Agent release log

Every agent release, newest first. This page is generated from the release pipeline, so it is complete rather than curated: it includes the verification targets and the one-line fixes as well as the interesting ones.

If you want the story rather than the list, read Three months of the agent, in nine releases.

Agents update themselves through the supervised update channel when a tenant has enabled it, so in normal operation you do not need to act on anything here.

0.3.98 · 04 September 2026

Socket rows carry the owning process and the agent reports its own pid, so a third-party process reaching an address shared with the platform is never written up as the agent's traffic

0.3.97 · 04 September 2026

The Windows MSI enrols by itself when given TOKEN= and SERVER= on the msiexec command line: it registers the device, installs the service and starts it, so Symantec, Intune, a GPO or a golden image...

0.3.96 · 02 September 2026

Windows identity read in-process rather than through PowerShell, so a machine where PowerShell fails no longer reports itself as windows-Unknown-Unknown

0.3.95 · 01 September 2026

Remote control on X11 desktops (Mint, XFCE, MATE, KDE on Xorg), and the agent reports whether it can offer remote control at all, so headless servers stop showing a Control button

0.3.94 · 31 August 2026

Remote control comes to Linux

0.3.93 · 16 August 2026

Lynis: a killed audit is reported as a failure, not posted as a completed one scoring zero

0.3.92 · 16 August 2026

Stop leaving an unconfigured osquery daemon running as SYSTEM on Windows

0.3.91 · 16 August 2026

Skip the paths the server says to skip

0.3.90 · 14 August 2026

Replaces the Windows driver inventory with problem-device detection

0.3.89 · 12 August 2026

Two scanner/diagnostic fixes, both found by using the product rather than reading it

0.3.88 · 12 August 2026

Anchor the vendor bootstrap to compiled-in digests

0.3.87 · 12 August 2026

Close the endpoint-side findings from the 2026-08-12 security pass

0.3.86 · 11 August 2026

A real speed test, and the assistant gets its windrose face

0.3.85 · 11 August 2026

The burst learns network and disk - throughput, IOPS, queue depth, and who is doing the I/O

0.3.84 · 11 August 2026

Metrics_burst - the AI can watch a box live for ten seconds

0.3.83 · 01 August 2026

Retry NATS connect in the background after a startup failure

0.3.82 · 30 July 2026

Stop guessing the notarization timeout just above the last one

0.3.81 · 28 July 2026

The run that proves the fleet moves by itself

0.3.80 · 28 July 2026

The fleet build

0.3.79 · 28 July 2026

Safe on all three platforms

0.3.78 · 28 July 2026

The build the fleet should actually be on

0.3.77 · 28 July 2026

Rollback verification target

0.3.76 · 28 July 2026

Rollback verification target

0.3.75 · 28 July 2026

Self-update verification target

0.3.74 · 28 July 2026

Fixes self-update leaving a Linux endpoint stopped

0.3.73 · 28 July 2026

Self-update verification target

0.3.72 · 28 July 2026

Fixes the self-update supervisor failing to start

0.3.71 · 28 July 2026

Documentation accuracy release, and the first target for automatic self-update

0.3.70 · 28 July 2026

Adds the self-update apply engine

0.3.69 · 28 July 2026

Fixes a silent-stop regression when upgrading Linux endpoints

0.3.68 · 28 July 2026

Adds the self-update client - observe-only

0.3.67 · 28 July 2026

Completes the antivirus fix: the scanner now runs cleanly on Defender endpoints

0.3.66 · 28 July 2026

Makes the scanner actually work on Defender endpoints, and fixes the RHEL install command

0.3.65 · 26 July 2026

Antivirus false-positive fix, Windows crash recovery, and the first signed release manifest

0.3.63 · 15 July 2026

Security: golang.org/x/crypto v0.52.0 (clears 13 Dependabot alerts incl

0.3.62 · 30 June 2026

Surface failed scans

0.3.61 · 29 June 2026

Richer match context + incremental delta scanning

0.3.60 · 29 June 2026

YARA-X scanner 1.16->1.19 + --cpu-limit throttle

0.3.59 · 24 June 2026

First Azure-signed release

0.3.58 · 21 June 2026

Accurate CPU + gated, lighter live metrics

0.3.57 · 21 June 2026

Windows security posture + protected-service visibility

0.3.56 · 16 June 2026

Binary_inventory low-profile pass - hash cache (re-scans skip unchanged files), I/O throttle (default 25 MB/s, no more disk thrash), and default-exclude container-layer noise trees

0.3.55 · 16 June 2026

Binary_inventory typed op (cross-platform SHA-256 executable inventory for NSRL provenance)

0.3.54 · 12 June 2026

Ctrl+Alt+Del injection for remote logon (SendSAS)

0.3.53 · 12 June 2026

Logon-screen + headless remote control: SYSTEM helper follows the input desktop

0.3.52 · 11 June 2026

Record multi-monitor ship (v0.3.52)

0.3.51 · 11 June 2026

Change-driven RC capture - DXGI duplication + partial frames

0.3.50 · 11 June 2026

Windows RC slices 2+3 - input, consent banner, live tuning

0.3.49 · 10 June 2026

RC targets active user session (fixes RDP'd servers)

0.3.48 · 10 June 2026

RC helper windowless (CREATE_NO_WINDOW)

0.3.47 · 10 June 2026

RC param-file readable by helper (fixes instant helper_exit)

0.3.46 · 10 June 2026

RC helper file logging (debuggable first test)

0.3.45 · 10 June 2026

Windows remote control slice 1 (Session-0 helper + screen frame-stream, view-only)

0.3.44 · 10 June 2026

Auto NATS cred re-issue (refetch on startup; server remints on perm drift)

0.3.43 · 10 June 2026

Interactive terminal (PTY) handler

0.3.42 · 09 June 2026

Cross-platform S.M.A.R.T. disk-health collection (new smart_health plan op):

0.3.41 · 09 June 2026

Resilience: a NATS broker connection failure (e.g

0.3.40 · 07 June 2026

Windows Server role/feature auto-tagging

0.3.39 · 06 June 2026

Quieter logs + on-demand log retrieval

0.3.38 · 03 June 2026

Fixes

0.3.37 · 03 June 2026

Lynis cacheDir must be absolute (no-$HOME systemd path-doubling)

0.3.36 · 03 June 2026

Self-serve lynis from the server mirror (Phase 2)

0.3.35 · 31 May 2026

Read-only patch/update intelligence for all three platforms (was Windows-only):

0.3.34 · 23 May 2026

Scanner false-positive cleanup

0.3.33 · 23 May 2026

Scanner no longer self-alerts on its own rule packs

0.3.32 · 23 May 2026

Was: serial yr subprocess per shard

0.3.31 · 23 May 2026

Scanner visibility + safety caps

0.3.30 · 23 May 2026

Scanner now actually scans files

0.3.29 · 23 May 2026

Two fixes to unblock the YARA-X scanner end-to-end

0.3.27 · 23 May 2026

Stops Microsoft Defender quarantining YARA rulepack shards mid-download

0.3.26 · 19 May 2026

Printer JSON wrapper fix (the real one)

0.3.25 · 19 May 2026

WMI child-env hardening + conclusive printer diagnostics

0.3.24 · 19 May 2026

Printer collection via -File/temp-file (regression #3 fix)

0.3.23 · 19 May 2026

Printer audit (Win32_Printer/WMI) + scanner cache Defender exclusion on install

0.3.22 · 18 May 2026

Scan-mode -> rulepack profile mapping

0.3.21 · 18 May 2026

YARA-X scanner

0.3.20 · 18 May 2026

Osquery runtime bootstrap

0.3.19 · 17 May 2026

MSI Stop-only ServiceControl (fixes fresh-install 1603)

0.3.18 · 17 May 2026

Fix on-endpoint logfile under Windows service

0.3.17 · 17 May 2026

Bounded on-endpoint rotating log file

0.3.16 · 17 May 2026

Branded icon/version resource (CI dirty-tree fix) + v2 agent docs

0.3.14 · 17 May 2026

Run via kardianos SCM dispatcher (real Restart-Service fix)

0.3.13 · 17 May 2026

Graceful bounded shutdown (fixes Restart-Service hang)

0.3.12 · 17 May 2026

Server-side per-device cadence gate (purse safety net)

0.3.11 · 16 May 2026

Native wevtapi event-log collector - un-neuter Windows analyses

0.3.10 · 14 May 2026

Redesign eventsFiltered shape + fix upload timeout

0.3.9 · 14 May 2026

Consolidate event-log pipeline to legacy parity

0.3.8 · 14 May 2026

Uncapped 30-day event-log collection

0.3.7 · 14 May 2026

MSI ServiceControl for clean upgrades

0.3.6 · 14 May 2026

Fix Security event log filter + per-channel timeout

0.3.5 · 13 May 2026

Windows drivers handler (slice B.7)

0.3.3 · 13 May 2026

Hardware-inventory typed handler (slice B.6)

0.3.2 · 13 May 2026

System-shared config path + service renamed Wegweiser; fixes start-time SCM timeout

0.3.1 · 13 May 2026

MSI: 64-bit install path + 4-part ProductVersion so MajorUpgrade works between rcs and releases

0.3.0 · 13 May 2026

First stable Go agent release (v2 device-auth, typed handlers, MSI/deb/rpm/pkg pipeline)

0.3.0-rc4 · 13 May 2026

Rc4: pin WiX 4.0.5 (avoid OSMF EULA)

0.3.0-rc5 · 13 May 2026

Version-less artifact names (slice C.2+C.3)