​

September 2026 - Prompt content stays on Hybrid installs by default

​

Hybrid engines stop forwarding prompt content by default

• You never set FORWARD_MODE: after the upgrade, new events in the cloud dashboard show the verdict and threat type but no prompt preview. If you want previews back, set FORWARD_MODE=content on the engine and restart it.
• You set FORWARD_MODE=metadata: nothing changes. You can leave the setting in place or remove it.
• You set FORWARD_MODE=content: nothing changes. Keep the setting; it is now how you opt in to forwarding prompt previews.

​

September 2026 - Self-hosted database migrations stop on the first error

​

Your database gets the same policies as Cloud, and never a partial schema

​

September 2026 - Security update for self-hosted installs

​

Rebuild your dashboard from v3.35.0

​

September 2026 - Requests no longer wait behind internal alert delivery

​

An occasional multi-second pause on API requests is gone

​

September 2026 - Removing someone from your team ends their access everywhere

​

Removing a member now stops their devices and their keys

​

Projects are created in the organization you have selected

​

September 2026 - Fleet health, and a first key without leaving the page

​

Your fleet shows which agent build each device runs, and whether it works

​

Create an API key from the playground

​

New accounts start with a project

​

September 2026 - Red-team reports stop scoring their own failures

​

Audit events are committed independently of the request

​

A probe the engine could not run is no longer a verdict

​

No engine, no report

​

target_preset now tests the preset you named

​

September 2026 - Long completions and alert credentials

​

Long completions no longer fail at 60 seconds

​

PagerDuty destinations now authenticate with a stored credential

​

September 2026 - Agent and engine enforcement

​

Tool names match exactly, or by their final segment

• POST /api/v1/agent/validate-tool no longer matches tool names by substring. A tool name now matches an entry in blocked_tools, allowed_tools or review_required_tools when the full name is equal, or when the part after the last namespace separator (., : or __) is equal. One rule, all three lists.
• Why: the allowlist used to match when either string contained the other, so execute_shell_get came back allowed and safe because the platform allowlist contains get — a positive safety assertion for a name the blocklist plainly means to stop. The blocklist, meanwhile, matched only exactly, so mcp__x__bash was not blocked.
• What changes for you: namespaced names keep working — acme.search_files still matches search_files, mcp__github__create_file still requires review. Names that only matched as a substring of an entry (or contained one) no longer do; they fall through to the default policy instead of being reported as explicitly allowed. Namespaced forms of blocked tools are now blocked.
• If a tool you rely on stops being “explicitly allowed”, add its exact name (or its final segment) to your project’s allowed_tools. Sequence-anomaly detection in behaviour analysis is unchanged and still matches loosely — it errs toward detecting more.

​

Agent tool policies enforce only when you turn enforcement on

• New project setting agent_policy_enforced, off by default. The per-agent allowed_tools / blocked_tools / require_approval policies decide POST /api/v1/agent/validate-tool verdicts only while it is on. Off, they are configuration you can write and review; every agent gets the platform defaults.
• Projects that already had an agent policy are switched on, so the enforcement the August release announced for them continues unchanged. Every other project starts with it off.
• Turn it on from the Agent Security page (the Agent Registry card shows “Enforcement: on / off” with a switch) or with PATCH /dashboard/projects/{id}/settings {"agent_policy_enforced": true}; the project response carries the value.
• Semantics, stated so nobody has to guess: an empty allowed_tools means no allowlist configured, never allow nothing; blocked_tools applies whenever enforcement is on.

​

Agent behaviour analysis now sees complete history

• Since 3.30.0 (1 September), POST /api/v1/agent/validate-tool records every tool call to the agent’s profile, including calls that raised an alert. Before that, a call that tripped any behaviour analyser was returned with its alert and then discarded: it never entered the agent’s tool-call sequence, usage counts or call total, so the profile only ever held the calls that looked fine.
• What changes for you: behaviour analysis now works from the agent’s complete history. Sequence detection can match a pattern that spans more than one request, and the unusual-tool and drift analysers see the real distribution. validate-tool may therefore alert — and return allowed: false — on sequences it previously could not see. No threshold has moved.
• The alerts themselves are now stored too, and the dashboard’s Agent Security page reads them from the server instead of approximating them in the browser.

​

MCP security has a shadow mode

• Nothing changes for you by default. MCP tool-call security keeps enforcing exactly as the August release announced: a project with the dashboard toggle on gets mcp_violation blocks on /api/v1.
• The deployment now carries a switch (ENABLE_MCP_SECURITY) that, when off, keeps evaluating every enabled project’s tool calls but logs the verdict instead of blocking. We use it to measure a change before enforcing it, and as a rollback that does not need a deploy. If we ever run your project in shadow mode we will say so here first.
• If you want observe-only behaviour for your project only, that is enforcement_mode: monitor in project settings — it already covers this stage along with every other.

​

September 2026 - One audit chain per organization

​

Your audit events form a single chain, whichever instance wrote them

​

Evidence packages say what they could not verify

​

September 2026 - Per-person Shadow AI reporting

​

Shadow AI usage is now attributed to the person behind each device

​

Devices can disconnect themselves

​

ChatGPT MCP tool calls now count against your monthly requests

​

Changelog

​

August 2026 - Overage on Pro gets cheaper

​

Pay-as-you-go on Pro now costs $0.99 per 1,000 requests

​

August 2026 - Free tier doubled, and Shadow AI scans now count

​

The Free tier is now 20,000 requests a month

​

Shadow AI scans count against your monthly requests

​

Pay-as-you-go now works

​

Annual plans now include two months free

​

Prices are shown in your local currency

​

August 2026 - Billing and plan changes

​

A lapsed subscription now says so, instead of blaming your quota

{
  "error": {
    "message": "Your pro subscription is not active (status: past_due). Update your payment method to settle the outstanding invoice.",
    "type": "subscription_inactive",
    "code": "subscription_inactive",
    "current_plan": "pro",
    "subscription_status": "past_due",
    "reactivate_url": "https://app.promptguard.co/billing"
  }
}

​

Trials can call the API

​

A scheduled plan change no longer blocks the next one

​

Scale’s advertised allowance corrected to 500K

​

August 2026 - Behaviour changes you may notice

​

Fail-closed projects: unreadable streamed responses are now withheld

• If your project runs with fail_mode: closed, a streamed response whose frames PromptGuard cannot parse is now blocked instead of forwarded. Until now it was passed through complete and unscanned, and reported clean — the output guardrail simply did not run on it.
• Projects on the default fail_mode: open are unaffected: the response is still released, and the case is counted so it shows up in monitoring rather than nowhere.
• This brings streaming in line with the non-streaming path, which has always withheld a completion whose output scan failed.
• When would this fire? Only for a provider whose streaming format we do not recognise — typically a brand-new provider, or an existing one changing its frame shape. If you are on a mainstream provider you will not see it. If you are fail-closed and using something unusual, test a streamed call before this reaches your traffic.

​

Reversible PII tokenization is selectable

• pii_detection.mode accepts tokenize. It replaces each detected value with a reversible placeholder (⟦PG:PII:EMAIL:0⟧) instead of destroying it, so the model keeps reference consistency — the same email twice gets the same placeholder — and PromptGuard restores the real values in the response before it reaches your user. Your provider still never sees the PII.
• This was already built and simply unreachable: the engine ran it, the proxy restored it, and the config schema would not let you select it.
• Nothing changes unless you opt in. The default is still redact.
• Restoration happens on the proxy. If you call the Guard API directly you get the tokenized text back and no mapping — that endpoint scans, it does not forward and restore.
• Set it from the dashboard or the API. The CLI’s policy apply validator has not caught up and still rejects tokenize.

​

Agent tool policies are now enforced

• POST /api/v1/agent/validate-tool now honours the agent policy configured for your project. Until now it enforced one hardcoded list of 17 tool names shared by every customer, and the per-agent allow/block lists you set in the dashboard were only read back to render the settings page — they decided nothing. allowed_tools on agent registration was accepted and documented, and never stored.
• What changes: a project with an agent policy row gets that policy enforced. blocked_tools is added to the platform defaults, so a policy can only narrow what is allowed — it can never re-enable a dangerous default. A non-empty allowed_tools replaces the default allowlist. require_approval makes every call return review.
• Who is affected: projects that have configured an agent policy. If you have never set one, nothing changes — you keep today’s defaults.
• Check your agent policies before this reaches your traffic. A narrow allowed_tools set months ago and never enforced will start refusing tools your agent uses today.

​

pii_types no longer accepts person or location

• /api/v1/security/redact returns 400 unknown_pii_type for person and location. The named-entity provider that scanned for them was never reachable in production — the flag enabling it had no caller — so those requests returned 200 over text that had not actually been scanned for names or places.
• This converts silent under-redaction into an explicit error. Neither value was ever listed in these docs or in the OpenAPI specs. If you send either, drop it from pii_types; the other types are unaffected.

​

Rate-limit responses on /api/v1

• Traffic far above your plan’s rate now returns 429 from abuse control. Previously a burst violation resolved to a warning that did nothing.
• Your plan’s rate limit has not changed, and the abuse ceilings sit well above every plan, so ordinary traffic — including a client spending its full entitlement — is unaffected. This fires on volumes no legitimate client produces.
• Rotating User-Agent or other free-form headers no longer resets abuse counters.

​

Detection reasons name a rule instead of a pattern

• The reason on a fraud, malware or toxicity finding now reads (rule 1a2b3c4d) where it previously contained the raw regular expression that matched. If you parse reason strings, parse the rule reference. The full pattern is still available in the finding’s metadata.

​

A guardrail turned off now stays off

• enabled: false is honoured for the gibberish, language and code-vulnerability detectors. The override worked for every other detector and was silently ignored for these three, so a project that had switched one off still had it run on every request.

​

MCP tool-call security now actually runs

• If your project has MCP security enabled, it was not being enforced. A configuration-lookup bug meant the guard read a setting that was never populated, so it exited before running any check. The server allow-list, the server block-list, the maximum argument size, the declared-schema check and the MCP prompt-injection check were all inert.
• Tool calls that have been passing may now be blocked, returning mcp_violation. This affects only projects that had switched MCP security on — nothing changes for projects that left it off, and a project with the toggle off is unaffected.
• Review your MCP settings before this reaches your traffic. A stale server_allowlist is the one to check first: with the guard live, any server not on the list is blocked. An allow-list configured and forgotten months ago has never been tested against your real tool calls.

​

Hallucination scores now reflect every detector

• hallucination_score was 0.00 for any request that carried no context, no matter what was found. The score came from a single one of the five hallucination checks — the one that compares claims against supplied context — so a plain chat completion with three fabricated-data and fake-citation findings still scored 0.00. The metadata said so in the same breath: {"hallucination_score": 0.0, "hallucination_matches": 3}.
• What changes: the score is now derived from the findings themselves, weighted by severity. Responses that scored 0.00 will score above zero.
• Who is affected: only projects that set the hallucination action to flag or block. The default action is metadata, which attaches the score and never enforces — those projects will see a more useful number and no change in behaviour. If you enforce on hallucination, review block_threshold (default 0.6) against your traffic before this reaches you, because scores that could never cross it now can.
• Related: a citation in a response where you supplied no sources is now reported as uncheckable (medium) rather than unverified (high). A citation absent from sources you did supply is unchanged.

​

Multi-turn drift detection is live on the proxy

• Crescendo attacks — where each message looks innocuous and the conversation drifts toward harm — are now detected on /api/v1/chat/completions. Included on every plan. It runs once a conversation reaches three user turns, and can only add a block: it never overturns a verdict the rest of the chain already reached, and a detector fault lets the request through.
• Turn off per project with the multi_turn_drift guardrail.

​

System-prompt leaks are reported as leaks

• If you have configured canary tokens, a canary appearing in a model response is now recorded as system_prompt_leak. It was previously recorded as toxicity, with a reason naming the input rather than the output. Dashboard filters and exported events keyed on toxicity for this case need updating; the detection itself is unchanged.

​

Cost estimates are retired; PromptGuard reports tokens

• The cost_usd_estimate column is deprecated and is NULL on every event written from 2026-08-10. The column itself stays and historical rows keep their values, so existing warehouse queries keep running rather than erroring — they will simply see no new spend.
• Why: that figure was token counts multiplied by a per-model price table PromptGuard maintained by hand for every model on every provider. It drifted. One model carried a price 7.5× its real rate for months and nothing detected it, because a wrong price looks exactly like a right one. Token counts come from the provider’s own usage block and cannot go stale; the dollar conversion was the only part we were inventing.
• What to use instead: tokens_input and tokens_output, joined against your provider’s current published rates — or read spend straight from your provider’s billing console, which is authoritative in a way a copy of their price list never is. The Analytics Cookbook recipes have been rewritten around tokens.
• Dashboard: the project “Spend” card is now a Usage card showing token volume, the Usage page’s by-model table reports tokens instead of dollars, and the Interactions table’s optional Cost column is gone (the Tokens column covers it). The security value card is unchanged — cost saved from blocked incidents is still shown, still weighted by the published IBM Cost of a Data Breach benchmarks it cites.
• API: cost_usd_estimate is no longer returned by the interactions endpoint, and GET /dashboard/projects/{id}/cost is now GET /dashboard/projects/{id}/usage returning token counts. The admin GET /internal/models/pricing endpoint has been removed.
• Routing: the per-project routing_strategy value "cost" is retired. It ranked providers using hardcoded 2024 provider-level rates, which cannot compare today’s models. It is still accepted, now routes as failover, and logs a warning — set the strategy explicitly to silence it.

​

Active policy overlays now apply to the proxy

• Your project’s active policy overlays are now applied to the /api/v1/chat/completions input scan and its non-streaming output scan. They already applied to /api/v1/guard, /api/v1/security/scan, the tool-injection check and streamed output; the proxy was the one door they skipped.
• A project with an active overlay may see different block/allow outcomes on the proxy than it did before this release. If an overlay loosens a rule, traffic that used to be blocked is now allowed; if it tightens one, the reverse. Review your active overlays before this reaches your traffic.

​

Pay-as-you-go now covers the whole account

• On-demand (pay-as-you-go) usage used to apply only to the proxy. It now covers every metered endpoint: /api/v1/security/scan, /api/v1/security/redact and the ChatGPT app tools as well as /api/v1/chat/completions.
• This can raise your bill. An account that exceeded quota on the scan endpoints used to be blocked; with on-demand enabled it now continues and meters, bounded by the spending limit you set. Breaching the limit on those routes returns spending_limit_exceeded rather than monthly_quota_exceeded.
• The 429 bodies from /api/v1/security/scan and /redact gained on_demand_url and retry_after, and both routes now send a Retry-After header. Purely additive — code and status are unchanged.

​

Custom policies: the plan floor is Pro

• Creating or editing a custom policy requires Pro or higher (plus Shadow Business / Shadow Enterprise). The 403 message is now Custom policies require the Pro plan or higher. — the previous message named a “Starter” tier that has never existed. A self-host licence granting the custom_policies feature now works without a subscription record.

​

Custom-policy condition precision

• contains_credit_card is now Luhn-validated, contains_email no longer fires on reserved domains (example.com, test, localhost, …), and contains_ssn no longer fires on non-issuable numbers. Each matches strictly fewer strings, and the ones dropped were false positives.
• prompt_injection is now the union of its own patterns and contains_ignore_instructions’, so it matches strictly more than before. No existing policy loses a match.

​

Agent API deprecations

• active_sessions on the agent stats response is always 0 and is marked deprecated. Session state is not retained server-side.
• DELETE /api/v1/agent/{agent_id}/session/{session_id} is an explicit no-op. It still returns 200 with the same keys plus "deprecated": true, and now sends Deprecation: true and Sunset: Wed, 09 Dec 2026 00:00:00 GMT.
• POST /api/v1/agent/{agent_id}/rotate-credential can now answer 409 (CREDENTIAL_ROTATION_CONFLICT) when two rotations race. Retry it; a 409 means your rotation did not land, never that the credential forked.

​

Corrections

• Alert webhooks are not signed. Our webhooks documentation described an X-PromptGuard-Signature header and told you to reject unsigned payloads. No such header is sent and there is no per-project webhook secret. The page now says so and recommends restricting the endpoint by network or an unguessable path instead.
• Agent credentials are issuance and rotation only. No request path verifies a presented credential, so agent IDs on tool-call and guard requests remain self-asserted. Our compliance page and two blog posts said otherwise and have been corrected.
• Custom data retention is Enterprise only. The Settings pane previously offered it on Scale; the backend never honoured a custom window below Enterprise, so the control did nothing. It has been removed from Scale.
• The CLI and VS Code extension provider lists claimed detection for Mistral and Groq. Neither has ever been in sdk-patterns.json, which is what the scanners read, so neither was ever detected. Both rows are removed. Azure OpenAI detection is now genuinely supported (sdk-patterns.json 2.1.0 adds AzureOpenAI to the OpenAI class names).

​

August 2026 - Usage page overage figures corrected

• The On-demand and Total spend tiles on the Usage page priced overage requests at $0.001 each instead of the billed$0.01, so they showed a tenth of the real amount. Both tiles now agree with the Subscription API, the spending-limit guard and your Stripe invoice.
• Nothing you were charged changes — only the displayed figures were wrong. If you have a saved report or screenshot of those tiles from before this release, the on-demand and total numbers on it are ten times too low.

​

July 2026 - Enterprise self-host & multi-platform Shadow AI

​

Air-gapped self-hosting (GA)

• Run the entire engine inside your network: Helm chart with a default-deny egress NetworkPolicy overlay, and offline license verification (no phone-home in air-gap mode). Corrected 2026-09-14: no ML model ships with the chart — ML inference needs a model server you run — and the NetworkPolicy, not the application, is what stops outbound calls.
• Direct OIDC SSO against your internal identity provider (Keycloak, AD FS, Okta on-prem)
• A customer-verifiable no-egress audit document your security team can reproduce, plus build provenance on published packages for supply-chain review

​

Shadow AI on Windows and Linux (early access)

• Windows x64 (.exe / .msi) and Linux x64 (.AppImage / .deb) installers are now publicly downloadable alongside the signed + notarized macOS universal app — download
• Windows installers are not code-signed, so SmartScreen shows “Windows protected your PC” on first run — click More info → Run anyway (see Troubleshooting)

​

Shadow AI auto-update & fleet policy

• Signed automatic updates with staged rollout, a remote kill-switch, and a server-set minimum-version floor — a dangerously outdated agent updates itself instead of running stale detection
• In-app Settings: Automatic / Notify / Off modes and a beta channel
• Fleet admins can force the update mode, pin the channel, and set a minimum version org-wide
• Refreshed menu-bar app: protection state visible in the tray icon, full keyboard/VoiceOver accessibility, one-click recovery when HTTPS inspection needs approval

​

ChatGPT MCP integration (GA)

• The PromptGuard MCP server is live at api.promptguard.co/mcp (Streamable HTTP + OAuth 2.1) — connect it to ChatGPT or any MCP-capable client
• The documentation itself is agent-readable: docs.promptguard.co/mcp and /llms-full.txt

​

May 2026 - Shadow AI packaging

• Personal Shadow AI is now included with every plan (protect one device on Free/Pro); the fleet layer (multi-device, org policy, usage rollup) unlocks at Scale
• Standalone per-seat plans for Shadow-only customers went live (sales-led)

​

April 2026 - Pricing update

• Pro is now **$99/month** (annual:$1,089) — same 100K requests / 5 projects / 7-day retention.
• Scale is now **$199/month** (annual:$2,189) — same 1M soft-limit / unlimited projects / 30-day retention.
• Free and Enterprise are unchanged.
• Existing subscribers stay on their original price (Stripe does not migrate active subscriptions).

​

April 2026 - v3.3.0: ATR Integration, Agentic OWASP, Cisco Plugin

• Community rule pack — Ingested 108 open-source rules / 714 regex patterns as a fast pre-filter layer covering agent-specific threats: MCP tool poisoning, cross-agent manipulation, skill supply chain attacks, privilege escalation, and excessive autonomy. PromptGuard now runs ~1,000+ detection patterns across built-in and community rule sets.
• OWASP Agentic Top 10 mapping — Every security event now maps to both the OWASP LLM Top 10 (LLM01–LLM10) and the OWASP Agentic Top 10 (ASI01–ASI10). Full coverage for enterprise compliance reporting across both frameworks.
• External benchmark eval framework — Added loaders for PINT (Invariant Labs, 850 adversarial samples) and Garak (NVIDIA, 666+ jailbreak probes) benchmarks for continuous validation using the existing eval runner.
• Scanner integration — Thin API shim (PromptGuardAnalyzer) for contributing to open-source agent security scanners as an optional analysis backend. Zero detection logic shipped — all intelligence stays server-side.
• Detection strategy bug fix — Fixed FAST_FIRST mode: non-detections from later providers no longer overwrite earlier detections, ensuring the first positive match is always preserved.

​

March 2026 - v3.0: SOTA Detection Upgrade

• Content safety classification — LLM-based harmful intent detection via an open-weight safety classifier, catching requests that traditional toxicity models miss (25/25 on our in-house harmful-intent set at release, 0 false positives on that set — an in-house suite, not an independent benchmark)
• Multi-turn intent drift detection — DeepContext-inspired crescendo attack detection using semantic embedding drift analysis with LLM verification
• Universal ML access — All detection layers (ML ensemble, content safety, multi-turn analysis) now available on all plan tiers; pricing differentiates on usage volume only
• Six-layer detection architecture — Upgraded from four layers to six: normalization → regex → ML ensemble → content safety → multi-turn drift → policy evaluation
• HIGHEST_CONFIDENCE strategy — Detection from any layer is sufficient to block; layers complement rather than gate each other

​

March 2026

​

Dashboard Overhaul - CISO & ML Features

• Alerts Feed: Real-time alert feed with severity filtering, status tracking, and unread count badge in the navigation bar
• Threat Intelligence: Cross-tenant anonymized attack patterns, mutation strategy trends, and evasion rate analysis (Scale+)
• Audit Log: Dedicated filterable audit log page with JSON export for SOC 2/GDPR compliance (Scale+)
• Webhook Delivery Monitoring: Track delivery status, retry failed deliveries, and diagnose integration issues per project
• Detector Performance: Per-detector accuracy, false positive rates, and latency metrics to help CISOs tune detection
• Token-Level Explainability: Interaction detail pages now highlight which parts of a prompt triggered detection with confidence breakdowns
• Attack Drift Detection: Visualize how attack patterns shift over time on the Threat Intelligence page
• Conversation-Level Threat View: Group multi-turn interactions to detect escalation patterns across turns
• Security Cost Analysis: ROI visualization showing latency cost vs. threats prevented in project analytics
• Feedback Impact: See how your false positive/negative reports improve detection accuracy
• Compliance Reports: Interactive framework-specific reports (SOC 2, GDPR, HIPAA, OWASP) with coverage progress bars
• Metrics Consistency: Unified “Threats Flagged” metric (block + redact) across all dashboard pages - no more mismatched numbers
• Brand Refresh: New deep indigo color identity with cool-tinted neutrals, unified chart color system, and View Transitions API for smooth page navigation
• URL State: Interaction filters, search queries, and tab states are now bookmarkable and shareable
• Command Palette: Enhanced ⌘K menu with “Jump to” shortcuts for Alerts, Threat Intelligence, and Audit Log
• Responsive Design: Dashboard settings, compliance, and all new pages fully responsive for mobile and tablet

​

OWASP LLM Top 10 Mapping

• Every security event is automatically classified against the OWASP LLM Top 10 framework with owasp_id, cwe_id, and human-readable title
• Dashboard shows OWASP badges on event detail pages and an aggregate OWASP Top 10 Coverage chart on the project overview
• Supports all 10 OWASP categories: LLM01 (Prompt Injection) through LLM09 (Misinformation), mapped from PromptGuard’s native threat types

​

AI-Generated Remediation Suggestions

• Blocked and redacted events automatically receive AI-generated security insights using an open-source HuggingFace model (Qwen/Qwen3-4B)
• Each insight includes a summary, impact assessment, and actionable remediation steps
• Runs asynchronously in a background thread - adds zero latency to the request path
• Displayed in the dashboard event detail as an “AI-Generated Insight” card

​

Dashboard UX Enhancements

• Security Posture Card: Project overview shows a data-driven circular gauge (0–100) reflecting guardrail coverage and event activity, with status labels (Excellent / Good / Needs Attention / Critical)
• Active Guardrails Strip: Horizontal pill badges showing which guardrails are enabled/disabled at a glance, linking to the guardrails configuration page
• Recent Threats Table: Main dashboard overview shows the last 5 blocked/flagged events across all projects with threat type badges, OWASP IDs, and click-through navigation
• Enhanced Global Search (⌘K): Server-side event search with debounced API calls, threat type and OWASP ID search, and result counts per group
• Sidebar Count Badges: Interactions nav item shows a live count of flagged events in the last 24 hours
• StatsGrid Sparklines: Inline SVG sparklines on stat cards showing trends from timeseries data
• Standardized Page Headers: Consistent PageHeader component across Interactions, Analytics, and Security Rules pages with contextual action buttons and keyboard shortcut hints
• Keyboard Navigation: G then I/R/A/O/K/T/P shortcuts for rapid project page navigation

​

Custom Policy Engine

• 7 policy types: input_filter, output_filter, topic_filter, llm_guard, entity_blocklist, rate_limit, and custom - all manageable via API and dashboard
• Topic Filter: Define conversation scope in natural language; an LLM judge blocks off-topic queries
• LLM Guard: Custom natural-language business rules evaluated by an LLM judge for constraints too nuanced for regex
• Entity Blocklist: Protect specific names, terms, or identifiers from appearing in prompts or responses with pipe-delimited matching
• contains_text_any condition: Match any of multiple pipe-separated terms in a single rule (e.g., "Acme|Globex|Initech")
• Full dashboard UI for creating and managing all policy types, including system_prompt_details editor for topic filter and LLM guard

​

Zero-Trust Response Verification

• HMAC-SHA256 response signing (X-PromptGuard-Signature): Cryptographic proof that the response came from PromptGuard and was not tampered with
• Content hashing (X-PromptGuard-Content-Hash): SHA-256 hash of the response body for independent integrity verification
• Zero-retention header (X-PromptGuard-Zero-Retention): Explicit confirmation that prompt content was not stored when zero-retention mode is enabled
• Replay protection: Timestamp-based signature validation with configurable max age (default 5 minutes)

​

Per-Project Token Limits

• Set max_tokens_per_request per project to cap prompt size before it reaches the LLM provider
• Requests exceeding the limit are rejected with HTTP 413, saving LLM costs
• tiktoken integration: Accurate token counting using OpenAI’s tokenizer (falls back to chars/4 heuristic)

​

Hallucination Detection with RAG Context

• RAG context threading: Automatically extracts grounding context from system messages and tool results in conversation history
• Source-grounded verification: Compares LLM responses against retrieved documents for higher-accuracy hallucination scoring
• Configurable enforcement: metadata (default), flag (log for review), or block (reject above threshold)
• Adjustable block_threshold (0.0–1.0) for tuning sensitivity per project

​

Hardened Container Security

• 3-stage Dockerfile: Build → Compile → Hardened production image
• Source code compiled to .pyc bytecode; original .py files stripped from production image
• Shell binaries removed (/bin/sh, /bin/bash, curl, wget, apt-get) - kubectl exec has nothing to invoke
• Docker Compose: read_only: true, cap_drop: ALL, no-new-privileges
• Helm chart: readOnlyRootFilesystem, allowPrivilegeEscalation: false, capabilities.drop: ALL

​

Autonomous Red Team Agent

• LLM-powered adversarial search discovers novel attack vectors through intelligent mutation
• Budget-controlled iterations (1—1000) for configurable thoroughness
• Generates graded security reports (A through F) with actionable recommendations
• CLI support: promptguard redteam --autonomous --budget 200
• SDK support: pg.redteam.run_autonomous() (Python) / pg.redteam.runAutonomous() (Node.js)

​

Attack Intelligence Database

• Anonymized bypass pattern storage for organizational learning
• Query statistics via GET /internal/redteam/intelligence/stats
• Categories, severity breakdown, and recent discovery counts

​

CI/CD Security Gate

• GitHub Action (promptguard/security-gate@v1) runs red team tests on every PR
• Configurable minimum grade (A—F), regression detection, and PR comment reporting
• Outputs: grade, score, bypasses found, and full JSON report

​

MCP Server Security

• Validate Model Context Protocol (MCP) tool calls before execution
• Server allow/block-listing, JSON Schema argument validation, and resource access policies
• Tool injection detection for MCP-based agent architectures

​

Policy-as-Code (YAML)

• Define guardrail configurations in YAML, version in git, apply via CLI
• promptguard policy apply / diff / export commands
• Validation, diffing, and idempotent application against live config

​

Multimodal Guardrails

• Image content safety via API delegation (Google Cloud Vision, Azure Content Safety)
• OCR-based text extraction with PII detection on image content
• Pluggable provider architecture for vision analysis

​

Security Groundedness Detection

• Detects security-relevant fabrication in LLM responses
• Identifies hallucinated CVEs, fake compliance claims, and invented security statistics
• Pattern-based confidence scoring with configurable thresholds

​

Open Source AI Attack Dataset

• Curated adversarial evaluation dataset with deterministic and LLM-powered mutations
• 8 mutation categories: synonym substitution, character obfuscation, encoding, payload splitting, and more
• HuggingFace-ready export for community benchmarking

​

Performance & Observability

• PolicyEngine fast path with thread-safe LRU cache (TTL-based) for sub-50ms repeated evaluations
• Per-detector profiling with timing instrumentation for performance analysis
• OpenTelemetry metrics: counters for block/allow decisions, latency histograms, detector-level timing
• Plugs into Datadog, Grafana, Honeycomb, and any OTEL-compatible backend

​

SDK & CLI Updates

• Python + Node.js SDKs: run_autonomous() and intelligence_stats() methods on RedTeam class
• CLI: redteam --autonomous flag with --budget control
• CLI: policy apply/diff/export subcommands for YAML-based config management

​

Late February 2026

​

Expanded Security Guardrails

• Expanded from 7 to 10 security guardrails (since grown to 14 with v3.3.0): Prompt Injection, PII Detection, Data Exfiltration, Toxicity, Secret Key Detection, URL Filtering, Fraud Detection, Malware Detection, Jailbreak Detection (LLM), and Tool Injection
• Jailbreak Detection (LLM): LLM-powered jailbreak detection catches sophisticated bypass attempts that evade traditional pattern matching, including multi-turn and encoded attacks
• URL Filtering: Detect and block malicious, phishing, or unauthorized URLs in prompts and responses
• Tool Injection Detection: Block attempts to inject malicious tool calls or manipulate agent tool usage through crafted prompts

​

Enhanced PII Detection

• Expanded PII coverage from 14 to 39+ entity types across 10+ countries
• Checksum validation for structured identifiers (credit cards, IBANs, tax IDs, national IDs)
• Country-specific entity support including national health numbers, driving licenses, and passport formats

​

Secret Key Detection with Entropy Analysis

• Entropy-based analysis to detect high-randomness strings that are likely secrets
• Provider-specific pattern matching for major API key formats (AWS, Stripe, GitHub, etc.)

​

Granular Guardrail Configuration Dashboard

• Per-guardrail enable/disable and threshold configuration from the dashboard
• Fine-tune sensitivity, actions (block/redact/log), and scope for each guardrail

​

Streaming Output Guardrails

• Real-time guardrail enforcement on streaming responses from LLM providers
• Scan and filter output tokens as they stream, blocking threats mid-response without breaking the stream

​

SDK Improvements

• Retry logic with configurable backoff for transient failures in Python and Node.js SDKs
• Async Python client for high-throughput, non-blocking guardrail calls
• Embeddings API support - guardrail protection for embedding model requests

​

Evaluation Framework

• Benchmarking framework for measuring guardrail accuracy, latency, and false-positive rates
• Pre-built test suites for prompt injection, PII detection, and jailbreak scenarios
• Compare guardrail configurations side-by-side with detailed metrics

​

February 2026

​

GitHub Code Security Scanner

• GitHub App integration for connecting repositories to PromptGuard
• Automatic scanning of repositories for unprotected LLM SDK calls
• AST-based detection for both Python (ast module) and JS/TS (tree-sitter) — zero false positives from comments, strings, or template literals
• Auto-fix pull requests that add PromptGuard protection to detected LLM calls
• CI checks on pull requests to flag new unprotected LLM usage
• Consolidated UX: scan history, findings, and repository management all accessible from Settings > Integrations in a single expandable interface

​

Organizations & Teams

• Create team organizations with shared projects and billing
• Role-based access control: Owner, Admin, Member, and Viewer roles
• Invite members via email with configurable roles
• Transfer ownership and manage invitations from Settings > Team
• Full API support under /dashboard/organizations

​

Enterprise Tier

• Self-hosted deployment — run PromptGuard on your own infrastructure
• Air-gapped mode — event forwarding and the license heartbeat off, with a default-deny egress NetworkPolicy (corrected 2026-09-14: the application still attempts some outbound calls, which the NetworkPolicy blocks)
• SSO (SAML / OIDC) support
• Audit logs and IP allowlisting
• Custom data retention and dedicated support with SLA
• Enterprise comparison table on pricing page

​

SDK Auto-Instrumentation

• Python SDK: promptguard.init() auto-patches OpenAI, Anthropic, Google, Cohere, and AWS Bedrock SDKs
• Node.js SDK: init() auto-patches OpenAI, Anthropic, Google AI, Cohere, and AWS Bedrock SDKs
• Works transparently with all frameworks (LangChain, CrewAI, LlamaIndex, Vercel AI SDK, AutoGen)
• Enforce mode (block threats) and monitor mode (log only)
• Fail-open by default with configurable fail-closed mode
• Optional response scanning (scan_responses / scanResponses)

​

Guard API

• New POST /api/v1/guard endpoint for standalone content scanning
• Accepts messages array with direction (input/output), model, and context
• Returns decision (allow/block/redact), confidence score, threat details, and optional redacted messages
• Used internally by auto-instrumentation and available directly via GuardClient

​

Security Scan & Redact Endpoints

• POST /api/v1/security/scan — analyze raw text for prompt injection and other threats
• POST /api/v1/security/redact — strip PII from text with selective type filtering
• Lightweight alternatives to the Guard API for pipelines and batch processing

​

Framework Integrations

• LangChain.js callback handler (PromptGuardCallbackHandler)
• Vercel AI SDK middleware (promptGuardMiddleware)
• Python: Native support via auto-instrumentation for LangChain, CrewAI, LlamaIndex

​

Documentation Overhaul

• Rewrote Python and Node.js SDK references to cover auto-instrumentation, GuardClient, and framework integrations
• Added Enterprise pricing tier with feature comparison
• Added Guard API, Security Scan, and Security Redact API reference pages
• Added Organizations & Teams documentation
• Regenerated OpenAPI spec (35 developer endpoints, 20 schemas)
• Updated pricing to match current plans ($149/month Scale, Enterprise tier)

​

Code Quality

• Tree-sitter AST parsing for JS/TS code scanning (replacing regex)
• Shared detection manifest (sdk-patterns.json) as single source of truth for LLM SDK patterns
• Removed 17 unused backend endpoint files and dead code

​

January 2026

​

Billing & Subscriptions

• Plan change with proration support (upgrade/downgrade mid-cycle)
• Usage-based billing alerts at 80% and 100% thresholds
• Stripe integration with metered billing for Scale plan overage

​

Security Improvements

• AI-powered threat detection with F1 = 0.887 and 99.1% precision
• Enhanced PII detection patterns (SSN, credit card, API keys)
• Red team test suite with 25+ adversarial test cases

​

December 2025

​

Initial Launch

• PromptGuard API (OpenAI-compatible proxy)
• Dashboard with project management and analytics
• Free, Pro, and Scale subscription tiers
• Regex-based threat detection
• PII redaction (email, phone, SSN, credit card)
• Rate limiting and usage tracking