Release #: 2026.10.2

Release Date: October 22nd, 2026

What's New

This release lets you share vulnerability data on AI Cards in place of vulnerability report PDFs, and rebuilds the Vulnerabilities tab in AI System details. It labels AI-based technologies and AI vulnerabilities, adds Bill of Materials feeds to the Public API, and fully rescans each BOM on its next scan. It also adds Cisco AI Defense to Arena Shield, tightens BOM JSON import, updates My Vendors permissions and AI Card reminders, refreshes page headers and tabs, and includes several bug fixes.

Share Vulnerability Data on AI Cards

You can now share vulnerability data on AI Cards instead of attaching vulnerability report PDFs, which can no longer be created. Turn on Share Vulnerability Data when you publish a card or respond to a request, since the switch is off by default. Cards published before this release can't share vulnerability data, so send a new card with the switch turned on. Vulnerability report PDFs already attached to published cards stay available to recipients. See Publishing an AI Card Without a Request, Responding to an AI Card Request and Supply Chain Overview for details.

Vulnerabilities Tab in AI System Details

The Vulnerability Assessment tab in AI System details is now Vulnerabilities, and it shows the model and technology vulnerabilities for every Bill of Materials in the AI System together. Generate Report and the per-BOM picker are removed from this tab, while the Bill of Materials details page keeps its own vulnerability card. See AI System Details Overview and Vulnerability Assessment Overview for details.

AI-Based Technologies and AI Vulnerabilities

Technologies in a BOM are now labelled as AI-based when they match Cranium's AI package list, and vulnerabilities on those technologies are labelled as AI vulnerabilities. New AI columns and Show AI vulnerabilities only filters appear in the BOM, vulnerability and AI System views, and existing BOMs are labelled as part of the release. Several exports gain an AI column at the end, and the Public API vulnerabilities endpoint returns a new isAi field, so update any integration that expects a fixed set of fields or columns. Because labelling doesn't change a vulnerability's updatedAt, run one full sync without cursor or updatedAfter after existing BOMs are labelled to get isAi on vulnerabilities you already have. See Bill of Materials Overview, Technology Search Overview and Endpoint Reference: Technology Vulnerabilities for details.

Bill of Materials Feeds in the Public API

The Public API adds read endpoints for the technologies, models, datasets, infrastructure and agentic systems in each Bill of Materials, so integrations can sync BOM contents without the Application UI. These feeds use the existing Api_BOM_Read permission, and new Arena All Models endpoints are available to tenants licensed for All Models. The existing Bills of Materials endpoints now also return the repository organization and project. If you plan to sync the technologies feed, start after existing BOMs have been labelled as AI-based, because items synced earlier don't receive the label later. See Public API Overview, Pagination & Incremental Sync and Endpoint Reference: Bills of Materials for details.

Full Rescan of Each Bill of Materials

This release updates the CodeSensor scanner, so the next scan of each code-scanned BOM re-reads the whole repository and can change the BOM's contents. That first scan takes longer than usual, especially for large repositories, and you can start it manually at any time even without new commits. The rescan reports fewer ordinary application tables as data and fewer duplicate models, and it improves discovery for Gradle, NuGet and system prompts. No action is required.

Stricter BOM JSON Import

BOM JSON import now checks each item's fields before saving and names the field to correct, where over-length fields and duplicate languages previously failed with a server error. An import with non-English characters in a language name is now rejected, so use plain names such as python and import again. Language names already stored as ??? are corrected only when you import the BOM again. See Bill of Materials JSON Import Format for the limits and rules.

My Vendors Requires Vendor Read Access

My Vendors now requires both AISystem_Publish_Received_Read and Vendor_Vendor_Read_Tenant, and every role that can read received AI Cards is granted the vendor permission as part of the release, so no existing user loses access. Add both permissions to any custom role you create after the release. To restrict vendor details, remove Vendor_Vendor_Read_Tenant from a role, which also removes its access to My Vendors. See My Vendors Overview for details.

AI Card Reminders Follow the Due Date

This applies to tenants with AI Card publish reminders turned on. [CONFIRM: Which tenants have AI Card reminders turned on, and does 2026.10.2 change that?] Publish reminders for an AI Card request with a Due Date are now timed from that date rather than from your tenant's standard deadline, and requests without a due date keep the previous schedule. No action is required. See Managing Outgoing AI Card Requests for the reminder schedule.

Cloud Assets for Cloud Sensor Tenants

Tenants licensed for Cloud Sensor have a new read-only Cloud Assets page under Artifacts that lists the AI models and resources discovered through Azure Cloud Sensor connections. The page requires the Artifacts_CloudAssets_Read permission, which the tenant Admin role has, so a tenant admin adds it to any other role that needs access.

Cisco AI Defense in Arena Shield

Shield remediation can now use Cisco AI Defense, a third-party hosted guardrail, for tenants with the Cisco Guardrails licence and their own Cisco AI Defense API key. Tenant administrators add keys on the new Guardrail Providers tab under Integrations. For all Shield users, choosing the same open-source guardrail for input and output now runs both guardrails, so results can differ from earlier runs. See Arena Shield Overview for details.

Page Header and Tab Styling

Page headers and main tabs now sit on a solid band that follows the light or dark theme, and tabs inside cards and dialogs use a smaller label. No features move.

Arena Display Improvements

The Findings Overview shows each model's type, and each successful attack in Vulnerability Details shows whether the test was fixed or adaptive. The Evidence chart and several panels now follow the light or dark theme. No action is required. See AI Arena Overview for details.

Bug Fixes

• Fixed an issue where responding to an AI Card request never flagged missing requested artifacts. The review step now shows a warning that doesn't block sending, so some responses that appeared complete are now flagged.
• Fixed an issue where CodeSensor rescans failed for GitHub repositories that had been renamed or moved, so rescan affected Bills of Materials once. Scans no longer follow a redirect to a different host or to plain HTTP, so a self-hosted VCS server behind a proxy that redirects this way may now fail to scan.
• Fixed an issue where editing or deleting one item in the BOM wizard could change or delete every item on the same tab. Existing Bills of Materials are corrected the next time they are saved.
• Fixed an issue where the Public API reported zero item counts for every Bill of Materials.
• Fixed an issue where CodeSensor scans failed on entries without a name or on certain encoded characters in Python files. Affected BOMs are fully updated on their next scan.
• Fixed an issue where Vulnerability Assessment status showed "Unknown" for BOMs last assessed before release 2026.7.1.
• Fixed an issue where CycloneDX and SPDX exports failed for BOMs without a repository.
• Fixed an issue where Integrations > CloudSensor offered Add, Edit and Delete to users who lacked the permission. See CloudSensor Overview for the permissions each action needs.