Choose which AI tools your device agents scan for, export risk findings over OTLP, and a sharper prompt injection judge

The Shadow AI scan list is yours to edit. From the Device Agent configuration tab, organization admins add their own targets, switch a built-in default off and back on, and edit or delete what they added, with no agent release needed for a change to reach devices. Risk findings join the data export sources, delivering new findings to your SIEM or observability stack as privacy-safe OTLP log events. Prompt injection detection is rebuilt around a typed judge, and every prompt-based risk policy now runs on one benchmarked model that catches more and misfires less at lower latency.

Features

• Manage Shadow AI scan targets per organization #6171 - The list of AI tools device agents probe for is served per organization: the built-in defaults overlaid with the targets you add or customize through the new agent.listAiScanTargets, agent.upsertAiScanTarget, and agent.deleteAiScanTarget endpoints. Every change lands in the audit log, and the served list version is echoed on scan receipts. The Device Agent Configuration tab gains a section where targets are entered as tags (#6173). (Author: @subomi)
• Risk findings as an OTLP data export #6018 - Add Risk Findings as a project-scoped source in Data exports and new, non-excluded findings are relayed to your configured OTLP log destinations. The log carries a stable finding ID plus policy, rule, source, and confidence for filtering and deduplication, never the matched content. Exclusions are re-evaluated immediately before each delivery and fail closed. (Author: @tgmendes)
• One benchmarked judge model for prompt-based risk policies #6024 - The per-policy model picker is gone and every prompt-based policy runs on Gemini 3.5 Flash Lite. On the risk judge benchmark the new model improves accuracy, precision, latency, and token usage over the previous default while keeping perfect recall. Policies keep their temperature and fail-open settings. (Author: @vishalg0wda)
• Typed prompt injection detection #4479 - The prompt injection judge now makes one call per event with bounded session context and returns a typed finding: the kind of directive, its target, whether it is operational, and a privacy-safe rationale. Your risk policies decide block versus surface exactly as before. (Author: @vishalg0wda)
• Turn off the observability plugin per project #6161 - Org admins can disable a project's observability plugin from the Observability card on the Plugins page. A disabled plugin is omitted from the published marketplace, is not installed by the device agent, and rejects direct downloads, and a connected marketplace is republished automatically. Marketplace settings changes are recorded in the audit log. The backing column shipped separately as a schema-only migration (#6170). (Author: @speakeasyforgebot)
• Gateway calls classified as the gateway, not shadow MCP #6180 - A hook-observed call whose server URL is a gateway endpoint now shows as that gateway in Tool Logs and insights instead of falling through to shadow MCP. Gateway activity hides members no longer on the gateway, and the activity charts link to the tool logs and insights pages filtered to that gateway. (Author: @daviddanialy)
• Clearer Watchdog exposure bar #6129 - Hovering a category dims the other slices so one reads at a time, and Custom Rules gets its own color so no category looks inactive. (Author: @adaam2)

Bug fixes

• Policy scopes saved as the scanner reads them #6092 - Policy setup saves message type selections as category detection scopes, so the "Applies to" value in Policy Center matches the scanner's effective scope and the scopes a policy's other categories relied on are preserved. (Author: @vishalg0wda)
• Imported chats with NUL bytes no longer fail the sync #6103 - AI provider chat messages and titles containing NUL bytes are stored with the byte dropped instead of failing the compliance sync for that window. (Author: @subomi)