AI Security
Search K

Appearance

October 21, 2026 - On-premises - v10.140.0 ​

This release includes updates in the following areas for F5 AI Security:

Moderator versions ​

AppVersion
Moderatorv10.140.0

Helm chart versions ​

Chart nameVersion
f5-ai-security-operator-helm1.12.0
cai-moderator1.17.0
cai-prefect1.11.0

On-premises ​

On-premises deployments now include the features and fixes from the October 14 SaaS release. This page repeats those notes in the following section: Included from the October 14 SaaS release.

Performance guardrails ​

Some F5 AI Guardrails are now available in two versions: Performance and Comprehensive.

Performance guardrails use smaller Machine Language (ML)-based core scanners. They run efficiently on CPU-based systems and provide the same core security logic with faster processing. You can also deploy them on GPUs for higher throughput.

Comprehensive guardrails use existing GenAI-based scanners. They apply deeper contextual reasoning to detect unknown or obfuscated attacks and nuanced subject-matter risks. They still require a GPU environment.

This release includes performance versions for PII core and the Adversarial attacks package.”

Changed: package renamed The Prompt Injection package is now called Adversarial attacks. The new name better reflects the breadth of attacks the package detects i.e. prompt injection, obfuscation, system prompt attacks and jailbreak. This name change applies to both Performance and Comprehensive Guardrails package.

Doc updates ​

Since the last on-premises release on October 8, 2026, we’ve updated the following product documentation:

Breaking changes ​

This release makes two changes to on-premises deployments. Review these changes before you upgrade.

  • The btree_gin PostgreSQL extension is now required. Every on-premises deployment requires btree_gin on the moderator database, regardless of the license.

    • If the extension isn't enabled, the database upgrade fails with the following message: btree_gin extension is not enabled. Please enable to continue database upgrade.

    The operator, the Helm chart, and caidb setup try to enable the extension automatically, as your database admin user. This requires an admin with permissions to create extensions.

Otherwise, the setup logs the following warning Failed to create btree_gin extension on moderator database and the upgrade then fails.

If your database admin user can't create extensions, ask a PostgreSQL user with access, to run the following command on the moderator database before you upgrade:

sql
CREATE EXTENSION IF NOT EXISTS btree_gin;
  • All model requests now use a single inference URL. This release removes the following environment variables:
    • CAI_MODERATOR_SCANNER_SERVER_URL
    • CAI_MODERATOR_AUTOPROMPTER_URL
    • CAI_MODERATOR_RED_TEAM_SCORER_URL

If you deploy with the operator or the Helm chart, no action is needed. Otherwise, if you set any of these variables, replace them with:

  • CAI_MODERATOR_INFERENCE_BASE_URL. Don't include the /openai/v1 suffix in this value. AI Security adds it automatically.
    • For example, if you set CAI_MODERATOR_SCANNER_SERVER_URL to http://inference.example.com:8000/openai/v1, set CAI_MODERATOR_INFERENCE_BASE_URL to http://inference.example.com:8000.

Included from the October 14 SaaS release ​

This section repeats the release notes from the October 14 SaaS release.

AI Red Team ​

Safety paradox attack pack ​

The November attack pack adds the Safety paradox attack vector. You can now use Safety paradox in your Red Team campaigns. For more information, see November 2026: Safety paradox.

CASI leaderboard update ​

The CASI leaderboard now shows results from the October attack pack, which adds the Involuntary in-context learning attack vector. For more information, see Attack pack timeline.

Search and filter raw report data ​

The raw data view for a Red Team report now loads results in pages. Search and filter the results to find specific attacks. The view shows how many results match your filters and how many results there are in total. Select Load more to see the next page.

When you download the raw data, select Full report to get every result, or Filtered results to get only the results that match your filters. For more information, see Open a report.

Reports list refreshes automatically ​

The Reports page now refreshes automatically. You can see the latest report status without reloading the page.

Empty report sections hidden ​

Red Team reports now hide sections that have no data. Reports are shorter and easier to scan.

Platform ​

Manage all API tokens from one page ​

In the UI, the new API Tokens page replaces the separate Personal and Global tabs with a single table. The table shows the tokens that your role lets you see. Org admins see every token in the organization. Each token has one of these scopes:

  • Personal: Belongs to you and is tied to your account.
  • Project: Can access only the selected project.
  • Organization: Can access organization resources.

The list shows active tokens by default. Filter the list by Owner, Scope, or Status, and sort it by name, expiry date, or status. A token's status is Active, Expiring soon, Expired, or Revoked. The Expiring soon status helps you replace a token before it stops working.

To create a token, select Generate API token. The secret appears only once, right after you generate the token, so copy it then. Org admins can revoke several tokens at once: select the tokens, and then select Revoke selected.

Project admins can now create project tokens from this view. For more information, see Tokens.

Get every guardrail added to a project ​

By default, the GET /backend/v1/projects/{project} endpoint returns only the guardrails that are turned on in a project. Add the includeAdded=true query parameter to also return the project's turned-off guardrails, guardrail packages, and connections in one request.

Resolved issues from the SaaS release ​

The October 14 SaaS release fixes the following issues:

  • The print view of a Red Team report didn't show the OWASP 2026 attack success rates chart or the attack success by attack vector chart. This was a known issue in the September 30 release.
  • In the print view, OWASP chart text and borders didn't display correctly in dark mode.
  • The attack matrix legend showed the wrong thresholds, and its colors didn't match the matrix.
  • Red Team reports showed the OWASP chart when no attacks ran.
  • Reports that contained only custom attacks didn't show the model name.
  • Section numbers in the agentic section of Red Team reports used a smaller font size than before.
  • On the Reports page, starting an attack run cleared the filters on the reports list.
  • On the Reports page, the report status badge didn't display correctly on small screens, and the progress bar in the Status column wrapped onto two lines.
  • If you canceled a campaign run that you had retried, the run stayed in the Cancelling status and never changed to Cancelled.
  • In the fingerprints view, a long model name could hide the name of the agentic resistance attack.
  • On the dashboard, the six-month time filter returned an error and the dashboard didn't update.
  • On the dashboard, the scan count could be negative.
  • The GET /backend/v1/scans endpoint ignored the projectId query parameter and returned scans from every project.
  • In the Python SDK, generated models didn't send aliased fields, such as global_, when you set them by their Python attribute name. For example, PatchScannerPackageAccessBody(global_=True) didn't send {"global": true}.
  • In the Python SDK, stopping an asynchronous client left its HTTP connections open.

Updated at: