2026 Endpoint Protection Release Notes 🚀🚀¶

Boost Security Endpoint Protection release notes for 2026, newest release first.

2026-11-13¶

See the AI Tools on Your Developers' Endpoints

The new AI Tools page, under Endpoint Protection, lists the AI coding agents and chat apps found on developer endpoints, such as Claude Code, Codex, Cursor, ChatGPT Desktop and Claude Desktop. For each AI tool, it shows the LLM providers and models it uses, its MCP servers and skills, and the developers and devices it runs on. Search, filter and pivot the list by AI tool, provider or model, and open a developer to see every AI tool on their device.

Compromised eMudhra Certificate Authorities

Endpoint scans now flag the devices whose trust stores still trust the eMudhra certificate authorities, which are known to be compromised, under the new Weak eMudhra CA Keys Still Trusted alert category, with a Critical severity. Each alert gives the details of the affected trust store. Requires the endpoint CLI 1.6.5 or later.

Save or Discard Policy Changes

Changes on the policy page are now staged before they apply. The page header counts the unsaved changes. Save opens the Review Policy Changes dialog, which lists each change before you apply them all at once with Confirm And Save; Discard drops them. Nothing changes for your developer endpoints until you save.

Improvements and Fixes

More reliable user detection. Users are now detected from the owner of each home folder. This fixes Linux devices that reported no user or alias even when a git configuration was set. Endpoint CLI 1.6.6.
Faster scans. User and host details are read once per scan instead of once per collector. Endpoint CLI 1.6.4.
Browser extension names. Browser extensions show their display names again, instead of their internal IDs. Endpoint CLI 1.6.4.
npm tarball downloads. Through Package Management Protection, npm tarball requests that lost the /npm/ prefix are routed correctly again.

Per-Device Tokens and the Endpoint Devices Page

Each device now authenticates with its own unique device token, issued when the device registers, instead of a shared API key. The new Endpoint Devices page lists every device that has been enrolled; administrators can revoke a device's access, or delete a device to revoke its access and remove its data: the developers, components, and alerts collected from it.

Devices deployed before this release are migrated automatically: each one receives its own device token as it updates, with no action required.

Deployment Tokens

Script installation now authenticates with a deployment token created from the Installation page. A deployment token can only be used to register devices, is active for 30 days by default (the duration can be changed when creating the token), and is meant to be single use. Delete it once the fleet is deployed.

Endpoint Scanning

VS Code Extension Enhancements The Boost VS Code extension has been updated with expanded package coverage and improved developer experience.
- IDE deep links: secrets detected by Boost's Bagel scanner now link directly to the specific file and line in the developer's IDE, enabling faster secret remediation without context switching.
- Expanded package support: the extension now detects globally installed and project-defined npm and PyPI packages, as well as Homebrew components.
- Package paths: the extension surfaces where packages are defined within project files, distinguishing installed packages from those merely referenced in dependency manifests.
- npm cooldown alerts: developers are notified when newly introduced npm packages fall within the low-maturity cooldown window, flagging packages less than 7 days old.

Cross-View Navigation & Group By Component

The Endpoint Security page now includes cross-linking between views, enabling seamless navigation between the Developer view and the Alert view in both directions. A new Group By Component view is also available for aggregating endpoint findings by the detected component.
Developer Identity: Enhanced Contributor Attribution

Boost now uses an improved developer identity resolution process to accurately attribute findings to the correct contributor. The system checks git configurations, workstation user accounts, and logged-in email addresses, falling back to a unique workstation ID when no other identity is available.
- Multiple identities detected on a single machine are tracked as aliases under a unified developer record.

Grouped Slack Notifications

Endpoint malware alerts are now grouped by package when multiple developers trigger the same alert simultaneously, preventing notification fatigue from high volumes of duplicate messages for a single malware event across a large developer fleet.
Allow/Deny Rules for Specific Package Versions

The Boost allow/deny policy framework now supports targeting specific package versions or version ranges. Teams can define granular rules that permit or block exact versions of a component, providing finer-grained control over supply chain governance.

Endpoint Scanning

VSCode Extension & CLI Available

The Boost Endpoint Security Extension and CLI are now available for installation, supporting developer workstation scanning across macOS, Linux, and Windows.
- Authentication is supported via OAuth (using the Boost user identity) or API Token (user context inferred from local configuration).
- Script-based installation is the recommended deployment method for the CLI.
- Uninstalling the CLI removes the local agent and log files from the workstation while preserving historical scan data within Boost.

Extended Package Detection

Endpoint Security now detects npm and PyPI packages installed on developer workstations, expanding supply chain risk visibility beyond CI/CD pipelines.

Extended Malware Policy
- Malware policy framework: configure allow/deny lists for specific components. Policy changes trigger automatic re-evaluation of all scanned endpoints.
- Malware detections generate alerts and can trigger outbound notifications via Slack or Microsoft Teams.
- Custom components can be added to the deny list to proactively block packages not yet present in the environment.
  
  Note
  
  Deny list rules currently match on provider and package name only — package version filtering is not yet supported.

Endpoint Scanning

VS Code Extension

The Boost Endpoint Security extension for VS Code is now available. Developers can view supply chain inventory and monitor scans in real time as they execute, with detected components and findings surfaced directly inside the IDE.

Endpoint Bill of Materials (EBOM): Alerts Categories View

The EBOM interface has been updated with a new Alerts Categories tab that groups alerts by category for a clearer overview of risk distribution across detected components. Components are grouped by name, with version details accessible within each component's detail view.