Changelog

What changed in Rogue-Agent Defense, newest first. Every entry below is taken from this project's own build and release history — dates are the days the work shipped.

October 22, 2026

• Account self-service: signed-in settings page with change password (current password required, every session signed out), change email (signed single-use confirmation link to the new address, old address notified), and account deletion with password re-entry and typed confirmation.
• Self-service password reset: public forgot-password flow with signed, single-use, 1-hour reset links; only the SHA-256 of each token is stored, and a reset signs out every session.
• Interceptor design system: the graphite + hazard-red signage identity shipped across every page, with the live Shield Score built from real blocked-threat counts.

October 21, 2026

• New home: the fleet moved to its own hosting on getingeniousai.com domains. Rogue-Agent Defense now lives at rogue-defense.getingeniousai.com.

October 19, 2026

• AgentJacking: a new rule family for trusted tool-response poisoning — poisoned tool outputs that try to steer the agent are scored and gated like any other injection.

October 18, 2026

• Tool-Metadata Integrity rule family and the Agent Reach Map: a staff-built map of what each agent can reach, with a hash-chained delta audit rail.

October 15, 2026

• Detection consoles: INFEX (infection-exfiltration checks), Proxy-Hijack and ARTX consoles joined the dashboard, alongside the MCP server supply-chain campaign guard (rules MC-01 to MC-06).

October 14, 2026

• Shield Score and fleet protection: honeypot endpoints, IP blocking and an in-product audit log for security events.

October 13, 2026

• Self-replication containment work and a per-account login lockout (10 failed attempts in 15 minutes) on top of per-IP rate limits.

October 12, 2026

• Referral program (share a link, earn a free month of Pro per paying referral) and the free canary-token generator.

October 11, 2026

• Live Intercept: the homepage check was wired to the real Shield engine — the same scoring the API runs — with per-visitor rate limiting. Pasted text is scored on the spot and not stored.

Questions about a change? Email [email protected]. Service state lives on the status page.