Developer Roll Up: August 2026

August opened AI Sessions up beyond Claude. From there, three web app releases turned July's Cloud Security launch into something you can run a shift on, and three sensor releases went down into the kernel and came back with telemetry on the hosts that used to go dark: unprivileged containers, read-only root filesystems, kernel 5.4.

AI Sessions add three more providers

Connect your own keys for OpenAI (API key or Azure OpenAI), Google Gemini (AI Studio or Vertex), and OpenRouter (one key covering their whole model catalogue). Claude keeps working exactly as before, and you can hold credentials for several providers at once.

Cloud Security becomes a worklist

Findings moved from a card display to a sortable table with roughly double the row density, an Owner facet, and a Due column showing relative age with SLA state on hover. Root-cause roll-ups link a finding's remediation to the ones it implies. Data Security adopted the same filter bar and facet rail, and by 6.1.0 every remaining Cloud Security screen speaks that language. Free-tier orgs can upgrade Cloud Security without leaving the interface.

Compliance and attack paths get sharper

The Compliance screen became a charts-and-rail report, with frameworks that only grade a fraction of their controls no longer showing a bare green score, and a new Coverage tab assessing whether anything is actually reporting CVEs on a workload. Attack paths now render the real internet-facing front door as the first hop, with scope-escalation rendered as its own edge category and dedicated screens for AWS permission boundaries and trust-policy conditions.

Six extensions got first-class pages

Event Collection, Artifact Collection, Reliable Tasking, YARA Scanners, File & Registry Integrity, and Sensor Cull moved off the generic schema renderer and onto purpose-built UI.

Query Console and the rest of the app

Large searches complete faster with reduced memory overhead, and dropped events now show a per-reason breakdown instead of a silent gap. Column resizing is now default across every table, the shared filter bar reached Platform Logs, False Positive Rules, and sensor Vulnerabilities, and the redesigned Org pickers support keyboard navigation. Vulnerability Reporting exports affected hosts to CSV or Excel, and the Entra ID adapter added an endpoint picker for Microsoft national clouds.

Sensor: kernel telemetry reaches far more hosts

Linux process events now identify the container and Kubernetes pod a process belongs to, and new Windows script visibility through the Antimalware Scan Interface reports already-deobfuscated scripts and .NET assemblies. Hosts that can't provide a cgroup2 mount, including unprivileged containers and read-only root filesystems, now keep kernel-level telemetry instead of losing it, and kernel telemetry loads on kernel 5.4 for the first time. DNS events report the attributed process on kernels that support it, and a bug holding kernel-sourced DNS events for 10 seconds before delivery is fixed.

Sensor: transfers, install, and diagnostics

Payload downloads and artifact uploads now run over a fully compliant HTTP client, fixing silent failures behind proxies and SSL inspection. Cloud-driven sensor upgrades now actually take effect on macOS, the arm64 Debian package installs cleanly, and the sensor's outbound queue is bounded by memory size so large events can no longer silently displace thousands of small ones. Diagnostics now report discard counts, queue depth, and which kernel telemetry subprograms are active.

Full release notes for web app 6.0.2, 6.1.0, and 6.2.0 are on Docs, along with sensor releases 5.3.5 through 5.3.7.