September 3, 2026

Offline SDK and CLI install for air-gapped deployments

16 new 11 improved 17 fixed

Self-hosted and air-gapped deployments get a major quality-of-life upgrade this week: the SDK and CLI are now available as offline bundles, docs ship inside every deployment, and a round of egress, startup, and TLS fixes make disconnected installs substantially more reliable.

New

Offline SDK and CLI install for air-gapped deployments. Self-hosted deployments now serve the SDK and CLI as self-contained offline bundles, so machines inside a network enclave can install the client without reaching PyPI or any external host.
Documentation bundled in every deployment. Docs are served at /docs inside every deployment, giving air-gapped and on-prem operators full documentation access without an internet connection.
Global Tool Registry. Published capability Python tools and declared command wrappers now have stable, organization-scoped identities with immutable revision history, queryable via GET /api/v1/tools and GET /api/v1/tools/{tool_id}.
Organization member credit cap. Organization owners can set a lifetime credit cap per non-owner member; capped members see their own remaining allowance on Settings → Billing rather than the shared org balance.
Bulk share-with-workspace for agent sessions. You can now select multiple agent sessions and share them all with your workspace in a single action from the floating action bar.
Wrangler (Cloudflare Workers) in web-security. The web-security capability now includes Cloudflare Workers via wrangler, letting agents deploy programmable OAST endpoints for blind XSS payload hosting, callback logging, and SSRF chain redirection.
Signup IP allow-list mode. Admins can now configure signup IP policy in allow-list mode, restricting new account creation to explicitly approved IPv4/IPv6 CIDR ranges with deny rules taking precedence.
Multi-agent red-teaming mesh tasks. 12 multi-agent AI red-teaming tasks — covering access-control bypass, indirect injection, memory poisoning, MCP poisoning, reasoning hijack, supply-chain, data exfiltration, DevOps RCE, and sector-specific meshes — are now publicly available in the task catalog under the airt-generative-ai set.
Indirect prompt injection web task. A new indirect prompt injection task environment is available, where agents fetch a public web page hiding instructions via five concealment techniques (HTML comments, hidden CSS, off-screen ARIA, white-on-white text, Unicode tags) and any triggered collection request proves the injection succeeded.
Agentic CI/CD secret-exfil task. A new multiagent task simulates a CI/CD secret-exfiltration scenario where an agent must detect or exploit hidden instructions in untrusted repo content that cause a CI assistant to leak its deploy secret.
Multi-step tool attack sandbox task. A new multi-step tool attack task environment is available: an over-permissioned tool-using agent with file, database, email, and HTTP tools where success requires chaining a sensitive data source to an external exfiltration sink.
Honeytoken tools for ai-red-teaming. The ai-red-teaming capability gains two honeytoken tools: mint canary tokens (exfil or RCE variants) and check whether a target agent leaked them across an output boundary.
Multi-step tool-attack search for AI red teaming. The AI red-teaming agent can now run algorithmic multi-step tool-attack searches against HTTP agents, finding replay-stable read-then-exfiltrate causal paths across tool call chains.
Agentic red-teaming suite: OWASP-ASI runner + honeytoken harness. The SDK now includes a turnkey OWASP-ASI agentic attack suite runner, argument-aware tool-evidence scoring, and a honeytoken harness for black-box exfil and RCE detection against any HTTP agent.
Environment-agnostic agent attack-success detection. The airt SDK now includes environment-agnostic attack-success detection across any agent, using canary exfiltration, OAST beacons, dataflow taint, LLM judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.
Agentic exfil transforms and browser-attack scorers. New SDK transforms and scorers cover two agentic exfiltration channels (search-query and trusted-domain image exfil) plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.

Improvements

Runtime cold-start timing breakdown. dn runtime start and GET /runtimes/{id} now report a full timing breakdown — total, platform overhead, provider provisioning, boot, installs, and the slowest step — so slow starts can be attributed rather than guessed at.
Richer support bundle diagnostics for on-prem installs. Support bundles now collect product-level diagnostics — pod scheduling, proxy auth, TLS, and runtime connectivity — so failures surface with actionable detail instead of generic timeouts.
Redesigned chat session transcript. The session transcript view has been rebuilt with improved message grouping, tool event display, and reasoning row rendering.
Chat project picker and session search. The chat interface gains a project picker, a session search dialog, and an improved session list panel with better layout and navigation.
Custom CA trust for the Node frontend on self-hosted installs. Self-hosted deployments can now inject a custom CA bundle into the Node frontend via caBundle, completing CA trust support across all workloads (API, LiteLLM, and frontend).
East-west network trust boundary documentation. Self-hosting docs now describe the platform’s two security zones — platform services and sandbox pods — and the cluster-level segmentation that operators are responsible for providing.
Air-gap upgrade docs cover registry drift. Air-gap upgrade docs now explain what happens when a release adds new images, the CLI upgrade path, post-upgrade version checks, and how to recover a missing ECR repository inside a sealed enclave.
Air-gap install prerequisite docs. Air-gap and Helm install docs now cover ECR repository pre-creation, StorageClass default requirements, and the platform readiness endpoint.
Support-bundle binary staging for offline use. Air-gap installation docs explain how to stage the support-bundle binary before going offline, covering both KOTS existing-cluster and Helm CLI paths.
TUI guard policy documentation. A new docs page covers the TUI guard policy in full: rubric configuration, transcript strategies, scope editor, deny behavior, judge model selection, and prompt caching.
AI red-teaming getting-started docs refresh. The TUI and SDK getting-started pages are rewritten to use hosted dn/ models (no API keys required), with corrected commands, accurate UI labels, and runnable examples.

Fixes

Evaluation claim deadlocks eliminated. Concurrent evaluation workers no longer deadlock when claiming items, preventing stalled evaluation runs under load.
Self-hosted sandbox runtimes now start reliably under cluster-assigned UIDs. Sandbox runtimes start correctly when a cluster assigns an arbitrary UID, include CA trust for on-prem model proxy calls, and bind before accepting connections to avoid false-ready signals.
Sandbox egress scope now takes effect on real deployments. Three blocking defects are resolved: air-gapped installs now carry correct allow-list entries for the model gateway and object store; the global.sandbox.egressExtraAllow chart value now takes effect; and dn evaluation create --egress targets are no longer silently dropped.
Air-gapped deployments stop making outbound connections. Platform services no longer attempt connections to MinIO SUBNET, MinIO release checks, Prisma checkpoint, or GitHub on sandbox runtime start; Traefik version-check and usage-statistics callhome requests are also disabled and the chart version is pinned.
Sandbox pause now refused on unsupported providers. Pausing a sandbox on a provider that doesn’t support pause returns an error immediately instead of silently recording the sandbox as paused while it continued running and accruing compute charges.
On-prem agent generation via OpenSandbox now works. Model calls from OpenSandbox runtimes on Embedded Cluster deployments are routed through the in-cluster model proxy instead of an unreachable public endpoint.
Self-hosted installs no longer show SaaS consent surfaces. Registration and account settings on self-hosted installs no longer display the marketing email opt-in, Dreadnode Terms of Service, or Privacy Policy.
Web search no longer falls through to a public backend on air-gapped installs. When the hosted search backend is unavailable, the cascade stops cleanly and reports a clear error instead of falling back to DuckDuckGo.
Outbound CA Secret setup guide fixed. The outbound TLS trust setup guide now uses server-side apply for the CA Secret, fixing a Kubernetes annotation size limit that caused the documented commands to fail on any standard distribution.
Multiagent mesh tasks route model calls through the platform LiteLLM proxy. Five multiagent mesh tasks now correctly route model overrides through the platform proxy when no Groq API key is present, so model_overrides with platform models work as expected.
Inference-key provisioning timeout extended. dn/ model resolution in notebooks and scripts no longer fails with a misleading proxy configuration error when inference-key provisioning takes longer than 30 seconds.
dn --resume now finds sessions across workspaces. dn --resume <session> searches all workspaces in your org rather than only the current workspace.
dn --resume fails safely on missing or ambiguous sessions. Running dn --resume with a missing or ambiguous session now shows a connection-failed state instead of silently starting a new session.
TUI composer preserves unsent drafts during arrow-key navigation. Pressing Up/Down no longer clears an unsent draft — cursor navigation stays within the text area until the draft is empty.
Pasted content in the TUI composer deletes in one keypress. Pressing Backspace or Delete now removes an entire pasted-content placeholder in a single keypress instead of deleting it character by character.
Typing ‘r’ in TUI workspace search now appends to the query. Previously, pressing ‘r’ triggered a refresh instead of adding the character to the search input.
Selecting the active project in the workspace browser now dismisses the panel. Previously, picking the already-active project showed an ‘Already active’ notice instead of closing the browser.