Changelog

8 November 2026

• One verdict. A score reads as the same word everywhere, on a phone, a computer, in the scan history and in reports: Dangerous, Suspicious, Low risk, No threats found. Before, one harmless app read “low risk”, “suspicious” and “Medium Risk” on one screen. Suspicious starts at 40 and low risk at 25, set from the measurement.
• Why this verdict. A result opens with one sentence on what the verdict rests on, and the reasons, in your language. The 80 most common finding names are translated; a detection’s own name stays as its engine gave it.
• Android apps. An app is judged by the shape of a job, not by its permissions. What it may do is listed under What the app can do and earns nothing. A hidden app that starts at boot, an app that sends messages to a Telegram bot, a banking trojan’s permissions on a hidden app read suspicious. Of 406 clean apps from F-Droid, none reads suspicious or dangerous; 7 automation and device-lock tools read low risk. Expo Go read 45 with Camera Access filed as malicious; it now reads 11, no threats found.
• Indicators. A scan keeps as indicators only addresses with a real host. Licences and library documentation stay with the file. A finding is as serious as the engine that found it says.
• Hash databases. MalwareBazaar and ThreatFox need the administrator’s free abuse.ch key. Without it they are not asked and read “needs a key”; an HTTP status is never shown.
• Measured again. Counting each campaign once, 89% and 83% of two MalwareBazaar days are flagged (85% and 77% before), with the same share named. Clean files flagged: 0.34% of 5,252 files, 0.07% of 6,000 JavaScript, 0.22% of 6,000 Python, 0.14% of 700 JAR, none of 406 Android apps.
• Network captures. A capture’s packets are now read for what malware does: domains that do not exist (DGA), repeated check-ins to one web server, connections refused again and again, many peers on odd ports and generated host names. Broadcast and multicast are no longer called callbacks. On 14 ordinary recordings none is flagged (2 were); of 28 botnet recordings 21 are (12 were). The result says why in your language, on the phone and on the computer, which before showed only HARD or SAFE. Only the deployment’s owner can change the capture detectors’ settings, which any organisation’s admin could before.
• Sign up. Creating an account asks you to tick that you accept the Terms of Service and the Privacy Policy; the account keeps which version you accepted and when. The legal documents are at version 1.2: they say what is kept when you accept, scan or upload.
• Deleting a scan. Deleting a scan now deletes the scanned file and its reports. Before, the file stayed on the server after its scan was gone.

7 November 2026

• File scanner. Nineteen engines now read a file, with 3.6 million ClamAV signatures and 1,240 ReversingLabs YARA rules, and the result lists what each one said. One that could not check a file says so, and is never counted as clean. Ordinary files are called dangerous far less often: on about 5,400 clean files from one machine, false alarms fell from 8.25% to under 1%. See File scanner.
• Hidden payloads. A new engine finds programs and scripts hidden in text (base64, also reversed or split over lines, hex, byte arrays, gzip inside them) and analyses what they decode to. In one day’s MalwareBazaar batch, 285 of 798 samples were a single campaign of this kind that no signature knew.
• More rules. 2,926 YARA Forge rules from sources whose licence allows it, each match naming its author. None of them flagged a clean file in the measurement.
• Similar samples. Fingerprints of known malware find rebuilt copies that no signature names. Fingerprints from the two weeks before a batch found 414 of its 1,417 samples, 100 of them caught by nothing else, and none of about 17,000 clean files.
• Java, installers, shortcuts. JAR files are read class by class, Windows Installer packages file by file with what they run, and a Windows shortcut for the command inside it.
• Android apps. The signature is now checked as Android checks it, so a changed file or a copied certificate shows. Keys of eleven popular apps are built in: their real builds read as low risk, and a copy under the same name with another key as repackaged. Permissions alone no longer make an app suspicious.
• Scripts. Scripts saved as UTF-16 are read as text, and script droppers are named by what they do. Ordinary JavaScript and Python libraries are no longer called dangerous for what they can do.
• Disguised programs. A Linux or macOS program holding a Linux kernel thread’s name, to pass for one in a process list, reads as disguised.
• Capabilities. On a server with four cores and 8 GB to spare, Mandiant’s capa says what a program can do, mostly tied to ATT&CK. It makes a program suspicious at most.
• Measured on real malware. 1,431 samples from two MalwareBazaar days, read in an isolated namespace and never run: counting each campaign once, 77–85% are flagged and 52–74% called dangerous. False alarms: 0.02% of 6,000 JavaScript files, 0.18% of 6,000 Python files, 0.14% of 700 Java archives, 0.30% of about 5,250 other files, some of which are attack tools. The scanner never runs a file, so what nothing has named can still pass.
• Verdicts. Malicious now needs something to name the file. What a program can do makes it suspicious at most. Riskware, sensitive data and files that could only be partly checked each say so.
• Archives. The files inside ZIP, TAR, GZIP, BZIP2 and XZ are analysed one by one, and an archive takes the verdict of what it holds.
• Android apps. Rebuilt and re-signed apps read as riskware, and the key of a publisher’s own build can be recorded.
• Sizing. The platform measures its server and works out its limits from it: how many files it analyses at once, how much memory each gets, how much of an archive it opens. A bigger server gets more, with nothing to set.
• Updates. ClamAV signatures can reach an air-gapped server in a signed update bundle.

6 November 2026

• Architecture Center. How Legit AI is built, drawn: the platform on one server, a map of its twelve parts, the detection loop, the data plane, deployment and security. See Architecture Center.
• Phone. The console on a phone is now its own small app: home, alerts, scanning of files, PCAP captures, links and addresses, the AI analyst, and a way to isolate a host or block an address from an alert. Approvals sit beside the bell. Pages built for a large screen say so and stay on a computer.
• Large files. Files and captures now travel in parts and are analysed in a process of their own, on a phone and on a computer. A dropped connection resumes, a long analysis no longer ends the request, and a capture is read from disk: a 500 MB one uses about 220 MB of memory. See On a phone.
• Windows agent. Version 1.1.6 carries out only commands signed for your organisation, and refuses anything unsigned, expired or repeated. Agents do not update themselves, so it is installed by hand.
• Accounts. A changed role or a suspension reaches open sessions at once, live connections and terminals included. A password changes only with the current one, and the change ends your other sessions. Signing in with an SSH key asks for the second factor, and adding a key asks for the password. See Accounts and sign-in.
• API keys. A key stops working when the person who made it is suspended or removed, and the list shows who made each key.
• Support. A support session is read-only on every route and ends with its token; refreshing it is refused.
• Playbooks. Each step is written down before it is sent, so an action is never sent twice, and a crash after sending shows as an unknown result. A playbook does not run twice on one alert within 60 seconds.
• Privacy. Erasing an organisation also deletes its stored files: uploads, scan reports, packet captures and terminal recordings.
• Docs. New pages: Accounts and sign-in, Plans and limits, Network map and scan, Ransomware and traps, Compliance evidence, Desktop app and Facts and evidence.

2 November 2026

• Detection. Correlation counts from stored events, by the time they happened, on every way in. A scan followed by an exploit, and data staged and then sent out, now raise findings; they never had.

1 November 2026

• Network. Scan a network from a server you monitor, and read a router from inside with its owner’s login. The password never reaches the monitored server.
• Accounts. Staff help someone back in with a one-time link and never see a password. Passwords are stored with Argon2id. A support session asks for the staff member’s second factor.

31 October 2026

• Response. The secure terminal opens a shell on a server beside the alert: a two-minute certificate, the whole screen recorded, destructive lines held. Each organisation chooses solo or four eyes.
• Servers. The monitoring key lives in a vault, shown by its fingerprint only.

25 October 2026

• Desktop app. Two editions: one opens your account in the cloud, one connects only to your own server and needs no internet.

22 October 2026

• Windows agent. Version 1.1.5 limits its queue by what is still unsent, not by file size. Nothing is lost when the connection drops, and the console shows Not delivering with the time of the last delivery.

18 October 2026

• On your own server. Legit AI installs the whole platform, the AI model included, remotely or on site: the server is checked first, every secret and a certificate are generated, the AI model is chosen for the server’s memory and GPU, and the whole platform is backed up every night. What arrives is the running platform, with no source code. See On your own server and Looking after the platform.
• Syslog. Firewalls, switches and servers send syslog straight to the platform on port 514, over UDP or TCP. Data sources shows what arrived and what was refused, and why.
• Console. Data sources guides each way in — Windows, Linux, devices, rsyslog, Fluent Bit, Vector, your own application — with your platform’s address filled in, makes the API key a source needs, and sends a test event.
• Ingest. An event on its own no longer opens an alert: one sent without a severity is low, and alerts come from the detection rules and layers. The answer’s event_id is the stored event’s id. POST /api/ingest/records takes what log shippers send.
• Windows agent. An offline package — agent, installer, Sysmon settings and the command — downloads as one zip, and Group Policy and Intune roll the agent out to many machines.
• SSH servers. Add several servers adds a whole list at once.
• Docs. Choose your path and Requirements say what each way of running Legit AI needs.

17 October 2026

• Ingest. Syslog severity is read on syslog’s own scale: an Emergency line is critical and a Debug line is info. Until now the scale was read upside down, so chatty devices logging at informational level filed high-severity events.
• Ingest. A JSON event sent with "severity": "high" or "low" keeps that severity; both used to be stored as medium.
• Ingest. A CEF event is named by its Name field, not its signature ID; the signature ID is kept as signature_id.
• File scanner. Files are typed by their bytes, not their names — more than 40 formats. A program named data.json, a macro document renamed report.bin and an Android app renamed app.zip are caught as disguised.
• Alerts. Risk scores above 85 keep their order instead of piling up at 100, and an alert shows the same risk score wherever it is read.
• Alerts. Alert lists can leave out detail they do not show (include_detail=false), which halves their size.
• Findings API. GET /api/findings/noisy-rules answers; it was unreachable. A verdict given through POST /api/findings/{id}/triage is counted once against its rule, not twice.
• Console. Finding summaries, the plan page, canary alerts and attack paths read in the console’s language. Sign-in fits a phone.
• Playbooks. A step that waits for approval is approved by someone other than the person who started the run, who may withdraw it instead. A step can be rejected; it never runs.
• Console. The approvals panel, now Pending approvals, lists waiting playbook steps beside response actions and agent commands. It reads in the console’s language, says why you cannot approve an item, and fits a phone.
• API keys. A key keeps the name it was created with, and the list shows it.
• Air-gap. Enrolling a Windows endpoint from the console works on an air-gapped server: the platform itself serves the installer, the Sysmon configuration and the agent.

16 October 2026

• Detection. An event with no host name is still correlated, and no kill chain is built on a host nobody named.
• Security. Production refuses a short or leaked API key or JWT secret. The API map is not public in production. In the air-gap deployment the backend listens on loopback only.
• Security. Five actions a VIEWER could take are now refused. Clearing or reading notifications changes them for you, not for the whole tenant. A rejected request no longer repeats the secrets it carried. Readiness detail is for administrators.
• Air-gap. The new-version notice comes from your own server; an air-gapped deployment never calls out for it. The platform is built on current, patched bases.

15 October 2026

• Air-gap. An air-gapped installation was carried out end to end; eleven defects found on the way were fixed. ClamAV runs in the air-gapped deployment.
• Offline updates. Signed bundles are staged, checked and applied from Settings → Offline updates.
• Ransomware. Canary files are watched, and the page says what it watches.
• Dashboard. A request that failed is shown as a failure, and a count that did not arrive as unknown — never as all clear.

14 October 2026

• Privacy. Nothing leaves the network without the administrator’s permission: lookups the platform would start on its own run only when they are switched on, and never in air-gap mode.
• Offline updates. An update applies only what its signed manifest lists, the signature can never be skipped, and an applied update is what the detection engine runs.
• Alerts. A signal that keeps repeating is one alert, and closed alerts stop counting.

11 October 2026

• Playbooks. A test run on an alert shows what each step would do. Approving a queued step carries the run on from it. Blocking an address waits for a second person.
• Attack path. Stages are joined only by what they share — a host, a user, an address, a hash — and each link says what.