule, with macOS LaunchAgent support.
• Test Device guide: Package-based Test Device setup guide. See Test Device.

• Client PII rule overrides: Override PII detection rules per client. See Policies.

• Browser capture: Perplexity and DeepSeek responses parse correctly again, Bolt sentinel responses are excluded, and Lovable and ChatGPT handoff replies are captured. See Detect.
• Chrome policy on macOS: Synced Chrome policy now refreshes on macOS.
• OAuth token TTL: Connections stay signed in when a provider omits expires_in from its token response. See Connectors.

​

Incident grouping and browser enforcement

• Native tool incidents grouped by class: Dev-tool incidents without a server now group under Terminal and Filesystem classes instead of fragmenting across dozens of per-tool, per-casing groups. See Incidents.

• Grok live enforcement: Pre-send enforcement and exact response capture work again after Grok moved to a new message envelope. See Enforce.
• Google Notebook host move: Prompts on notebook.google.com are captured and attributed to NotebookLM again. See Detect.

​

Codex sync, Intune macOS, ToolGuard status

• ToolGuard status monitoring: Track scanner status in the dashboard, alongside a customer-visible model changelog. See ToolGuard.
• Session scanning cards: Full-session scan results are now split into discrete cards. See Sessions.
• Max reasoning effort: Agents can now run with a max reasoning effort setting. See Agents.
• Outcome-aware incident severity: Severity is now scored from outcomes, with a recalibrated reason map. See Incidents.
• Slack notification scope: Toggle security notifications between incidents and alerts. See Slack Notifications.
• Broader shadow MCP detection: Wider MCP-server source-code signatures and corrected Shadow labeling; weak client evidence is now classified as traces. See Detect.

• Codex auto-sync: Codex configuration now syncs automatically. See Agents.
• Intune (macOS) deployment: Deploy the agent to macOS fleets via Intune from the MDM wizard. See Intune (macOS).
• Managed CLI auto-updates: Schedule automatic updates for the managed CLI.

• Team default permissions: Edit a team’s default permission and cascade it to shared assets. See Roles.
• Disabled connectors issue no tokens: OAuth token issuance is now gated on the connector not being disabled. See Connectors.

• Browser extension capture: Repaired provider capture and session recording in the browser extension.
• Token refresh reliability: Connections stay signed in more reliably when a lot of requests happen at the same time, and refresh problems are now recorded so they surface faster.
• Approvals: Automatic Slack approval retries stopped; blocked users are directed to Slack. See Approvals.
• Local tool sync: Local tools re-sync after configuration changes.
• Interactive artifacts: Popups now work inside the interactive artifact iframe sandbox.
• Transient upstream 401s: Read-only MCP operations retry once in-request after an upstream 401.

​

Agent eval tools and wider enforcement

• Agent eval runs via Runlayer MCP: New Runlayer MCP tools to create and read agent eval runs. See Agent Evals.
• Sessions ↔ audit cross-linking: Move between sessions and audit logs with stacked drawers. See Sessions.
• Violation Type column: Security audit views now include a violation Type column. See Audit Logs.
• Agent run naming: Agent runs are named from session labels, with analyzers firing on subagent stop. See Agents.

• OAuth redirect URI allowlists: A wildcard optimizer flow for OAuth redirect URI allow/deny lists. See Policies.
• PBAC list operators: contains / not_contains policy operators now accept list values. See Policies.
• Sync-only API keys: New skill_sync org-key role for sync-only keys.
• MDM session ingestion: The MDM session-ingestion setting is now enforced.

• Expanded browser enforcement: The browser extension now enforces Lovable, Bolt, Poe, Meta, and Grok surfaces.
• Vercel Eve sessions: Capture Vercel Eve sessions through native hooks.

​

Slack MCP OAuth, Detect drift, and approval surfaces

• Slack MCP (OAuth): Connect Slack MCP through a managed OAuth profile in the broker. See Connectors.

• Detect configured vs running: Detect now surfaces configured-vs-running state with runtime shadows, so you can spot drift between declared and actually-running MCP setups. See Detect.
• Intune packaging: The Intune deployment card now offers a .intunewin package plus a signed detection script for easier MDM rollout. See Detect.
• Approval policy surfaces: New approval policy surfaces across the dashboard and Runlayer MCP. See Policies.
• Scanner policy provenance: The dashboard now shows where each scanner policy came from. See ToolGuard.
• Incident sessions toggle: Toggle related sessions directly on the incident detail view. See Sessions.

• Slack outbound messaging controls: New controls to govern outbound messaging from Slack-based agents.
• Policy details in audit events: Audit events now include the policy details behind each decision. See Audit Logs.

• AI Watch config sync: AI Watch configuration changes are now reported immediately.
• Local connectors visibility: The org-install skill no longer suppresses Runlayer local connectors.
• Directory sync cleanup: Deleted groups are now cleaned up during directory sync.
• Server log paging: ECS server logs now page correctly across large CloudWatch result sets.

​

Global Policies, skills, and new models

• Global Policies page: See every policy in one view, with a pinned pagination footer for easier navigation. See Global Policies.
• Version history for skills & agents: Review diffs across versions with a polished comparison dialog. See Agents.
• Skill auto-sync: Skills now sync automatically as first-class entities, with assigned-skills visibility in ai-watch. See Agents.

• Kimi K3 (Baseten): Select Kimi K3 via Baseten as an agent model. See Agents.

• Security score stability: /tool_list security scores now return stable, consistent results. See ToolGuard.

​

Current version in lists

• Current version everywhere: Agent and skill list and detail views now report the current version directly, so version history reflects the live head without an extra lookup. See Agents.

​

Claude Opus 5 and version history

• Claude Opus 5: Select Claude Opus 5 as the model for your agents. See Agents.
• Agent & skill version history: View and restore previous versions of agents and skills, with version context now recorded on update audit events. See Agents.

• Admin request search: Server-side search across the /admin/requests inbox for faster review.
• Scan correlation IDs: Security scoring responses now include scan_id and tool_fingerprint; pass your own x-runlayer-scan-id header to correlate scans. See ToolGuard.
• Safer connection edits: Agent account connection grant changes are staged until you Save.

• List up to 500 servers: Server listings no longer cap early on large catalogs.
• Plugin shared skills: The Runlayer Plugin now includes shared skills.

​

Protect denylists, ToolGuard feedback, and agent visibility

• Protect MCP denylists: Block known-bad MCP sources by remote URL, npm/PyPI package, or client built-in — allow-unless-denied source governance in Protect mode, without switching to Enforce’s deny-by-default posture.
• ToolGuard feedback API: Report ToolGuard false positives and false negatives via a new POST /api/v1/security/feedback endpoint, using the same API key and role as the ToolGuard scoring endpoints. See ToolGuard.

• Live AI Watch settings sync: Dashboard changes to AI Watch settings now reach managed endpoints automatically, without rebuilding and re-pushing the MDM policy.
• Agent MCP activity: The agent account Activity view now shows tool calls and other MCP events performed by the agent, not just lifecycle and delegation rows. See Agents.
• Slack agent attachments: Slack-based agents can now reliably read image and PDF attachments shared in a thread.

​

New connectors and workspace controls

• Audited remote MCP servers: New vetted remote MCP servers are available in the catalog. See Connectors.
• Google Forms: Added write tools for Google Forms. See Connectors.

• Workspace management: Add or remove skills, plugins, and agents directly from any All Workspace tab. See Skills, Plugins.
• Requests inbox: Unified /admin/requests view with infinite scroll for faster review.
• MDM scan toggles: Turn process and container detection on or off from the MDM config UI. See Detect.
• Legacy Linux support: The Runlayer CLI and AI Watch now ship glibc 2.17 builds for older Linux distros. See Linux CLI.
• Codex client: Runlayer now recognizes the Codex MCP client.

• Session-linked audit logs: Audit log entries are now associated with their session, so you can trace activity end to end. See Audit Logs, Sessions.
• WSL scanning: Home-directory artifact scanning now covers WSL home directories.

​

Offline agent evals and connector improvements

• Offline agent evals: Replay agent runs with overrides, scored by an LLM judge plus custom scorers.
• Skill and plugin owners: Owners are now shown on skill and plugin cards.
• Trial budgets: Platform trial budgets are now surfaced in the webapp.
• Webhook run-as-agent-account: Webhooks can run as an agent account for true machine-to-machine runs.
• Plugin v2 + multisearch: Plugin v2 is now integrated with multisearch.
• Team icon colors: Team icons now use dynamic background colors.
• Agents picker: The agents picker now supports infinite scroll and server-side search.

• Faster connector pickers: Connector pickers now paginate and lazy-load for faster loads.
• Manual OAuth in the CLI: Manual OAuth is now supported in the local CLI.
• CLI deploy link: The CLI deploy link now points at the connector deployment-runs tab.

• Connector descriptions: Deployment connector descriptions are now preserved.
• Claude settings: Claude settings are now preserved during MDM updates.
• Resumed sessions: Resumed session duration is now cleared correctly.
• OAM link metric filter: The OAM link metric filter is now applied as a single IN condition.
• Agent environment variables: Saved agent environment variable descriptions are now clearer.
• Duplicate eval button: Removed a duplicate “new eval” button.

​

Org logo upload and AI Watch coverage

• Organization logo: You can now upload your organization’s logo to brand your Runlayer workspace.

• Broader scan coverage: AI Watch now covers more agent definitions and container artifacts, so more of your environment is scanned. See AI Watch.

• Session endings: Resuming a session no longer produces duplicate session-end events. See Sessions.

​

Sourcegraph connector and agent schedules

• Sourcegraph: The official Sourcegraph MCP server is now available in the catalog. See Connectors.

• Active-hours agent schedules: Agent schedules now support an active-hours window, so agents only run during the times you choose. See Agents.

• Slack blocked-channel enforcement: Slack interactions are now blocked in channels you’ve blocked, closing an enforcement gap.
• Redirect-URI denylist for manual callbacks: Manually registered client callbacks now respect your org’s redirect-URI denylist.

• OAuth token refresh: Failed upstream token-refresh cycles now use escalating backoff, improving connector reliability.
• AI Watch scans: Resolved re-audit findings for more accurate scan results. See AI Watch.
• Agent skills: Skills deleted during a sync retry are now correctly recreated.
• Catalog suggestions: The app no longer invents pending catalog connectors from prompt keywords.

​

AI Watch auto-update and scanner controls

• Self-updating installers: The AI Watch agent now auto-updates on Windows and Linux, so endpoints stay on the latest version without manual reinstalls. See AI Watch.
• Clearer scan status: Scan-unavailable states are now shown separately from security verdicts, and scan dedupe, detection confidence, and transport labels are more accurate.

• Customizable block messages: You can now customize the security block message shown when a scanner violation blocks a request.
• Incidents and sessions from MCP: View incidents and sessions directly through the Runlayer MCP tools.

• Plugin access: Non-admin users now see the plugins they have access to.
• Enforce-mode connectors: Verified claude.ai connectors now resolve correctly under MCP enforce.
• Usage timeline: Empty sessions no longer appear in the timeline.

​

Shadow AI client discovery

• AI client inventory: AI Watch now detects installed AI clients during scans and classifies them as shadow or managed, with a new client catalog and installation tables in the Shadow AI overview. See AI Watch.
• Runtime process & container sightings: MCP processes and MCP configs found inside running containers are correlated as runtime sightings in the UI. See AI Watch.
• Allowlist shadow AI clients: Allowlist discovered AI clients and drill into per-client audit detail. See AI Watch.
• Per-user enforcement disable: Enforcement can now be disabled for individual users. See Enforce.
• Policy-selected installers: Download the AI Watch installers selected by your policy. See AI Watch.
• Auto-provision AI Watch users: Users surfaced during AI Watch scans that don’t match an existing account are now automatically provisioned. See AI Watch.

• Agent usage vs limits: Agent settings now show current usage against run limits and cost budgets. See Agents.
• Redesigned session alerts: The session alerts panel now rolls up findings for a clearer view.
• client_credentials OAuth: Remote MCP servers now support the client_credentials upstream OAuth mode. See Connectors.
• Standalone M2M access: Owner opt-in for standalone machine-to-machine MCP access grants.

• Windows AI Watch scans: Fixed a crash on path digests during scans on Windows.
• Claude Code plugins: AI Watch now scans Claude Code marketplace-bundled plugins.
• Google Slides & Calendar: Catalog tool lists are now populated for these connectors. See Connectors.
• Browser find on settings: Cmd/Ctrl+F no longer hijacks the browser’s native find on settings pages.

​

New connectors and skills cleanup

• Carta, Egnyte, Make, and Replit: Four new MCP servers are now available in the catalog. See Connectors.

• Skills management: Get a heads-up when a similar skill already exists before you create one, see where each skill is used and sort the list, and find and safely clean up duplicate skills. See Skills.
• Unused agents cleanup: A new Unused tab on the Agents page surfaces zombie agents with a last-used badge so you can clean them up. See Agents.
• Usage Activity widgets: The Usage Activity dropdown is now unpacked into six dedicated widgets for clearer at-a-glance insights. See Analytics.
• In-app what’s-new: A what’s-new card and changelog dialog now surface the latest updates directly in the app.
• AI Watch device filters: Unified device filters across AI Watch views. See AI Watch.

• Secret redaction in get_deployment: The get_deployment MCP tool now redacts environment secrets from its output. See Deploy.
• Short-lived token refresh: OAuth now applies a lifetime-relative inline-refresh floor so short-lived upstream tokens refresh reliably.

• Slack auth prompts: Authentication prompts are now sent as direct messages. See Slack.
• AI Watch CLI: aiwatch scan no longer crashes on unexpanded $VAR config paths.
• Spend charts: Sparse spend data is zero-filled so spend charts render continuously.

​

Per-client scanning and Enforce allowlists

• Per-client security scanner overrides: Security scanner settings can now be overridden per MCP client, so you can scan some clients more strictly without changing the global configuration. See ToolGuard.
• Granular credential masking: New controls for choosing exactly which credential types the credential scanner masks. See ToolGuard.
• AI Watch scanner container: Run AI Watch Detect scans from a container image — standalone or on Kubernetes via the provided DaemonSet and CronJob manifests. See Container deployment.
• AI Watch Enforce: MCP allowlists and built-in tool blocks: Enforce policies now support allowlisting MCP servers and blocking built-in client tools, with an allowlist editor and expanded safe defaults. See Enforce.
• Audit logs: sub-day time filters: Filter audit logs down to specific hours, not just days. Also new audit events for agent enable/disable and security scanner settings changes. See Audit Logs.
• CLI MDM deployment guides: New per-platform guides for deploying the Runlayer CLI via MDM. See Runlayer CLI.
• Microsoft Teams connector: Now out of alpha. See Microsoft 365.

​

Monitor dashboard and managed client updates

• Monitor dashboard: New Monitor home for admins with workspace-wide insights; admins now land on Monitor after login.
• Build plugins from anywhere: Multi-select connectors and skills to create or extend a plugin, and add-to-client flows now recommend the Runlayer Plugin. See Runlayer Plugin.
• Client update policies: Admins can now control how managed Runlayer CLI / AI Watch installs update, with backend-managed update channels and native installers (including Windows MSI and Linux packages).
• Runlayer Deploy on Kubernetes: Deploy-hosted MCP servers can now run on Kubernetes (enterprise), with pod logs and status visible in the deployment UI. See Deploy.
• New client guides: Setup guides for Cursor Cloud Agents and Vercel Eve agent accounts.

​

AI Watch on Linux, agent memory

• AI Watch on Linux: Detect-mode support for Linux via native packages, with a deployment guide. See Linux deployment.
• Scoped agent memory: A second memory system alongside workbench memory — agents persist and recall scoped memories across runs. See Agents — Memory.
• GPT-5.6: Available as an agent model when OpenAI is configured as an LLM provider.
• Workday connector guide: New setup guide for the Workday connector. See Workday.

• Microsoft Teams MCP: A new Microsoft 365 connector built on Microsoft Graph delegated permissions (no M365 Copilot license required). Browse teams and channels; read and send channel messages and threaded replies; read and send 1:1 and group chat messages; create and manage chats and channels; and manage chat and channel members. See Microsoft 365.

​

Agent builder and smarter skill scanning

• Agent builder: New dedicated agent creation page with a guided flow.
• Beta connectors + custom OAuth client names: Catalog connectors can now register with a vendor-required OAuth client name and be flagged as beta — unblocking the Figma remote MCP, among others.
• Slack: agents propose help: Invite an agent to a channel and it introduces itself with what it can help with there.
• Skill scan transparency: Skill imports now show the exact source snippet behind each security finding, and shadow skills open in a viewer with inline risk annotations.
• Deploy: paginated deployment logs: Deployment logs now paginate in the UI. See Deploy.
• Settings search: New search box in the Settings sidebar.
• Web AI Watch: precise capture: The browser extension now has dedicated capture for 10 AI chat web clients, reducing false positives.

​

New models and model governance

• Claude Fable 5 and Sonnet 5: Available as agent models when Anthropic or AWS Bedrock is configured as an LLM provider.
• Model governance: Restrict which LLM models each role may use, and configure a recommended model for the workspace. See LLM Providers.
• ⌘K command palette: Now includes actions, recent items, and quick settings.
• OAuth-disconnected notices: When a connector’s OAuth connection stops working, users see a clear reconnect notice in their MCP client instead of opaque errors.
• Teams: Plugins tab: Manage team-scoped plugins from the team page.
• User identity attributes: Directory identity attributes are now shown on the user detail page.
• Faster large workspaces: Infinite scroll and server-side pagination on the agents, skills, and connectors pages.
• AI Watch: Scan project depth and timeout are now MDM-configurable, plus a new AI Watch FAQ.
• New catalog connector: Ashby.

• Agent Slack app icon sync: Agent icons are now synced to Slack app bot profile images. When you create a Slack app for an agent or update an agent’s icon, the icon appears in Slack within seconds. If no custom icon is set, the app uses the Runlayer logo.

​

Copilot CLI hooks, account management

• Connector accounts: rename & disconnect: Rename or disconnect a connected account directly from the connector account menu.
• GitHub Copilot CLI hooks: AI Watch session monitoring and enforcement now cover GitHub Copilot CLI.
• Customizable no-access message: Customize the message users see when a policy blocks access to a connector.
• Agents list sorting: Sort agents by run count and people count.
• Global policy creation: Streamlined create-policy modal with clearer condition fields. See Policies.
• Usage accuracy: Provider token usage is now captured from Claude Code transcripts for accurate per-session accounting.

​

Home tab and agent spend analytics

• Home tab: New Home page with a guided build flow for creating agents, connectors, skills, and plugins from one place.
• Shareable artifacts: Agent artifacts can now be shared with other users.
• Agent spend analytics: Usage now breaks down LLM spend by agent. See Analytics.
• Shadow AI at scale: Drill-downs and server-side filtering and pagination on the Shadow dashboard for large fleets.
• Deploy: search & pagination: Server-side search, pagination, and infinite scroll on the deployments list.
• New catalog connector: Tinybird.

​

Self-improving agents and cost budgets

• Self-improving agents (opt-in): Agents can distill reusable Skills from their successful runs, refining and deduping existing skills instead of piling up new ones. Per-agent toggle; distilled skills stay private to the agent. See Agents.
• Agent cost budgets: Set LLM cost budgets per agent. See Agents.
• Artifacts via Runlayer MCP: Create, update, list, and delete artifacts programmatically. See Runlayer MCP.
• Codex: native skill install: Skills now install natively into Codex.
• AI Watch: browser extension via MDM: The CLI installs the AI Watch Chrome extension and policy from MDM configuration.
• Teams: settings dialog: Rename a team, set its icon, and control its visibility.
• Catalog: official Snowflake Cortex MCP: Replaces the Runlayer-built Snowflake server, which is now deprecated. See Snowflake.

​

Azure AI Foundry and device monitoring

• Azure AI Foundry: Available as an LLM provider for agents. See LLM Providers.
• AI Watch Devices tab: Device inventory on the Shadow dashboard with per-feature check-in and health monitoring.
• VS Code hooks: AI Watch session monitoring and enforcement for VS Code.
• Goose hooks: Hook support for the Goose client.
• Teams: skill sharing: Team owners can share skills with their team.
• Incidents: filtering & priority: Filter the incidents list, Severity renamed to Priority, and improved Slack incident formatting. See Incidents.
• Agent ownership transfer: Admins can change an agent’s owner from the Share modal.
• Connector metrics: unique users: Connector activity metrics now include unique user counts.

• AI Watch on Windows: device-local Scheduled Tasks: The Windows MSI now registers its own Scheduled Tasks at install (a SYSTEM hooks task plus a per-user S4U scan fan-out) instead of relying on Intune Remediations — so AI Watch no longer needs Intune P2 / Remediations, and scans run in each user’s context with no interactive logon, mirroring the macOS launchd model. Tasks live in a hidden, permission-locked \Runlayer Task Scheduler folder and self-heal; use the bundled detect-install.ps1 as the Intune custom detection rule. See Intune deployment.

​

CLI catalog browsing and UI polish

• Collapsible navigation: Sidebar sections can now collapse, persisted per browser.
• Agent artifacts tab: Each agent page now has an Artifacts tab listing the files it has published.
• CLI catalog browsing: Browse skills, plugins, and connectors from the terminal with the new runlayer catalog commands.
• Power BI OAuth fix: Resolved the Entra resource conflict that blocked Power BI MCP OAuth.
• New catalog connector: Chili Piper.

​

AWS Bedrock and AI provider settings

• AWS Bedrock LLM provider + AI Providers settings: Configure AWS Bedrock as an agent LLM provider and manage all providers from the new Settings → AI Providers page; each agent can pick its own provider and model. See LLM Providers.
• Automatic session titles: Sessions now get generated titles so they’re easier to scan. See Sessions.
• Test Connection: interactive tool runner: Run a connector’s MCP tools with real inputs directly from the Test Connection drawer.
• OAuth redirect-URI consent: OAuth authorization to unrecognized redirect URIs now requires explicit consent, with an inline consent card and an admin-managed approved list.

​

Artifacts gallery, simpler AI Watch deployment

• Artifacts gallery: Browse all artifacts published by agents in one gallery. See Agents — Artifact publishing.
• AI Watch: single org-key deployment: MDM deployment now uses one org API key with capability flags for all AI Watch features — no more per-feature credentials. See Deploy AI Watch.
• Per-user credentials for hosted stdio connectors: Deploy-backed stdio servers can prompt each user for their own environment variables (e.g. personal API keys).
• Custom connector icons: Pick an icon when creating a custom connector.
• Auto-created access policies: New connectors automatically get an access policy at creation. See Policies.
• Incidents page UX: Refreshed incidents layout and workflow. See Incidents.

• Microsoft Outlook Calendar: lighter event lists: Listing calendar events now returns smaller summaries by default. See Microsoft 365.

• Google Docs table editing: edit_table can now overwrite an entire row in one call with set_row_text (one value per column), and style_cell accepts a padding option to set cell padding on all four sides (in points). See Google Workspace.

• Microsoft OneDrive document text extraction: onedrive_read_file now extracts text from Word (.docx), PDF, PowerPoint (.pptx), and Excel (.xlsx) files server-side instead of returning raw package bytes, so agents can review PRDs, RFPs, decks, and spreadsheets. Plain-text files are unchanged. Extracted text is capped and flagged with truncated when it exceeds the limit. See Microsoft 365.

​

Skill editing and new connectors

• Skills: edit & rename: Edit skill contents and rename skills directly in the UI. See Skills.
• Audit logs: Unredacted filter: Unredact events now appear as a filterable event type. See Audit Logs.

• Metabase (native): Official native Metabase MCP replaces the Runlayer-deployed server. See Metabase.
• Deel: New hosted Deel MCP connector.

• Microsoft SharePoint exact site lookup: sharepoint_search_sites now resolves an exact site name (including hyphenated names like IntermediaInc-ITSA), a full site URL, or a server-relative path via direct path lookups before falling back to the tokenized tenant search, and surfaces exact matches first. See Microsoft 365.
• Microsoft Outlook Calendar lightweight lists: outlook_calendar_list_events and outlook_calendar_list_calendar_view now return lightweight summaries (a short bodyPreview instead of the full event body), so date-range lists stay compact and no longer truncate. Use outlook_calendar_get_event for the full body. See Microsoft 365.

• Microsoft Outlook in-thread reply drafts: New outlook_create_reply_draft tool saves a Reply or Reply-All as an editable draft nested inside the original conversation, so you can review and send it later instead of sending immediately. See Microsoft 365.

• HITL Notify-Only: New asynchronous approval mode for agents — when a guarded tool call fires, approvers receive a Slack notification and the run pauses until they allow or deny. See Agents — HITL.
• Settings IA: All admin pages (Roles, Policies, Security Scanners, Workspace, MDM Configuration, etc.) have moved under Settings with a left-side nav.
• Agent example prompts: New agents include curated example prompts on the detail page to help users get started faster.
• Quarter-hour agent schedules: Agent schedules now offer :00, :15, :30, and :45 options for sub-hour cadences.
• Slack channel blocklist: Admins can now block specific Slack channels from triggering agent runs.
• Slack step labels: bash sleep N agent steps now render as Waiting Ns in Slack transcripts instead of the raw shell command.
• Slack private channel tolerance: Agents now degrade gracefully when the Slack app is missing private-channel scopes instead of failing the run.
• Runlayer MCP export_audit_logs trims noise: The export tool now strips verbose internal details fields by default; pass an opt-in flag to include them.
• Catalog: Metabase full payload schemas: The Metabase MCP catalog entry (1.0.1) now allows full card payload schemas.

• Sessions hooks installed by default: MDM deployments now install the full event/session hook set by default. Set the Sessions MDM field to false to keep enforcement-only hooks. See Deploy AI Watch.
• Identity Forward on any connector: Identity Forward is no longer limited to Runlayer Deploy. Enable plain X-Runlayer-* headers or the signed JWT on any HTTP-based connector (Streaming HTTP or SSE) from the connector’s configuration. See Deploy — Identity Forward.
• Skill upload: single .md file: The web UI now accepts a single .md file when creating a skill. The file is treated as SKILL.md, and the skill name is derived from frontmatter, the first heading, or the filename. See Skills — Uploading from the web UI.
• Claude Agent SDK integration: New integration guide for wiring Runlayer MCP servers into the Claude Agent SDK, covering HTTP transport, multiple servers, and agent account auth. See Claude Agent SDK.
• Hooks TypeScript SDK: framework adapters: The Runlayer Hooks TypeScript SDK now ships adapters for Vercel AI SDK, OpenAI Agents SDK, and Google ADK tool wrappers, in addition to Claude Agent SDK hooks. See Hooks TypeScript SDK.
• ToolGuard: embedded resource masking: PII and hidden-character masking now covers all MCP content block types, including embedded resources.
• MDM Configuration wizard: A guided wizard in Settings → MDM Configuration walks admins through picking an MDM platform, configuring detect or enforce mode, and downloading deployment artifacts.
• CLI 0.24.14: macOS keychain prompt fix for MDM-deployed binaries; improved hook reliability.

• Webhook authorization: Agent webhooks can now require API-key authentication. Enable it per-webhook and create a scoped API key directly from the webhook dialog. Unauthenticated requests are rejected. See Agents — Webhooks.
• Runlayer MCP: bulk audit log export: New export_audit_logs tool for exporting audit logs as JSON or CSV — no 90-day hot-window restriction, up to 10 000 rows per call. See Runlayer MCP.
• Hooks TypeScript SDK: agent account auth: The Runlayer Hooks TypeScript SDK now supports authenticating as an agent account via client_credentials token exchange, including OBO (on-behalf-of) agent tokens. See Hooks TypeScript SDK.
• SIEM export: customer-owned bucket: SIEM audit log export now supports writing directly to a customer-owned S3 bucket in addition to the Runlayer-owned bucket pattern. See Audit Logs — SIEM Export.
• Shadow Skills analytics: The Shadow page now includes a Skills section with discovery timeline, most common shadow skills, users with shadow skills, and per-client breakdown.
• Subagent events in timeline: Agent run timelines now render subagent tool calls and events inline, giving full visibility into delegated work.
• Claude Opus 4.8: Claude Opus 4.8 is now available as an agent model when Anthropic is configured as an LLM provider.
• Connector Permissions tab: The server-level “Policies” tab has been renamed to Permissions for clarity. Global policies under Admin → Policies are unchanged. See Policies.
• New catalog connectors: AWS MCP, Supernova Relay MCP.

• Microsoft Outlook Calendar: New Outlook Calendar MCP connector with 11 tools covering event CRUD, invitation responses (accept/decline/cancel), meeting-time suggestions, and free/busy lookup. Shares the same Entra app registration as the other Microsoft 365 connectors; add the Calendars.ReadWrite delegated scope. See Microsoft 365.

• Security Scanners redesign: The Security Scanners settings page now groups scanners by lifecycle phase (catalog admission, per-call scanning, session monitoring) and introduces the Mask violation action. Mask redacts detected content (PII values, hidden characters, credentials) and lets the request continue — giving you a middle ground between alerting and blocking. Scanner labels are clearer: “Invisible character detection” and “Credential detection”. See ToolGuard — Violation Actions.
• Self-serve SCIM role mapping: Admins can now configure SCIM groups-to-roles mapping directly in Settings → Workspace → Manage Directory Sync without contacting support. See Roles — SCIM Role Sync.
• Agent clone: The agent “Duplicate” action has been renamed to Clone for clearer terminology. Cloning copies an agent’s configuration, connectors, and tools into a new agent owned by you.
• CLI 0.24.9: The CLI now trusts system CA certificates, fixing connectivity issues in environments with corporate proxy certificates or custom CAs.
• Intune Deployment Package: scan-on-detect option: The Intune deployment package now ships two remediation strategies — Scan on detect (simpler, one script) and Detect staleness + remediate (follows Intune best practice). (Superseded by device-local Scheduled Tasks in 1.28.69.) See Intune deployment.

• Enforce: plugin MCP servers intercepted: Enforce now detects MCP servers bundled in native client plugins (e.g. Claude Code marketplace plugins). Plugin-provided MCP endpoints are subject to the same enforcement rules as any other shadow MCP — they must point at a Runlayer proxy URL or be on the remote URL allowlist.
• Enforce: always-on shadow blocking: Shadow MCP enforcement on the hook path is always active once hooks are installed, regardless of the Full session scanning toggle in workspace settings.
• PII scanning: pattern-based detection: PII scanning now uses regex patterns with validators instead of heuristics. Built-in types: SSN, credit card, phone, email, passport, driver’s license, IBAN, IP address, date of birth, MRN, VIN, Bitcoin address, and Ethereum address. Custom regex rules continue to work alongside built-in patterns. See ToolGuard Models.
• Runlayer MCP server tools: full REST parity: The create_server and update_server Runlayer MCP tools now support all fields from the REST API, including OAuth configuration (manual and broker), audit log sensitivity, tool output offloading, MCP fingerprint, and deployment association.
• Runlayer MCP agent tools: create_agent now accepts model and icon parameters. update_agent now supports is_disabled to enable or disable an agent programmatically.
• Deploy org API keys: Organization API keys can now be scoped with the Deploy role for CI/CD pipelines. See Deploy — Organization API Keys.
• Helm: custom trusted CA bundle: Self-hosted Helm deployments can now mount a custom CA certificate for outbound HTTPS through enterprise proxies.
• Helm: existing backend secret: Reference a pre-existing Kubernetes Secret for backend credentials instead of having the chart create one.
• Helm: DB reader endpoint: Configure a read-replica endpoint to offload read traffic.
• Detect: expanded client support: AI Watch scans now discover MCP configs in Cline, Cline CLI, Gemini CLI, Antigravity, and GitHub Copilot CLI.
• Codex setup: native add command: Codex client setup now uses codex mcp add <name> --url <proxy> for a smoother install flow.
• Shadow reports: user attribution: Shadow discovery reports now show which user each shadow MCP server belongs to.
• Outlook tools expanded: Additional calendar and mail management tools added to the Microsoft 365 connector.
• Salesforce troubleshooting: Added guidance for resolving the “consumer secret is required” error when using External Client App credentials.
• New catalog connector: Ramp Data (read-only financial data, transactions, and reporting analytics).
• CLI 0.24.6 → 0.24.8: Hook enforcement reliability improvements, expanded client scanning, and bug fixes.

• Agent artifacts: Agents can now publish files from their workspace as shareable URLs using the built-in publish_artifact tool. Use it to share generated reports, CSVs, or any file with end users. Artifact publishing is enabled by default on new agents. See Agents — Artifact publishing.
• Runlayer MCP: agent memory toggle: The create_agent and update_agent Runlayer MCP tools now accept an enable_memory parameter so you can enable or disable built-in agent memory programmatically.
• Shareable session links: Agent run sessions can now be shared via a direct link from the sessions list.
• CLI 0.24.4 → 0.24.6: Improved AI Watch hook enforcement reliability on Cursor; internal stability fixes.

• Analytics: Skill risk assessment: The Skills tab now includes a Skill risk assessment widget showing skills ranked by security score with per-skill risk level badges (High, Medium, Low, Minimal, Unknown). See Analytics.
• Analytics: Plugin usage by client: The Plugins tab now includes a Plugin usage by client widget showing which MCP clients generate the most plugin activity. See Analytics.
• Slack DM mode via Runlayer MCP: The update_agent Runlayer MCP tool now supports setting slack_terminal_run_dm_mode to control run-result DMs (always, errors_only, or disabled) without using the UI.
• Agent templates refreshed: Agent creation templates have been replaced with a new set distilled from real workspace patterns, including 1:1 Prep, Release Notifier, Account Intelligence, Daily Briefing, and others.
• CLI 0.24.3: Bug fixes for skill and plugin install name resolution.

• GPT-5.5: GPT-5.5 is now available as an agent model when OpenAI is configured as an LLM provider. See LLM Providers.
• New client setup guides: Setup instructions are now available for Zed, Cline CLI, GitHub Copilot CLI, and Antigravity.
• Microsoft OneDrive & SharePoint: OneDrive and SharePoint MCP connectors are now available. The Outlook, OneDrive, and SharePoint setup guides are consolidated into a single Microsoft 365 page.
• Runlayer MCP server management: Runlayer MCP now supports creating, updating, and deleting connectors (admin-only, confirm-required). See Runlayer MCP.
• Shadow Connectors widgets: The Shadow page now includes a Connectors section with most common shadow servers, users with shadow servers, top servers to migrate, and MCP client usage breakdown.
• Agent accounts for all users: All workspace members can now view agent accounts, create delegations, and create session grants — no longer limited to admins.
• Slack say on all triggers: The agent say tool now works on webhook and scheduled runs (not just Slack-triggered runs) when the Slack MCP connector is attached.
• Agent memory opt-in: Agent memory is now opt-in — enable it from the agent’s advanced settings. Previously it was automatically available on all agents.
• Agent cross-turn context: Agent conversations now include tool calls and results from prior turns, giving the model better continuity across multi-step tasks.
• Agent LLM gateway settings: Self-hosted OpenAI-compatible gateway environment variables are now deprecated in favor of workspace LLM provider settings. Existing environment variables continue to work as a temporary fallback and emit a deprecation warning.
• New catalog connectors: Skyvern is now available in the connector catalog.
• Claude Code plugin install: Plugins are now installed into Claude Code via the marketplace format for better compatibility.

• PII scan direction: PII detection can now be scoped to tool inputs, outputs, or both. Configure globally in Settings → Security Scanners or override per connector. Defaults to input-only. See ToolGuard Models.
• Agent365 Work IQ branding: All Microsoft Agent 365 servers in the connector catalog now include the (Work IQ) suffix to align with Microsoft’s updated product naming.
• Admin setup instructions for all users: A new workspace setting (Settings → Workspace) lets admins show the full admin-facing client setup instructions to every user, not just admins.
• Shadow Connectors widgets: The Shadow page now includes a Shadow vs Managed breakdown chart and a Shadow Server Discoveries timeline.
• MDM guide refresh: Detect and Enforce MDM deployment guides have been refreshed with updated naming (Iru, Kandji) and streamlined instructions.
• Microsoft Outlook MCP: A dedicated Outlook setup guide is now available for the Outlook MCP connector.
• New catalog connectors: Fellow, Tines, Kubernetes, and Superhuman Mail are now available in the connector catalog.
• Agent account creation simplified: The outdated connector setup step has been removed from the agent account creation flow.

• Shadow page: Shadow discovery metrics (MCP servers and skills) now have a dedicated page in the sidebar, separate from the Analytics dashboard.
• Skill security scores: After uploading skill files, the skill detail page displays the overall security score and per-file risk indicators with a drill-down dialog for each finding.
• Manual skill security rescan: Skill owners and admins can trigger a security rescan from the skill detail page for skills uploaded before scanning was enabled.
• Agent activity security section: Each agent run in the Activity view now includes a collapsible Security section showing ToolGuard scan results, policy denials, and warnings.
• Schedule timezone modes: Agent schedules now support a Local wall clock mode that evaluates the cron expression in the selected timezone and automatically adjusts for DST transitions.
• Auto-grant delegation: Starting your first interactive chat with an agent automatically grants a delegation so the agent can act on your behalf.
• Identity Forward: Any HTTP-based MCP connector (Streaming HTTP or SSE) can now receive the authenticated caller’s identity via X-Runlayer-* headers or a signed JWT. Enable it in the connector’s configuration. See Deploy — Identity Forward.
• Policy-blocked tools flagged: Tools and resources blocked by connector policies are now visually flagged in the connector detail view.
• New catalog connectors: Pinpoint ATS, Clay, and pganalyze are now available in the connector catalog.
• Slack agent input: Agents now process link unfurls and bot attachments from Slack messages as part of their input context.
• Connector description limit: MCP server descriptions now support up to 4096 characters (previously 1024).
• Shadow MCP false-positive fix: Improved shadow MCP matching to reduce false-positive detections on command-line argument tokens.
• Detect MDM guide simplification: Organization API key prerequisites have been removed from the Detect MDM deployment guides — enrollment keys handle authentication automatically.

• Configurable skill risk policy: Admins can now configure how the platform responds to skill security scan results. Set per-tier actions (Block, Warn, or Allow) for high-risk and medium-risk skills in Settings → Security Scanners. High-risk defaults to Block; medium-risk defaults to Warn.
• Intune Remediation deployment method: The Intune deployment guide now supports the Remediation method (requires Intune P2). Intune handles scheduling natively — no scheduled task is created on the device.
• New catalog connectors: Smartsheet and DataGrail Vera are now available in the connector catalog.
• Draft connectors hidden from clients: Connectors in Draft status are no longer exposed via the MCP endpoint or the proxy — only the creator can see them until the connector is activated.
• OAuth popup fix: Fixed the upstream OAuth popup flow when the remote server’s COOP header prevents window.opener access.
• Subagent update fix: Updating a subagent no longer clears fields that were not included in the update payload.

• Runlayer Assistant generally available: The in-app Runlayer Assistant is now available to all workspaces with agents enabled — no separate feature flag required.
• Onelayer plugin always visible: The Onelayer plugin now appears in the plugin list for all users without a feature flag gate.
• Slack run source details: Agent runs triggered from Slack now display conversation, channel, and trigger details in the Activity view, with a direct link to the originating Slack message.
• New catalog connector: Amazon Redshift (read-only SQL — discover, explore, and query Redshift clusters and serverless workgroups).
• MDM PowerShell improvements: Windows MDM scheduled tasks now run with a hidden PowerShell window (-WindowStyle Hidden -NonInteractive) so recurring scans no longer flash a console window.
• Sensitive audit log guard fix: Updating a connector without changing its sensitive audit log settings no longer requires Super Admin permissions.

• Claude Opus 4.7: Claude Opus 4.7 is now available as an agent model when Anthropic is configured as an LLM provider.
• Agent icon in creation flow: You can now set a custom icon when creating an agent, not just after creation.
• Deployment custom icons: Deployments now support custom icons — set one during creation or update it from the deployment settings dialog.
• Resume agent runs from Activity: Open a past agent run in the Activity view and click Resume to continue the conversation in the Playground with the full prior context loaded.
• Slack plan improvements: Agent messages in Slack now display which LLM model produced each response. Tool outputs are no longer shown inline to keep messages cleaner.
• Deploy auto-grants developer access: When you deploy a connector via the CLI, the deploying user is now automatically granted developer-level access to the resulting connector.
• New catalog connector: ZoomInfo is now available in the connector catalog.
• Ashby out of beta: The Ashby connector is now generally available (no longer marked as beta).
• PPPC profile for Detect (macOS): The Shadow MCP Detect deployment flow now includes a downloadable PPPC profile for macOS MDMs. Deploy it before the scan script to prevent macOS consent prompts for runlayer-scan.

• Analytics: top agents by tool calls: The Agents tab now includes a ranking of agents by raw tool call volume alongside the existing top-by-runs widget.
• Agent default model updated: New agents now default to Claude Opus 4.6 (claude-opus-4-6). Existing agents keep their current model.
• Agent memory clarified: Agent creation and update endpoints now document the built-in persistent SQLite database — no extra storage setup required.
• Onelayer auto sync: The Onelayer org install dialog now includes an Auto Sync toggle so the plugin is automatically pushed to developer clients via runlayer setup sync.
• Auto-provisioning syncs plugins: runlayer setup sync now installs both connectors and plugins marked for auto-sync, not just connectors.
• CLI target resolution: runlayer run now accepts a connector alias in addition to a UUID.
• Agent account authentication cookbook: New recipes page with copy-paste examples for M2M tokens, OBO flows, session grants, and external user mapping.
• New catalog connectors: Render and Hugeicons are now available in the connector catalog.
• Slack alert toggle states: Budget and scheduled-run failure Slack alerts now show clear status when Slack is not yet configured on the agent.
• Codex MCP instructions: Improved Codex client setup instructions.
• Audit log chart fix: The audit log timeline chart now truncates at the current time instead of extending into the future.
• OAuth fixes: Fixed refresh-token retry loop on upstream 401, isolated rate-limit buckets per identity, and fixed OAuth popup getting stuck on close.

• Session grants: Agent account authentication to OAuth-protected connectors now uses session grants — a model that decouples OAuth credential sharing from delegations. Grants can be personal (caller-only) or shared (fallback for other users). See Agent Accounts.
• Session grant admin revocation: When an admin deactivates a user, all of that user’s session grants are automatically revoked.
• Terraform Provider (Beta): Manage Runlayer policies and resources from Terraform. See the Terraform Provider guide.
• OAuth guide for deployed servers: New guide covering dual-auth architecture, DynamoDB token storage, and the two OAuth integration patterns for custom MCP servers. See OAuth for Deployed MCP Servers.
• Slack say tool: Agents triggered from Slack can now post additional messages back to the conversation thread using a built-in messaging tool.
• Connector docs expanded: The Connectors page now covers the connector catalog, manual setup, deploy flow, and ToolGuard security in detail.
• MDM script fixes: PowerShell scripts no longer fail on uv stderr output; macOS scripts fix .runlayer directory ownership.

• Analytics Agents tab: The Analytics dashboard now includes an Agents tab with an agents inventory card (total, public vs private, created in period) and an agent runs over time chart.
• Duplicate agent: Any workspace member can duplicate an agent from the agent detail page or from the agent card menu. The copy clones configuration, connectors, and tools.
• Onelayer OpenAI org install: “Add to Organization” for the Onelayer plugin now supports both Anthropic and OpenAI paths. The OpenAI flow walks admins through registering an MCP connector and uploading skills in ChatGPT.
• Directory sync locks manual editing: When SCIM directory sync is enabled, manual role and group editing is disabled in the UI with an explanatory banner.
• Connector search: Connectors can be searched by name or description using the global command palette (Cmd/Ctrl+K) and via the query parameter on the servers API.
• Schedule count badge: Agent cards now display a badge showing how many active schedules the agent has.
• Connector icons on agent cards: Agent cards display icons for their attached connectors.
• CLI 0.24.0: Bug fixes and scan parsing improvements.

• Goose MCP client support: Goose is now a supported MCP client with hosted and local setup guides, native skill install, and plugin install via MCP fallback.
• CLI 0.23.0: New interactive skills find and plugins find commands for browsing and installing skills or plugins from the terminal.
• Agent list sorting and filtering: The Agents page now supports sorting by newest, oldest, alphabetical, and last-used, plus a status filter (active / disabled).
• Agent playground auto-tools: The Playground now automatically injects Runlayer tools (search, run, manage) so agents can reason about the workspace without manual connector setup.
• Agent connector grant access: Connectors requiring authorization now show a guided access setup dialog directly during agent creation, with per-connector status indicators.
• SIEM export (S3): Audit logs can now be continuously exported to an S3 bucket for SIEM ingestion (CrowdStrike, Splunk, Sentinel). See Audit Logs.
• Enforce remote MCP URL allowlist: Admins can now allowlist specific remote MCP URLs so Enforce does not block trusted third-party MCP servers. See Enforce policy.
• Tool selector categories: The tool picker in policies now includes an annotation-based category dropdown next to “Select All” for faster bulk selection.

• Runlayer MCP subagent management: Add, update, and delete subagents on an agent directly through Runlayer MCP tools (confirm-required).
• Manage Slack App link: Agent Slack settings now include a direct link to manage the agent’s Slack app on api.slack.com.
• Improved scheduled run reliability: Scheduled agent runs now retry transient authentication errors automatically instead of failing immediately.
• New catalog connector: Ravenna (AI knowledge management — search knowledge bases, manage channels, and automate support workflows).

• Analytics v2 Overview redesign: The Overview tab now shows a Tasks chart (human vs agent), Usage card (users, agents, connectors), Most Used Clients, and a redesigned Security Alerts widget. The previous tool calls timeline has been replaced.
• Deploy agent from plugin: Create an agent directly from a plugin detail page — the new agent inherits the plugin’s connectors and skills automatically.
• New catalog connectors: AirOps (50 tools) and Pendo are now available in the connector catalog. Datadog now uses the full toolset by default.
• CLI deploy URL: The CLI now prints the deployment URL after a successful deploy.

• Sensitive audit log redaction: Super Admins can mark connectors as sensitive. When enabled, tool call arguments, results, and security scan details are automatically redacted from audit log entries for that connector.
• Analytics Connectors tab: Connector-related widgets (top by tool call, connector health, usage by client) are now in a dedicated Connectors tab. Skills tab renamed “Skills created over time” to “Skills usage over time.”
• Scheduled run failure DMs: Agent owners receive a Slack DM when a scheduled agent run fails.
• Agent advanced settings: Model, environment variable, and subagent settings are now visible only to admins and the agent owner.

• ToolGuard sensitivity levels: Each scanner phase (Tool List Guard, Tool Call Guard, Tool Intent Guard) now supports Strict, Balanced (default), or Moderate sensitivity, configurable globally and per connector.
• Runlayer MCP policy CRUD: Create, update, and delete policies directly through Runlayer MCP governance tools (in addition to list and read).
• Security warning classification: Hidden-character masking and sensitive-token masking findings are now classified as security warnings instead of violations.
• Connection test timeout: MCP connection tests now enforce a 15-second timeout to prevent long hangs.
• CLI 0.22.2: Minor fixes and improvements.

• AI Watch now scans Codex and OpenCode plugins: Detect discovers installed plugin artifacts in Codex and OpenCode alongside existing client support.
• Enforce now supports Claude Code on macOS: Shadow MCP tool call interception is available for Claude Code.
• Agent policies: Agents now have a dedicated Policies section for managing per-agent access rules directly from the agent detail page.
• Analytics: skill usage timelines and top skills: The Skills tab now shows skill usage over time and a ranking of the most-used skills.
• Zoom connector: Zoom is now available in the connector catalog with meeting search, recording access, and Docs creation tools.
• CLI 0.22.0: Includes Codex and OpenCode plugin scanning support.

• Agent subagents: Agents can now delegate work to lightweight child agents that inherit the parent’s connectors and tools but follow their own instructions.
• Analytics v2 tabbed layout: The Analytics dashboard is now organized into Overview, Skills, and Plugins tabs with dedicated widgets for each area.
• Agent run audit events: Agent runs now emit AGENT_RUN, AGENT_RUN_SUCCESS, and AGENT_RUN_FAILURE audit log events with source, model, and duration.
• Deploy force-delete: Deployments with connected connectors can now be deleted via a Delete All option that removes the deployment and its connected servers together.
• Agents API: The public Agents API routes have been renamed from /assistants to /agents.
• Kandji shadow MCP support: Kandji is now included in Shadow MCP device filtering.