What changed in each release

The sub-agent that fits each question answers with its own model, knowledge, tools, and permissions, and the supervisor combines the results into a single answer. Add and edit sub-agents in the structure view and check per-sub-agent calls, tokens, and latency; admins can control whether the feature is available.

See agent runs and resource call records at a glance on the operations overview screen. Manage budgets, regression evaluation results, and run details.

Choose Azure OpenAI's built-in web search as your search engine.

Finds malicious instructions (prompt injection, jailbreaks) hidden in user input, documents, web search results, and tool responses. A suspect source is quarantined on its own, later write-tool runs are held back, and external addresses that never appeared in the conversation are not opened automatically. Turn it on in the guardrail editor and try it right away.

Apply and check 16 key security settings aligned with the OWASP* Top 10 for LLM and agentic applications (2026) to run agents reliably.

* OWASP (Open Worldwide Application Security Project) is a nonprofit foundation for software security, best known for its "Top 10" lists of the most common and critical security risks. This update follows the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications, both 2026 editions.

Favorite the agents you use often and sort by most recently used to pick them quickly.

Improved how charts and tables appear in answers, and chart images sent through scheduled notifications now look the same as on screen.

Improved the web search card and final answer display, domain filter editing, and the notice for sources blocked by guardrails.

Strengthened protection on the paths that display shared content such as artifacts and embeds. External images in answers load only when clicked, and artifact and HTML previews send no requests outside.

Tools that change data, such as sending mail, modifying a database, or running code, run only after the user allows them on an approval card. In scheduled runs, API calls, and Teams calls, where there is no approval screen, the agent answers without write tools.

Private knowledge bases and databases connected to a shared agent, the sources a knowledge graph queries, and files attached to the conversation are checked again at run time against the user's permissions. Users with read-only access do not see the agent's system prompt.

10 concurrent runs per user, a 15-minute limit on flow AI steps, size limits on every upload path, and checks on tool server addresses now apply by default. When an error occurs, a reference number is shown instead of the raw internal error, and guardrail logs mask personal information when stored.

Applied a new design along with the brand logo and name.

Turn a workspace agent into a supervisor and it sends each question to the sub-agent whose domain fits, then combines the results into a single answer. Each sub-agent answers with its own model, knowledge, tools, and permissions, and you can check each sub-agent's progress in the reasoning panel and traces.

Add and edit sub-agents from the structure view in the agent editor, and check calls, tokens, and latency per sub-agent. When an admin turns the feature off, supervisors run as normal agents, and sub-agents the user can't access or that are over their usage limit are left out of the run.

Admins set a default reasoning effort and the allowed levels for each model; agents and the chat input then pick an effort within that range.

Install on AWS and connect Amazon Bedrock LLM and embedding models (including models in other AWS accounts) and OpenSearch search. Each Bedrock connection calls its models by a name with a unique prefix, so the same model on different connections never gets mixed up.

Resident registration, alien registration, phone, bank account, passport, and driver's license numbers are detected with no extra setup and masked in the formats used in Korea (e.g. 010-****-6666)​.

Memories agents extract from conversations are now stored in the configured search engine. Memories from earlier versions are left out of related-memory lookup until they are re-indexed, and no new memories are extracted where no search engine is configured.

Removed unused components from the install package and applied security patches.

Fixed server responses being delayed for a long time when a database connection dropped without notice. Dropped connections are now detected and cleaned up within 30 seconds.

For each MCP connection, decide whether the tool definitions the server provides are exposed as-is, or routed through a selector. When tools are exposed as-is, choice lists, nested arguments, and optional arguments pass through unchanged. A write tool never runs without approval just because the server marks it "read-only", and the configuration approved at confirmation is locked for that run.

When an agent runs on a GPT-6 family model, reasoning is kept across tool calls, and the reasoning summary and tokens are shown in chat and in traces.

Previously, question–SQL examples (few-shot) were saved automatically without verification, so bad examples could pollute the memory. Now only SQL confirmed to support the answer is saved, and a check that used to misread natural-language dates has been fixed.

Members can check the change history of the Knowledge Base, agents, databases, guardrails, the glossary, and skills directly from "Activity history" on each screen. Covers files added, deleted, or moved; renames; sharing-scope and public/private changes; agent configuration changes (model, connected resources, tools, guardrails, automatic quality evaluation)​; security-policy and term changes; and skill file changes, all shown as before/after comparisons. Skill files can also be rolled back to an earlier version.

Previously there was no way to tell which database was queried. Now the SQL execution card and the answer show which database was chosen, why, and what was queried, and the database list carries a type badge.

Previously, some rules declared on an agent could be dropped during the retrieval step. Now every declared rule is applied without exception.

Previously, turning on output guardrails could break streaming, and a single banned word could stop the entire session. Now streaming stays intact, only the new question and this turn's tool results are checked, and a blocked call shows the reason and request ID.

Fixed an issue where read-only access alone could modify another user's library, one where a scheduled task with empty access settings was visible to everyone, and one where two admins editing the same user could overwrite each other's group changes. Only the owner can stop a response, and session expiry is now distinguished from authorization errors, removing unnecessary logouts.

Previously, in multi-server environments, a stop request didn't propagate, so answers kept generating or a loading indicator lingered after cancellation, and a brief network drop produced an immediate error. Now a stop takes effect immediately, and a brief disconnect waits for reconnection and continues automatically.

Organize the Knowledge Base as a folder tree, and set an agent's search scope and a "when to search this folder" description per folder. Supports full filename search, and processing progress is shown in the notification center and stays visible even when you switch pages.

Register a bundle of scripts as a skill and connect it to an agent. The skill editor supports AI-generated drafts, and the marketplace offers document-generation skills (PPT, Word, Excel, HTML)​.

Create and edit documents, sheets, and slides in Drive (table of contents, tables, images, charts, with existing formatting preserved)​. Actions are approved through a confirmation card before running, and when finished, a read-only completion card with recipients, subject, link, and body stays in the conversation. Shared calendars and other users' calendars can also be looked up.

Usage can be viewed as time series, treemaps, a day-of-week × hour heatmap, and a ranking table. Register a per-model price (input, output, cache) to estimate cost and choose your display currency, with prompt-cache savings shown in the time series.

Previously, a flow had to be saved and deployed before you could see results, and there was no run history. Now Test Run executes a draft immediately, and you can check per-node progress in the run history. Nodes are reorganized into Agent (agent, model, supervisor)​, Logic & data (condition, router, merge, transform, loop, subflow)​, and Control & safety (approval gate, guardrail)​.

Previously, an agent could skip the final step and still report completion. Now it plans the steps first, refuses to report completion while a step is missing, and opens generated files to confirm them before answering.

MariaDB can now be selected directly as a connection type.

Search and compose mail, events, and Drive files in natural language from chat. Sending mail and generating documents are reviewed and edited in a confirmation card before approval. Features without connection permission stay hidden, every send is audit-logged, and admins turn the integration on or off.

Infers table relationships from foreign keys and column-naming conventions to build a join graph, with an ERD panel showing fact, dimension, and bridge table roles and relationships. Improves accuracy on questions that span multiple tables.

Every prompt save keeps a version. Compare versions and restore an earlier one; you can also check who made changes and how the answer format changed.

Register several answer formats and the agent answers using whichever fits the question.

Edits an attached Excel file cell by cell, row by row, column by column, or sheet by sheet, keeping formulas and formatting, and returns it as a new file.

Claude models can be used through a Vertex AI connection. Prompt caching cuts the cost and response time of repeated calls.

Previously, an answer was written from only a partial view of the last SQL result, sometimes describing filters or aggregation incorrectly. Now every SQL statement executed and its results are passed to the answer step, and the reasoning process is shown live. Few-shot SQL examples are separated per database.

Attachments are now reliably recognized on every turn, with uploaded files and Knowledge Base sources cited separately. Scheduled-task agents can also use web search and Google Workspace lookups, with sources attached to the results.

Added automatic retries and a recovery queue so processing doesn't stall even with large or numerous files uploaded at once, and email files (.msg/.eml) are now registered without leaking attachments.

Write and run SQL directly on the data analysis screen and save it as a file. Write queries like INSERT, UPDATE, and DELETE require a preview and approval before they take effect, and every execution, approval, and rejection is audit-logged.

When information is missing or a request is ambiguous, the agent asks a clarifying question with a set of options. Data-changing SQL and write-type external tool calls are confirmed with an approval card right before they run, and each database sets whether writes are allowed. OpenAPI and MCP tools are automatically classified as read or write.

Ask in chat and it generates PPT, Word, and Excel files. Once an admin registers a master template, documents are generated in your exact internal format.

Assign an extraction engine per extension. Within the same Knowledge Base, PDFs can go through Document Intelligence while Excel uses the built-in extractor. An extension with no engine assigned is rejected at upload, so it's never handed off to a different engine without warning.

Preview and register Excel, CSV, and Markdown files in one go; AI converts different formats into glossary entries.

Set a daily token limit per model, with exceptions by user, group, or organization. Over the limit, chat stops with a notice and resets at midnight. The model screen shows which agents, flows, and evaluations use that model.

One admin screen checks whether LLM connections, embeddings, extraction engines, search, web search, code execution, Code Gateway, notifications, voice, images, encryption, and licensing are configured, and what each one affects.

Connect to Vertex AI and BigQuery with Google Cloud default credentials, no service-account key file required. Tokens refresh automatically.

A connection-test button now confirms the table list immediately. BigQuery connects without a key file, and Oracle supports read-only accounts and queries across other schemas.

Sources are now shown as numbered chips with a popover, only actually cited sources appear, and web-search sources carry a site icon.

Fixed background jobs stalling after a cache-server restart, and an intermittent "model not found" error.

If an extraction engine is assigned but its credentials are empty, an error is now reported instead of switching to the default extractor without warning.

Secrets like DB connection info, tool connection keys, and user API keys are envelope-encrypted with an Azure Key Vault key (AES-256-GCM + RSA-OAEP-256, with the master key never leaving Key Vault)​. Supports separate keys for personal-information and financial classifications, automatic key rotation and re-encryption, tamper-evident hash-chain logging with CSV export, and a pre-flight check with atomic storage.

Adds OAuth and Cloosphere SSO token passthrough alongside the existing none/API-key/Bearer authentication. Choose which of an MCP server's tools are exposed to users, one by one.

Runs read-only queries directly against the graph for questions the built-in tools can't express. Write queries are blocked, and a judge model double-checks safety.

Reuses successful query patterns and avoids repeating past mistakes.

Accepts ID tokens issued by a trusted IdP such as Entra ID or Google with no separate token exchange.

Share a scheduled task with read or write access. Execution always runs with the creator's permissions, so there's no privilege escalation.

Across tools, tags, the glossary, and scheduled tasks, read sharers can view and copy while only write sharers can edit. Tag-management permission can be granted per group.

Stalled job queues are cleaned up automatically once they cross a threshold.

Admin setting changes now apply to every server immediately. Teams bot conversation context is also preserved across multiple servers.

Every entity from a Knowledge Base document is now recorded in the graph without exception, and search results are broken out by file-level source.

Extraction progress display, re-extraction, and bulk deletion.

The editor shows a warning if a tool connected to an agent has no description.

Admins choose whether the first-login onboarding walkthrough is shown.

Chat directly with a Cloosphere agent inside a Teams conversation. Supports agent selection, conversation persistence, and multiple languages, and is configured and deployed from the admin screen.

Automatically syncs organizations, departments, and groups. Stays stable at large-organization scale with parallel processing and retries.

Guest mode with no login required, external auth-token exchange, a bottom-panel display, user resizing with automatic host-page layout adjustment, and an SSO settings tab.

Reflects the document/chunk hierarchy in the graph, automatically classifies document types, and supports full-screen graph exploration with progress display.

Categories, background term extraction from DB values, per-item extraction instructions, extraction-source selection, and bulk management.

Applies shared tags and filters across the agent, Knowledge Base, database, glossary, guardrail, prompt, and tool lists.

Connects Google BigQuery as a data source.

Adds guardrail items to department-level permissions.

Suggests a next question to ask after each answer.

Background-job progress and results for the Knowledge Base, data analysis, glossary, and Knowledge Graph can be checked in the top notification center.

User role changes are now recorded in the audit log.

Upload an entire folder at once, with automatic duplicate-file detection.

Links business terms from the glossary, tables/columns/relationships from databases, and Knowledge Base documents into a single graph. Extracts entities and relationships from documents, maps terms to column conditions (e.g., "VIP customer" → tier = 'VIP')​, and lets you review candidate terms before registering them. Connect it to an agent and 5 graph-exploration tools are added automatically; you can also explore the graph on screen.

Add AI chat to an external website with a single script tag. Bubble, side panel, inline, and full-screen display modes; a color/size/icon editor; its own login; and an allowed-domains list. The agent can fill in a form or click a button on the page the user is looking at.

Uploading a large batch of files no longer stalls the service — they're processed in order through a job queue. Includes automatic retries, retry for failed files, same-name file replacement, and a processing-status card.

Improves PDF/Word/PPT extraction and chunking quality, and processes images and scanned documents with LLM Vision.

An option to automatically mask email addresses in conversations and documents.

Open models like Ollama can now call tools the same way as any other agent.

Global guardrails now apply as intended even when an organization's own guardrail is turned off.

Fixed a response-truncation issue with Gemini models, and partial response truncation on some other models.

Fixed Korean input where a consonant was entered twice.