What's new
The current version is 2.5.101. AgentWarden updates itself; detection rules update separately, every day, without a new version.
Version 2.5.101 Latest
19 October 2026 · Mac and Windows
Fewer false alarms: checking a startup item on another of your Macs over ssh, without changing it, is no longer reported as writing a startup item. Changing one over ssh is still caught.
Version 2.5.100
19 October 2026 · Mac and Windows
Fewer false alarms: when a Claude Code chat hands work to its own helper agents through a file, AgentWarden no longer reports it as agents passing secret messages. Separate agents talking through a file are still caught.
Version 2.5.99
18 October 2026 · Mac and Windows
Fewer false alarms: checking backups, iCloud or a startup item's settings while looking at the programs that start at login is no longer reported as writing a startup item. Includes detection rules v35, which also catch an AI tool's saved login being read on Windows when its file name is written with a dot at the end.
Version 2.5.98
17 October 2026 · Mac and Windows
AgentWarden now shows ZCode and JetBrains Junie in their own colours on the main page. Fewer false alarms: checking which programs start at login is no longer reported as writing a startup item when the check tidies its output or runs over several lines. Includes detection rules v34.
Version 2.5.97
15 October 2026 · Mac and Windows
Links to fake "Ads for Claude", "Ads for Gemini" and "Perplexity beta" pages, which ask you to sign in with Google and steal the code, are now named in Check anything and the browser extension. Fewer false alarms: a folder called NC in a file path is no longer reported as opening a reverse shell. Includes detection rules v32.
Version 2.5.96
14 October 2026 · Mac and Windows
Check an AI model before you download it. Paste a Hugging Face or Ollama link into Check before installing and AgentWarden reads only the small parts it needs, never the whole model, to warn you about hidden code or hidden instructions. You can also choose a model file or a downloaded model folder to check it before you open it. If a model cannot be read from its link, for example because it needs a sign-in, AgentWarden says so instead of calling it safe.
Version 2.5.95
14 October 2026 · Mac and Windows
AgentWarden now checks the AI models you download for Ollama, LM Studio, Hugging Face, GPT4All and Jan. It warns you about a model file that would run hidden code the moment an app opens it, and about a chat template that runs code or slips hidden instructions to the AI. It only reads the files and never runs them. Part of the Pro check of skills and MCP servers. Alerts now also write "MCP server" and "AI model" the usual way.
Version 2.5.94
14 October 2026 · Mac and Windows
Fewer false alarms. Reading your startup items with a quoted sed line range, or an awk filter that matches names, is no longer reported as installing one. An app such as LINE adding its own startup entry is no longer blamed on an AI agent just because the agent wrote a word like "deadline".
Version 2.5.93
13 October 2026 · Mac and Windows
Fewer false alarms: checking which background items exist, with a command that tidies its output, is no longer reported as adding a startup item. Includes detection rules v30, which catch an AI agent asking the cloud computer it runs on for that computer's access keys.
Version 2.5.92
12 October 2026 · Mac and Windows
Check anything now helps when a subscription charge surprises you: it says where to cancel and how to ask for a refund, and never to cancel through a link or a phone number in a message. Texts that give you a one-time code and warn you not to share it are no longer called a scam, while someone asking you for a code still is. Scam messages in Greek are recognised too, including fake receipts with a number to call, parcel fees and locked accounts, and links that imitate Bank of Cyprus, Hellenic Bank or Cyprus Post.
Version 2.5.91
11 October 2026 · Mac and Windows
Fewer false alarms on the Mac: when an AI agent only looks at your background jobs, for example checking which ones start at login or how often they run, AgentWarden no longer warns that it installed a startup item. Adding or changing one is still caught, including a change hidden inside a check. Windows gets the same engine update.
Version 2.5.90
5 October 2026 · Mac and Windows
Fixed on Windows: since 2.5.73 the AgentWarden window could open completely black. Protection kept running behind it the whole time; only the window failed to draw. It opens normally again, and every build is now checked by loading the window the way Windows does, so a build like that is stopped before it ships. Nothing changes on the Mac.
Version 2.5.89
3 October 2026 · Mac and Windows
Now recognised: NVIDIA OpenShell. If you run AI agents inside it, AgentWarden lists it with your AI tools and says plainly that those agents run in a sandbox of its own, which AgentWarden can't see into. One false alarm fixed: when an AI agent sets up a scheduled task you asked for, another app's own startup item added at the same moment is no longer put down to the agent.
Version 2.5.88
1 October 2026 · Mac and Windows
Fewer false alarms, and more caught. Checking why your computer is slow, reading a startup item's settings, printing lines of a file, or working out a date from a timestamp is no longer called writing a startup item. Writing an SVG image is no longer called visiting w3.org. With detection rules v24, AgentWarden also catches an AI agent that downloads a PowerShell script and runs it in one step, and one that makes a new public GitHub repository you did not ask for. The same on Mac and Windows.
Version 2.5.87
29 September 2026 · Mac and Windows
AgentWarden is much lighter on your computer. It keeps checking which programs are running, what starts automatically and which connections are open, and on Windows those checks asked the system for everything, every time, which could keep a noticeable part of a processor core busy. Now it only asks about what has actually changed, so it uses a fraction of what it did while seeing exactly the same things. Checks also pace themselves when your computer is very busy, the Skills and MCP scan only looks again at what changed instead of repeating itself for minutes, and Stop AI and any new alert still get an immediate, fresh check. With nothing needing you it now sits at around 1% of a processor: the menu bar icon only redraws when your protection status changes, a window you cannot see draws nothing, and agent logs that have not changed are not read again. Stop AI is also more careful: it can no longer mistake a long-running program, such as a game launcher, for something an AI agent started. The same on Mac and Windows.
Version 2.5.84
26 September 2026 · Mac and Windows
AgentWarden uses far less of your computer while it watches. An animation on the Live page kept the whole window redrawing all the time, even when it was hidden, which could take a full processor core and slow down your screen. The Live indicator now updates quietly every couple of seconds instead, on both Mac and Windows, and a new check on both makes sure nothing like it comes back.
Version 2.5.83
25 September 2026 · Mac and Windows
AgentWarden now checks every command in full even when your computer is very busy: a heavily loaded machine can no longer make a check stop early. Commands Codex types into a shell it has already started are now checked like any other command. Fewer false alarms: listing Cloudflare tunnels, the invisible direction marks webmail puts around phone numbers, and asking for something to open at login are no longer flagged. Tested the same way on Mac and Windows.
Version 2.5.82
25 September 2026 · Mac and Windows
AgentWarden now checks every command in full even when your computer is very busy. Before, a heavily loaded machine could make a check stop early and miss something; now only a check that is genuinely stuck is cut short. Tested on Mac and Windows with the same 2,846 checks.
Version 2.5.81
25 September 2026 · Mac and Windows
The Health tab no longer freezes the first time you open it when your Documents folder is kept in iCloud or OneDrive. SSH keys are recognised however Windows writes the path. Resume AI now puts your agents' settings files back exactly as they were. Tested against 500 customers in every country we sell to, and Stop AI proven on real processes on Mac and Windows.
Version 2.5.80
25 September 2026 · Mac and Windows
The Health tab no longer freezes the first time you open it when your Documents folder is kept in iCloud or OneDrive. SSH keys are recognised however Windows writes the path. Resume AI now puts your agents' settings files back exactly as they were. Tested against 500 customers in every country we sell to, and Stop AI proven on real processes on Mac and Windows.
Version 2.5.79
25 September 2026 · Mac and Windows
A report or file that Codex writes is no longer mistaken for a command it ran, so it can no longer turn the Live page red. After All of these were me, AgentWarden now says when a proven attack is still open and how to close it.
Version 2.5.78
24 September 2026 · Mac and Windows
Skills & MCP: if several items are yours, trust them in one go. Each one is trusted on its own, with the content it was trusted at, so a file that changes comes back on its own and nothing is trusted just for being in the same folder. (Released with the gates run on this Mac: GitHub Actions would not start, because the account's billing needs attention.)
Version 2.5.77
24 September 2026 · Mac and Windows
Skills & MCP: if an item is something you wrote yourself, say so. The score stays exactly as it is, and stops being counted against you until the file changes. Each row now says what the item is called and where it lives, with the strongest finding on the row, so you can tell nine files apart without opening any of them.
Version 2.5.76
24 September 2026 · Mac and Windows
AgentWarden is now readable and usable without sight. Small text that was too faint to read is fixed on both the Mac and Windows, every screen says its name, and you can see where you are when moving by keyboard. Icons that only repeat the words beside them are no longer read out, and the ones that carry meaning of their own, like the menu bar icon, now say what they mean.
Version 2.5.75
24 September 2026 · Mac and Windows
Check anything now warns when a message gives you a code to type into a Microsoft, Google or GitHub sign-in page. Typing it would sign the sender in to your account, a trick used against thousands of people this month. If you use Codex's goal mode, AgentWarden now reads the goal you set, so ordinary work towards it is no longer called unexpected. On Windows, what AgentWarden has learned is no longer lost when another program briefly has its file open.
Version 2.5.74
24 September 2026 · Mac and Windows
An automatic update no longer interrupts you. AgentWarden puts its window back exactly where you had it: in the Dock if that is where it was, behind your work if it was open there, and in front only if you were looking at AgentWarden itself. It never comes up over what you are typing.
Version 2.5.73
23 September 2026 · Mac and Windows
AgentWarden can now be used without sight: VoiceOver and Narrator read each AI as one sentence, the Live strip is announced as it changes, and every icon is either hidden as decoration or named. AgentWarden also checks that what is on disk is exactly what we packaged.
Version 2.5.72
23 September 2026 · Mac and Windows
Signing in opens AgentWarden minimized; the tray icon opens it; open AI apps are named; ChatGPT, Perplexity, Copilot, Comet and Dia recognised.
Version 2.5.71
23 September 2026 · Mac and Windows
Open AI apps are named, not counted as processes; only running AI gets a tile, in its own colour; ChatGPT, Perplexity, Copilot, Comet and Dia are recognised; on Windows the tray icon opens AgentWarden and signing in opens it minimized.
Version 2.5.70
22 September 2026 · Mac and Windows
Open AI apps are named, not counted as processes; only running AI gets a tile, in its own colour; ChatGPT, Perplexity, Copilot, Comet and Dia are recognised; on Windows the tray icon opens AgentWarden and signing in opens it minimized.
Version 2.5.69
21 September 2026 · Mac and Windows
Codex threads you resume days or weeks later are watched again, and the Live page shows them as working.
Version 2.5.68
20 September 2026 · Mac and Windows
Text too small to read, carrying an instruction for an AI, is treated as hidden text; signed rules v17 ship inside both installers.
Version 2.5.67
20 September 2026 · Mac and Windows
Curly apostrophes and dashes are read like plain ones, so an instruction telling an AI to hide what it is doing is caught however it is typed.
Version 2.5.66
20 September 2026 · Mac and Windows
Check anything now also catches a link that says one address and opens another, and the fake support line that asks you to call a number about your account. Right-click a file in Finder to check it, if you turn that on in Settings. The browser extension can take hidden text out of a page when you ask it to.
Version 2.5.65
20 September 2026 · Mac and Windows
AgentWarden no longer treats its own source folders as someone else's project, so the people who build it stop seeing their own files reported. Nothing changes for anyone else: an installed copy has no source folder to recognise. Plus a fix to the internal test tooling.
Version 2.5.64
20 September 2026 · Mac and Windows
Releases can no longer collide when more than one session is working: the version number is worked out from what is already live instead of chosen by hand, only one release can run at a time, and anything not newer than the live version is refused before it can be published.
Version 2.5.63
20 September 2026 · Mac and Windows
Catches a repository that runs a command of its own on every git command. Opening someone else's repository can run code before you type anything; AgentWarden now reads the repository's own git settings when an agent opens it, and tells you plainly what to remove. It also tells you when the AI agent you are running is a version this can happen to. New decoys imitate an export of your signed-in browser sessions, for attacks that go after sessions rather than passwords.
Version 2.5.62
20 September 2026 · Mac and Windows
The Mac now names an intrusion the way Windows does. Reaching for a planted decoy secret counts as a step of an attack on both, so an invoice that steers your assistant to a fake password file and then uploads it is reported as one intrusion rather than three separate curiosities.
Version 2.5.61
20 September 2026 · Mac and Windows
On Windows, agentwarden --verify-install now actually verifies. Until this release it could report success having checked nothing when AgentWarden was running, or open a window instead of answering, because the launcher only recognised its own commands and passed everything else to the window. Console commands now run the real check and return its result, an unknown command is refused rather than quietly accepted, and the list of commands is pinned by a test on both platforms. Found and fixed through the assurance process with Codex.
Version 2.5.60
20 September 2026 · Mac and Windows
Check anything, on your computer. Paste a message, an email or a page into AgentWarden, drop a file on it, or right-click a file on Windows, and it answers in plain words: is something hidden in here for an AI, does this read like a scam, is a link pretending to be somewhere else. It is the same check the iPhone app makes, now on the Mac and the PC, free, and read only: nothing is stored or sent. A browser extension for Chrome and Edge is included in this release for you to install, warning you when a page hides instructions meant for AI.
Version 2.5.59
20 September 2026 · Mac and Windows
Protection for everyone, not only developers. AgentWarden now catches the everyday form of an AI attack: instructions hidden from you but written for an AI, in white or invisible text, a zero-sized font or a hidden element, inside an invoice, a newsletter or a web page. Files that arrive from outside, in Downloads or as mail attachments, are treated as outside content. New decoys imitate everyday documents, so an AI hunting through your files is caught the same way a hijacked coding agent is. The main page now fits what is on your computer, and says plainly what AgentWarden does and does not do when no AI is installed. Plus yesterday's false-alarm fixes.
Version 2.5.57
19 September 2026 · Mac and Windows
Checks that AgentWarden itself is complete: each release now records exactly what it contains, signed by PRAESI, and agentwarden --verify-install confirms your installed copy matches it. Skills that describe an attack in plain words (find your keys, send them away, stay running) are now flagged. The Windows command line no longer prints a warning when it checks the detection rules.