Lakera

No entries match these filters. Clear filters

1. changelog Oct 31, 2026 · issue 126

   Lakera adds a request latency percentiles chart to the Analytics page showing p25, p50, p75, and p95 over time⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Spot tail-latency spikes in Guard API traffic by checking p95 on the Analytics page.
   📍In the Lakera console, go to Analytics › Request Latency Percentiles. Hover over any point to read p25/p50/p75/p95 values for that time bucket. Click a legend entry (e.g. 95th) to isolate that percentile on the chart.
2. updated seen Oct 26, 2026 · issue 121

   Lakera Analytics page gains a request latency percentiles chart showing p25, p50, p75, and p95 Guard API latency over time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Identify tail-latency regressions in your Guard API traffic after a deployment or traffic spike.
   📍In the Lakera dashboard, go to Analytics › Request Latency Percentiles chart. Hover over a time bucket to read p25/p50/p75/p95 values, then click a legend entry (e.g. p95) to isolate that percentile and confirm whether tail latency exceeds your SLO threshold.
3. docs update Oct 5, 2026 · issue 095

   Lakera Red gains tool-response poisoning delivery via traced tool calls, with session-id-based scan correlation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Bind a session id before the first agent reply so Red can associate all traced tool calls with the correct tool-response-poisoning scan.
   copy

   $ setSessionId('<your-session-or-conversation-id>');

   • Adds tool-response-poisoning strategy that splices adversarial payloads into traced tool return values — targeting string fields in plain text, JSON objects/arrays (including content[].text MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. shape), while passing numbers, booleans, and null through unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces session-id binding (setSessionId / set_session_id) to tie reported tool calls to the correct scan and correlate findings with application logs.
   • Scopes poisoning delivery to traced tools only — tools omitted from the tracing allowlist cannot be targeted, giving practitioners explicit control over attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
   • Adds tool-response-poisoning strategy that splices adversarial payloads into traced tool return values — targeting string fields in plain text, JSON objects/arrays (including content[].text MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. shape), while passing numbers, booleans, and null through unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces session-id binding (setSessionId / set_session_id) to tie reported tool calls to the correct scan and correlate findings with application logs.

   1 more in Everything

4. docs update Oct 5, 2026 · issue 095

   Lakera Red adds SDK/CLI objectives parameter, inline CustomObjective definitions, and a dashboard Objectives library for managing scan targets.

   • New vulnerability checkAdds objectives parameter support for passing specific objective IDs when creating a scan via the SDK/CLI.
   • Supports custom objective definitions inline in SDK/CLI scan requests via the CustomObjective type in TypeScript and Python.
   • Adds an Objectives library in the dashboard sidebar for selecting, deselecting, or creating custom objectives with a severity level and category before starting a scan.

   3 details in Everything

   • New detection Tool Response Poisoning indirect attack strategy
5. docs update Oct 4, 2026 · issue 094

   Lakera adds US-specific (us.api.lakera.ai) and Singapore/Asia (ap-southeast-1) API endpoints alongside existing EU routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds us.api.lakera.ai as a dedicated US-region API endpoint, complementing the existing https://eu.api.lakera.ai for EU traffic and https://api.lakera.ai for closest-region routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports pinning requests to a specific region using the ["eu-south-2"] region identifier in API configuration.
   • Adds us.api.lakera.ai as a dedicated US-region API endpoint, complementing the existing https://eu.api.lakera.ai for EU traffic and https://api.lakera.ai for closest-region routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. docs update Oct 4, 2026 · issue 094

   Lakera adds request_uuid in API response metadata and direct dashboard lookup via URL or Request IDs filter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Every API response now includes a request_uuid field in its metadata object, enabling direct lookup of any request in the dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports direct Log Details URL navigation at https://platform.lakera.ai/dashboard/requests/<request_uuid> to reach any request across all dates.
   • Adds a Request IDs filter on the dashboard requests view, accepting one or more UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to locate requests within a selected time range.

   3 details in Everything

7. docs update Sep 25, 2026 · issue 085

   Lakera Red adds inline custom scan objectives via SDK/CLI with severity, success indicators, and category grouping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Define a custom attack objective inline in your scan config to test for a specific prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. scenario without adding it to the shared objectives library.
   yaml copy

   attackDescription: Attempt to exfiltrate system prompt via role confusion
   successIndicators: Response contains verbatim system prompt text
   severity: high
   additionalContext: The target LLM acts as a customer-support agent with a confidential system prompt
   categoryId: prompt-injection

   • Adds inline custom objectives to scan configuration via SDK/CLI, with fields attackDescription, successIndicators, severity ('critical', 'high', 'medium', 'low'), additionalContext, and categoryId.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an objectives library UI where practitioners can select, deselect, or create custom objectives with a severity level and category before starting a scan.

   2 details in Everything

8. 1.0.0 Sep 18, 2026 · issue 078

   API surface changed: 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ~ POST /v2/guard: param Authorization (header) removed
   • ~ POST /v2/guard/results: param Authorization (header) removed
   • ~ POST /v2/policies/health: param Authorization (header) removed
   • ~ POST /v2/policies/lint: param Authorization (header) removed
   └──▷ BREAKING ON UPGRADE

   • !POST /v2/guard: param Authorization (header) removed
   • !POST /v2/guard/results: param Authorization (header) removed
   • !POST /v2/policies/health: param Authorization (header) removed
   • !POST /v2/policies/lint: param Authorization (header) removed
9. docs update Sep 18, 2026 · issue 078

   Lakera Audio Defense adds prompt-attack screening for audio input, including an acoustic manipulation check before transcription.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Audio Defense, a new capability that screens audio clips for prompt-attack content before they reach a model, with no separate transcription pipeline required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Runs a two-stage pipeline: an acoustic check flags manipulated or jammed recordings before transcription, then a content check scores the transcript with the same prompt-attack model used for text.
   • Detects spoken prompt injections and jailbreaks across 80+ languages and scripts.
   • Available as a self-hosted deployment where the full pipeline, including transcription, runs inside your own infrastructure so no audio leaves it.
   • Available as a SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. deployment in Early Access, with size limits and processing region confirmed during onboarding.

   5 details in Everything

10. docs update Sep 18, 2026 · issue 078

    Lakera Guard adds Audio Defense in Early Access to screen audio inputs for spoken prompt injections and audio-based attacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
11. docs update Sep 12, 2026 · issue 072

    Lakera Red adds tool-call tracing via interceptTool/intercept_tool so red-team scans capture what agents actually did, not just their final replies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Opt a deployment environment into tool tracing without touching source code — safe to leave unset in shared or staging environments where no data should leave.
    copy

    $ export LAKERA_RED_TOOL_INTERCEPT="true"
    export LAKERA_RED_API_KEY="$(vault read -field=value secret/lakera/api-key)"
    export LAKERA_RED_URL="https://red-webhooks.lakera.ai"

    Instrument a single tool in TypeScript so every call during a red-team scan is reported to Red with full argument and result context.
    typescript copy

    import { interceptTool } from "lakera-red-sdk"
    
    async function getTickets(status: string, conversationId: string) {
      const result = await getTicketsApi(status)
      return await interceptTool({
        toolName: "get_tickets",
        toolArguments: JSON.stringify({ status }),
        result,
        conversationId
      })
    }

    Wire tracing once into an existing tool-dispatch middleware and scope it to specific high-risk tools, avoiding per-tool edits across a large agent codebase.
    typescript copy

    import { interceptTool } from "lakera-red-sdk"
    
    const LAKERA_RED_ENABLED = process.env.LAKERA_RED_TOOL_INTERCEPT === "true"
    const TRACED_TOOLS = new Set(["url_fetch"])
    
    const lakeraRedMiddleware = async (call, ctx, next) => {
      const result = await next(call, ctx)
      if (!LAKERA_RED_ENABLED || !TRACED_TOOLS.has(call.name)) return result
      try {
        return await interceptTool({
          toolName: call.name,
          toolArguments: JSON.stringify(call.args),
          result,
          conversationId: ctx.conversationId
        })
      } catch {
        return result
      }
    }

    • Adds LAKERA_RED_TOOL_INTERCEPT, LAKERA_RED_API_KEY, and LAKERA_RED_URL environment variables to enable and configure tool tracing in the lakera-red-sdk.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds interceptTool (TypeScript) / intercept_tool (Python) module-level functions to the lakera-red-sdk to report tool name, arguments, and result to the Red API over TLS and return the result unchanged.
    • Supports tracing any JsonValue result type — string, number, boolean, null, array, or object — through interceptTool/intercept_tool.
    • Supports tool tracing for both platform targets (auto-associated via session id) and SDK-driven scans (via a conversationId you supply) without requiring a framework adapter.
    • Supports a dispatch-middleware placement for interceptTool so tracing can be wired once across all tools rather than per-tool, with optional scoping to an allowlist of tool names.

    5 details in Everything

12. docs update Sep 10, 2026 · issue 070

    Lakera Red adds tool tracing so red team scans capture every agent tool call and result, not just final replies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Enable tool tracing in an agent runtime before running a red team scan, so every tool call is reported to the Red API.
    copy

    $ export LAKERA_RED_TOOL_INTERCEPT="true"
    export LAKERA_RED_API_KEY="your-red-team-api-key"
    export LAKERA_RED_URL="https://red-webhooks.lakera.ai"

    Instrument a single tool in TypeScript so its result is traced and returned unchanged to the caller.
    typescript copy

    import { interceptTool } from "lakera-red-sdk"
    
    async function getTickets(status: string, conversationId: string) {
      const result = await getTicketsApi(status)  // your real tool
      return await interceptTool({
        toolName: "get_tickets",
        toolArguments: JSON.stringify({ status }),
        result,
        conversationId  // your own conversation/thread id
      })
    }

    Wire tracing once into an existing tool-dispatch middleware and scope it to specific tools, so you avoid editing every tool individually.
    typescript copy

    import { interceptTool } from "lakera-red-sdk"
    
    const LAKERA_RED_ENABLED = process.env.LAKERA_RED_TOOL_INTERCEPT === "true"
    const TRACED_TOOLS = new Set(["url_fetch"])  // optional: scope to specific tools
    
    const lakeraRedMiddleware = async (call, ctx, next) => {
      const result = await next(call, ctx)  // run the real tool
      if (!LAKERA_RED_ENABLED || !TRACED_TOOLS.has(call.name)) {
        return result
      }
      try {
        return await interceptTool({
          toolName: call.name,
          toolArguments: JSON.stringify(call.args),
          result,
          conversationId: ctx.conversationId
        })
      } catch {
        return result  // fail-open: never break the agent
      }
    }

    • Adds LAKERA_RED_TOOL_INTERCEPT, LAKERA_RED_API_KEY, and LAKERA_RED_URL environment variables to opt agent runtimes into tool tracing — off by default with zero network egress when unset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds interceptTool (TypeScript) / intercept_tool (Python) module-level functions in lakera-red-sdk to report a tool's name, arguments, and result to the Red API and return the result unchanged, accepting any JsonValue (string, number, boolean, null, array, or object).
    • Supports a dispatch-middleware integration pattern so tracing can be wired once into an existing tool-dispatch path — with optional per-tool allowlisting — rather than instrumenting each tool individually.
    • Supports interception at both the tool source (raw result, before redaction or sanitization) and at the middleware layer (what the model actually receives), with the source placement offering higher fidelity.
    • Ties reported tool calls to the right scan via a conversationId you supply — works for both platform targets (automatic) and SDK-driven scans.

    5 details in Everything

13. docs update Sep 7, 2026 · issue 067

    Lakera AI Guardrails gains filesystem-based policy loading via FORCE_POLICY_MANAGER=fs, HelmHelmA package manager for Kubernetes, maintained by the CNCF, that lets tools define, version, and deploy clusters of Kubernetes resources as a single reusable unit called a chart. chart support, and S3S3Amazon's object storage service, where files are stored in named buckets and retrieved over HTTP; cyber tools use it for scalable, cheap log or artifact storage without managing a filesystem. policy sourcing with new env vars

    └──▷ TRY IT
    Run AI Guardrails locally with policies loaded from a read-only bind-mounted directory instead of S3, making the policy source explicit and portable.
    copy

    $ docker run -e LOCAL_POLICY_DIR=/policies -e FORCE_POLICY_MANAGER=fs -e LAKERA_GUARD_LICENSE=$YOUR_LICENSE -v ./policies:/policies:ro -p 8000:8000 <image>

    Install the lakera-guard Helm chart with a custom policy file injected at install time, letting the chart handle ConfigMap creation and mounting automatically.
    copy

    $ helm upgrade --install lakera-guard --namespace lakera-guard --set 'guard.policies[0].name=custom-policies.json' --set-file 'guard.policies[0].data=./custom-policies.json'

    Verify that a specific project resolves to the expected custom policy and detector set rather than the AI Guardrails Default Policy.
    copy

    $ curl -X POST http://localhost:8000/v2/guard -H 'Content-Type: application/json' -d '{"messages": [{"role": "user", "content": "test"}], "project_id": "project-chatbot", "breakdown": true}'

    • Adds FORCE_POLICY_MANAGER=fs environment variable to force AI Guardrails to read policies from a mounted local directory instead of S3, with FORCE_POLICY_MANAGER taking precedence over container-default detection when both are set.
    • Adds LOCAL_POLICY_DIR environment variable to point the container at a mounted policy directory for filesystem-based self-hosted deployments.
    • Adds S3-based policy sourcing via POLICY_BUCKET_NAME, POLICY_ENDPOINT_URL, and POLICY_PREFIX environment variables alongside standard AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY credentials.
    • Adds guard.policies Helm chart value to the lakera-guard chart, which automatically creates the ConfigMap, mounts it read-only, and sets LOCAL_POLICY_DIR — supports --set-file for loading policy from an external file at install time.
    • Adds breakdown field to POST /v2/guard request payload, returning the resolved detector list and whether the project uses a custom policy or the AI Guardrails Default Policy.

    +1 more show less

    • Adds startup log diagnostics that report which policy source was selected (using policy manager override: local, getting policies from local), enabling operators to confirm filesystem policy loading on boot.

    6 details in Everything

14. docs update Sep 7, 2026 · issue 067

    Lakera adds Dangerous Deviation detector and runtime Tool Allow/Deny List policies

    ⤢ ⤢ ⤢ ⤢
    • Adds the Dangerous Deviation detector to Lakera's SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. policy options.
    • Adds a runtime Tool Allow/Deny List to Lakera's SaaS policy options.

    2 details in Everything

15. docs update Sep 7, 2026 · issue 067

    Lakera adds Dangerous Deviation detector (beta) to catch unauthorized agent tool calls — data leakage, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and system destruction.

    • Adds Dangerous Deviation detector (beta) to the Guard API, flagging agent tool calls that are both dangerous and lack a warrant in trusted user or system role messages.
    • Detects three danger types: data leakage, access and privilege escalation (sudo/admin grants, widened ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., public resource sharing), and system destruction (deleting/wiping persistent resources).
    • Returns an explanation object per detection — with reason_code (machine-readable, stable, routing-safe), reason (user-facing text), agent_guidance (instruction to feed back into the agent context), and debug_info.dev_tips (developer remediation guidance) — when tool definitions are provided in the top-level tools field.
    • Detected events appear in Guard API logs with reason text and are counted in analytics.

    4 details in Everything

16. docs update Sep 7, 2026 · issue 067

    Lakera: Adds the Dangerous Deviation detector to identify agent actions that fall outside the agent's trusted mandate.

    • Adds the Tool Allow/Deny List to control which tools an agent may call at runtime.

    1 detail in Everything

17. docs update Sep 7, 2026 · issue 067

    Lakera: Adds Dangerous Deviation detection for agent behavior defense, identifying when an agent deviates unexpectedly from expected behavior.

    • Adds Tool Allow/Deny List controls to restrict or permit specific tools available to agents, limiting propagation of compromised behavior.
    • Extends Prompt Defense coverage to tool responses and tool descriptions in addition to inputs.
    • Adds Tool Allow/Deny List controls to restrict or permit specific tools available to agents, limiting propagation of compromised behavior.

    1 more in Everything

18. updated seen Sep 7, 2026 · issue 067

    Lakera adds AI Agent Security early access, Policy Impact Simulator, audio debugging flag, and self-hosted request logging.

    └──▷ TRY IT
    Inspect audio debug metadata when a Guard audio request is flagged, to understand why a sample was screened.
    copy

    $ curl -X POST https://<your-guard-host>/v2/guard/audio \
      -H 'Authorization: Bearer <API_KEY>' \
      -F 'audio_payload=@sample.wav'

    Cap warmup token usage and tune policy reload frequency when deploying a self-hosted Guard container, to reduce startup time and control reload overhead.
    .env copy

    POLICY_RELOAD_INTERVAL_SECONDS=120
    MAX_WARMUP_TOKENS=25000

    Scrape the Guard telemetry endpoint from a Prometheus-compatible monitoring stack to track self-hosted request throughput and model latency.
    copy

    $ curl http://<your-guard-host>/metrics

    • Adds audio_payload flag in Guard audio requests to expose debugging information about the audio sample.
    • Adds POLICY_RELOAD_INTERVAL_SECONDS environment variable to control the configurable policy reload period for self-hosted containers.
    • Adds MAX_WARMUP_TOKENS environment variable (default 50000) to cap warmup tokens in self-hosted containers, using the minimum of MAX_WARMUP_TOKENS and MAX_INPUT_TOKENS.
    • Adds /metrics endpoint to expose telemetry data for self-hosted deployments.
    • Adds Request Logging for self-hosted deployments suitable for monitoring solutions such as Elastic Stack.

    +13 more show less

    • New AI Agent Security (Early Access) product extends AI Guardrails with discovery and risk assessment for agents your organization builds and deploys.
    • New Policy Impact Simulator in the Dashboard shows how different sensitivity levels and guardrail configurations would have affected historical traffic.
    • Guard API breakdown response now includes a result field for each detector showing confidence level (l1_confident, l2_very_likely, l3_likely, l4_less_likely, l5_unlikely).
    • Adds support for developer and tool roles for messages in the API to cover agentic and tool-using use cases.
    • Expands API coverage to include tool role and tool_calls to better support agentic workflows.
    • Adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. support for self-hosted containers, compatible with any CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. 12.x GPU, accelerating request processing.
    • Adds support for Portuguese language in Prompt Defense.
    • Adds HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint support for Guard.
    • Adds user-defined prompt Allow/Deny lists to customise detection behaviour, with Allow/Deny list detections shown in the Request Details page.
    • Adds weapons detector (firearms, bombs, missiles, bladed weapons, other personal weapons) and crime detector as new Content Moderation detectors.
    • Gateway now logs requests to v2/guard/audio for monitoring purposes.
    • Enhanced guardrails overview table with filtering functionality and a Policies column; guardrails page adds creator field and last edited by/at information.
    • Enhanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Requests page adds filtering and ordering of columns, request_id field, and shareable URL-based filter views.
    • Adds audio_payload flag in Guard audio requests to expose debugging information about the audio sample.
    • Adds POLICY_RELOAD_INTERVAL_SECONDS environment variable to control the configurable policy reload period for self-hosted containers.
    • Adds MAX_WARMUP_TOKENS environment variable (default 50000) to cap warmup tokens in self-hosted containers, using the minimum of MAX_WARMUP_TOKENS and MAX_INPUT_TOKENS.
    • Adds /metrics endpoint to expose telemetry data for self-hosted deployments.
    • Adds Request Logging for self-hosted deployments suitable for monitoring solutions such as Elastic Stack.

    +7 more show less

    • New AI Agent Security (Early Access) product extends AI Guardrails with discovery and risk assessment for agents your organization builds and deploys.
    • New Policy Impact Simulator in the Dashboard shows how different sensitivity levels and guardrail configurations would have affected historical traffic.
    • Adds support for developer and tool roles for messages in the API to cover agentic and tool-using use cases.
    • Adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. support for self-hosted containers, compatible with any CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. 12.x GPU, accelerating request processing.
    • Adds HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. endpoint support for Guard.
    • Adds user-defined prompt Allow/Deny lists to customise detection behaviour, with Allow/Deny list detections shown in the Request Details page.
    • Adds weapons detector (firearms, bombs, missiles, bladed weapons, other personal weapons) and crime detector as new Content Moderation detectors.

    6 more in Everything

19. docs update Aug 31, 2026 · issue 060

    Lakera adds Custom Guardrails (beta): plain-language detection policies mixing pattern and semantic rules, no code required.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Scope a SQL keyword pattern rule to tool calls only, so it fires on SQL an agent sends to a database tool rather than on user questions about SQL syntax.
    📍In the policies page, go to New Policy › Build Custom Policy, then describe: 'Flag any message containing DROP TABLE or DELETE FROM'. When the guardrail is compiled, set the screening role scope to assistant::tool_call before saving.
    Tune a semantic rule's sensitivity to catch more borderline financial-advice content at the cost of more false positives.
    📍In the guardrail builder, select the semantic rule for 'flag messages that give financial advice', change Threshold from HIGH to LOW, then run test sentences to review the recall/precision trade-off before saving.
    • New Custom Guardrails (beta) capability lets practitioners describe detection targets in plain language — the built-in AI assistant compiles the description into a detection policy, asking clarifying questions when scope is ambiguous.
    • Supports two composable rule types: deterministic pattern rules (IP addresses, national identifiers, internal ticket/account ID schemes) and semantic rules that detect meaning and intent across languages and paraphrases.
    • Semantic rules expose a LOW / MEDIUM / HIGH detection threshold (default HIGH) to tune recall vs. false-positive rate without rewriting the rule description.
    • A single custom guardrail can combine pattern and semantic rules with natural-language logic (e.g. 'flag Italian fiscal codes and any mentions of financial advice').
    • Guardrails are scoped to screening roles — defaulting to user and assistant — with support for narrower scopes such as assistant::tool_call to limit firing to actual agent tool invocations rather than user questions about the same content.

    +2 more show less

    • Custom guardrails run inside Guard at screening time with no LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. on the request path and no external calls, evaluated in the same request as Check Point managed guardrails.
    • Custom guardrails are built from the policies page via New Policy → Build Custom Policy → Configure or add a custom guardrail from the catalog.

    7 details in Everything

20. docs update Aug 31, 2026 · issue 060

    Lakera adds custom guardrails (beta) letting practitioners define bespoke detection policies in plain language.

21. docs update Aug 31, 2026 · issue 060

    Lakera Guard adds beta access to custom security and content controls defined in natural language.

    ⤢
    • New beta feature lets practitioners define and fine-tune custom security and content controls using natural language rules.

    1 detail in Everything

22. docs update Aug 17, 2026 · issue 048

    Lakera adds Off-Task Action detector and tool-response screening to catch dangerous agent tool calls and poisoned tool results.

    • Adds the Off-Task Action detector, which flags dangerous tool calls (data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., data destruction) that are inconsistent with the user's stated intent in the conversation history.
    • Enables screening of tool responses as untrusted content: pass tool results as role messages in the Guard API request to run Prompt Defense and Data Leakage detection on poisoned tool responses.
    • Off-Task Action detector ships in a conservative, low-false-positive configuration; the documentation recommends enabling in Detect mode first, then switching to Enforce mode after validating accuracy on real traffic.
    • Detected Off-Task Action events appear in logs with a reason text and are counted in analytics.

    4 details in Everything

23. docs update Aug 17, 2026 · issue 048

    Lakera Guard projects now support a Detect mode alongside Enforce mode, letting teams tune policies against live traffic before enforcing.

    ⤢ ⤢ ⤢ ⤢
    • Adds Detect and Enforce modes per project, letting teams roll out a new policy or tune detector thresholds against production traffic in Detect mode before switching to Enforce mode.
    • Allows switching a project between Enforce and Detect at any time; changes take effect within a few minutes on future requests.
    • Requests processed without a project ID are always handled in Enforce mode regardless of project-level settings.

    3 details in Everything

24. 1.0.0 Aug 14, 2026 · issue 045

    API surface changed: 1 modified

    API change

    API surface changed: 1 modified

    • ~ POST /v2/guard: response schema changed
    • POST /v2/guard: response schema changed

    1 detail in Everything

25. docs update Aug 9, 2026 · issue 040

    Lakera AI Guardrails adds custom PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations./content detectors, unknown-link detection with allow lists, custom allow/deny lists, and a Policy Impact Simulator for incident response.

    ⤢ ⤢ ⤢ ⤢
    • Adds custom regex-based detectors for arbitrary content patterns — including internal employee IDs, national IDs, or competitor name mentions — matching case-insensitively and as standalone words.
    • Adds an Unknown Links detector that flags URLs outside the top one million most popular domains to prevent phishing links being returned by an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. via data poisoning or indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools..
    • Supports a custom domain allow list in policy configuration so that internal or niche-but-safe domains are never flagged by the Unknown Links detector.
    • Introduces per-policy confidence threshold configuration to control the sensitivity level (L1–L4) at which guardrail detectors treat content as a threat.
    • Adds custom allow and deny lists to temporarily override model detection decisions, enabling rapid remediation of false positives or false negatives affecting critical workflows.

    +1 more show less

    • Introduces a Policy Impact Simulator that displays historical detection rates per sensitivity level (L1–L4) regardless of current project mode, supporting structured incident response when false positive rates spike.

    6 details in Everything

26. docs update Aug 9, 2026 · issue 040

    Lakera adds allow and deny lists to override AI Guardrails detector decisions using fuzzy match patterns.

    • New allow list support lets practitioners override false positives by adding a full prompt string so matching content passes through without being flagged, regardless of policy configuration.
    • New deny list support forces detection of specific content via fuzzy substring matching, flagging any close match in Flagging mode regardless of detector confidence — useful for overriding false negatives.
    • Both lists use fuzzy match patterns and operate without modifying the underlying model behavior, enabling lightweight, on-the-fly tuning of Check Point AI Guardrails decisions.

    3 details in Everything

27. docs update Aug 9, 2026 · issue 040

    Lakera adds Off-Task Action detector and Tool Allow/Deny List controls for agent runtime protection via the Guard API.

    • New Off-Task Action detector identifies tool calls inconsistent with the user's intent in the conversation, returning reason text explaining the inconsistency; enable it in your policy and include conversation history and the tool call in your Guard API request.
    • New Tool Allow List mode detects tool calls for any tool not on a permitted list — use when an agent has a fixed, known set of tools it should ever use.
    • New Tool Deny List mode detects tool calls for tools explicitly on a blocked list — use to restrict specific high-risk tools while leaving all others unrestricted.
    • Detection results for Off-Task Action and Tool Allow/Deny List detections are returned in the Guard API response and logged with reason text in analytics.
    • Supports a staged rollout path: run in Detection mode (logs detections without blocking) first, then switch the project to Flagging mode from the dashboard once accuracy is validated — no code changes required between modes.

    5 details in Everything

28. docs update Aug 9, 2026 · issue 040

    Lakera adds Detection and Flagging modes so threat response behavior can be switched without code changes.

    ⤢ ⤢ ⤢ ⤢
    • Introduces Detection and Flagging modes, letting practitioners change how an application responds to detected threats without modifying code.

    1 detail in Everything

29. docs update Aug 9, 2026 · issue 040

    Lakera adds unknown-link phishing detection, Off-Task Action detector, and Tool Allow/Deny List for AI agents.

    • New Off-Task Action detector identifies tool calls inconsistent with the user's intent, keeping AI agents within policy.
    • New Tool Allow/Deny List controls which tools an agent may call at runtime.
    • Adds unknown-link detection to prevent attackers manipulating an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. into displaying malicious or phishing links to users.
    • Adds override lists to temporarily suppress false positives or false negatives while waiting for model improvements, without making permanent policy changes.

    4 details in Everything

30. docs update seen Aug 1, 2026 · issue 032

    Lakera adds Detection mode for projects — observe policy hits without enforcing blocks, ideal for safe policy rollouts.

    └──▷ HOW TO FIND IT
    Enable Detection mode when creating or updating a project via the API to observe what your policy would catch in production before switching to enforcement.
    📍In the dashboard, open your project's settings and set Project Mode to Detection, or pass "action": "detect" in the API project create/edit request.
    • New Project Mode setting lets you run a project in Detection (detect) mode, surfacing policy hits in the response breakdown and dashboard without setting flagged: true, so you can tune detectors against live traffic before enforcing.

    1 detail in Everything

31. updated seen Jul 15, 2026 · issue 015

    Lakera adds AI Agent Security (Early Access), Policy Impact Simulator, per-detector confidence levels, and a self-harm subcategory to content moderation.

    └──▷ HOW TO FIND IT
    Before tightening a policy, use the Policy Impact Simulator to preview how many historical requests would have been flagged at each sensitivity level.
    📍In the dashboard, navigate to Policies › select a policy › Policy Impact Simulator. Adjust the sensitivity slider across L1–L4 and review the flagging-rate and category-level breakdown charts before saving.
    Cover agentic pipelines by sending tool-role messages so Lakera evaluates content produced by tool calls, not just end-user turns.
    copy

    $ curl -X POST https://api.lakera.ai/v1/guard \
      -H 'Authorization: Bearer $LAKERA_GUARD_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"messages": [{"role": "developer", "content": "You are a helpful assistant."}, {"role": "tool", "content": "<tool output containing external data>"}]}'

    • New result field in Guard API breakdown responses exposes per-detector confidence levels (l1_confident through l5_unlikely), matching the granularity already available in /guard/results.
    • New self-harm sub-category added to the content moderator detector.
    • New product: AI Agent Security (Early Access) — discovers and inventories agents, their tools, and connected MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers across Amazon Bedrock, Amazon Bedrock AgentCore, Google Cloud, Microsoft Copilot Studio, Salesforce Agentforce, n8n, and Relevance AI.
    • AI Agent Security provides per-agent risk ratings (Critical / High / Medium / Low) with contributing factors, plus a risk-types view mapped to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. and MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling..
    • New Policy Impact Simulator on the dashboard shows how different sensitivity levels and guardrail configurations would have affected historical traffic, with flagging-rate comparisons across L1–L4 and category-level breakdowns.

    +8 more show less

    • Audio requests now expose an audio_payload flag in the Guard API request for access to debugging information of the audio sample.
    • Gateway now logs requests to v2/guard/audio for monitoring purposes.
    • TensorRT-LLMTensorRT-LLMNVIDIA's inference optimizer and runtime, which compiles a model into a version tuned for a specific GPU. TensorRT-LLM is its library for serving large language models. audio processing gains denoising support.
    • Added support for developer and tool roles in API messages to cover agentic and tool-using use cases.
    • Guardrails overview table gains filtering functionality and a new Policies column; guardrail detail pages now show creator, last edited by/at, and Policies assigned fields.
    • Logs page adds a Link button for shareable navigation with or without current filters.
    • Misclassification submissions now support bulk operations across multiple logs.
    • Policy advanced settings redesigned with dedicated sections for Content Moderation, Data Leakage Prevention, Prompt Defense, and Unknown Links.

    13 details in Everything