This release contains the following component versions:
Windows Agent 26.28
Mac Agent 26.20
Web 26.27.3
BI 26.28
Server 26.27
New Features
New LLM Content Sharing Rule
Category: Web (Behavior Rules)
We have introduced a new LLM Content Sharing rule to detect and control sensitive data shared across AI platforms like ChatGPT Web, Gemini Web, Claude, etc. This enables real-time Data Loss Prevention (DLP) enforcement whenever users submit prompts, upload files, or download content during AI sessions.
How It Works
Whenever a user sends an AI prompt, uploads a file, or initiates a download, the Agent inspects the content against your configured behavior rules in real time. If a matching rule with a Block action is triggered, the connection is instantly terminated, ensuring the sensitive content never reaches AI servers.
How to Use the Feature
Enable the LLM channel from a Monitoring Profile.
Select the AI services you want to monitor, such as ChatGPT Web, Gemini Web, etc. from the LLM settings panel.
Create a new rule.
Select Content Sharing from the General tab, under Rule Category. Then, select LLM under Types of Content.
Select target users, computers, department, etc. from the User tab.
Configure your content definitions from the Content tab.
From the LLM tab, select the AI services you want to track from the LLM Source rule criteria.
For more information about behavior rules, check out our Rules Guide.
Known Limitations
Support Services/Apps: Currently supported services are: ChatGPT Web, Gemini Web, Claude Web, Claude Desktop, Copilot Web, and Google AI Mode. Additional AI platforms will be integrated in subsequent updates.
Content Definitions: Currently, only Data Content is supported on the Content tab.
File Size Thresholds: For file uploads/downloads larger than 5 MB, content inspection is applied only to the first 1 MB of file content. Files smaller than 5 MB are fully scanned.
Availability of the Linux Agent
Category: Web (Agent Download)
We're excited to announce that the Teramind Linux Agent (Stealth/Hidden version) is now generally available and can be downloaded from the Download Agent screen, bringing Teramind's full suite of endpoint monitoring, behavior analytics and threat prevention capabilities to Linux environments.
Features & Benefits
With the Linux Agent, you get similar powerful monitoring, analytics, and threat prevention capabilities you rely on for Windows and macOS - now extended to your Linux fleet:
User activity monitoring.
Behavior analytics and workforce intelligence.
Policy and rule enforcement for insider threat detection and data loss prevention.
Session recording and forensic investigations.
And more...
Supported Platforms
On launch, the Agent supports the following distros on AMD64 architecture:
Ubuntu 24
Debian 13
Red Hat 9
Additional distributions will be supported in future releases.
How to Install
1. Download the installer.
2. Run the following command in the Terminal:
Debian/Ubuntu:
sudo apt install -y <path-to-installer> TMROUTER=<instance-ip>
RedHat:
sudo dnf install -y <path-to-installer> TMROUTER=<instance-ip>
The <instance-ip> is the IP address of the Master Teramind server. The <path-to-installer> is the path where you saved the installation package. For example:
sudo apt install /tmp/ tmagent_26.23.447_debian13_amd64.deb TMROUTER=10.22.33.1
You can also select the Via command line option from the Download Agent/Welcome screen and run the Curl commands listed under the Linux section directly on the Terminal to download and install the Agent.
If you are deploying the Agent on a secure boot system, please consult this article.
Availability of All LLM/AI Sources
Category: Web (Monitoring Settings)
All supported LLM/AI sources including Claude, Microsoft Copilot, Google AI Mode, Claude Desktop, and others are now enabled by default in LLM Monitoring Settings. This ensures that new deployments capture AI activity out of the box, and your teams get immediate visibility into LLM usage across all supported platforms.
Gemini AI File Response Capture
Category: Web (BI Report) / Windows Agent
AI-generated file responses in Gemini Web conversations are now fully captured. When Gemini generates files (such as images or documents) directly within a chat, they are properly monitored and recorded giving you complete visibility into AI-assisted workflows.
The captured files can be downloaded as attachments from the LLM BI report.
Support for Korean Keystrokes
Category: Web (BI Report, Behavior Rules)
We’ve enabled support for Korean characters typed via IME (Input Method Editor). Previously, Korean input was incorrectly logged as the underlying English key mappings. With this release, the Agent correctly intercepts composed Hangul characters, ensuring keystroke logs and content-based rules reflect the actual Korean text entered by the user.
Configurable Date Range Limit for All Events Report
Category: Web (BI Reports)
The All Events BI report now supports a configurable maximum date range. This prevents out-of-memory errors when running queries against very large data sets, ensuring report reliability for high-volume environments.
To enable or adjust the limit, edit the teramind.config file on the BI node (or master, if BI runs on master):
tma_cubeapi_all_event_max_days = <number_of_days>
Replace the <number_of_days> with the required limit. For example, set to 7 to limit queries to a maximum of seven days (recommended for large environments). Set it to 0 to disable the limit entirely (default behavior - no restriction).
After saving, restart the Teramind service:
systemctl restart teramind
[Mac] Support for Gemini Web Monitoring
Category: Mac Agent (LLM BI Report)
We’ve added support for activity tracking in Gemini Web. This will help you monitor all user prompts and the corresponding AI-generated outputs, with data visible in the LLM BI report:
Known Limitation:
Tracking for file attachments is not currently supported.
[Mac] Support for ChatGPT File Attachments Capture
Category: Mac Agent (LLM BI Report)
The Mac Agent now captures file attachments uploaded through ChatGPT Web, which are reflected in the LLM BI report to improve visibility into AI-related file sharing. This enhancement provides fuller context for data exfiltration detection and investigations while improving overall AI governance.
[Mac] Support for Protected Agent Mode
Category: Mac Agent
The Mac Agent now supports Protected Agent mode - a tamper-resistant installation option that prevents unauthorized users from removing or modifying the Agent on monitored endpoints.
Features & Benefits
Tamper Protection: When enabled, the Agent is shielded from unauthorized removal, file deletion, or modification by local users, even those with administrator privileges.
Supports both Stealth and Revealed Agents: Protection works identically regardless of Agent type.
Zero-Configuration Operation: Protection arms automatically once the installer runs. No post-install setup, no policy files or complex configurations required. Disarming and re-arming are handled entirely through authorized uninstall flows.
Kernel-Level Enforcement: Protection is enforced by the Endpoint Security framework, ensuring it remains active even if other Agent components are interrupted.
Owner-Based Access Control: Only the user who originally installed the Agent can perform updates or uninstalls without a password. All other local users must provide a valid password to uninstall.
Seamless Maintenance: Server-driven updates, and auto-updates continue to work without interruption.
MDM-Ready: Fully compatible with MDM solutions. Deploy the protected installer package silently with no console user required - protection arms automatically and management is restricted to server-driven flows.
How to Use the Feature
Please see the following articles to learn how to install/uninstall the Protected Agent:
[Mac] New Uninstall Parameter to Skip Extension Removal
Category: Mac Agent
The Agent uninstaller script now supports a safe mode to skip extension removal to help prevent partial or unfinished uninstalls in environments where security policies prevent system extension removal. Administrators can use the skip_extensions flag to allow a clean agent uninstall to complete even if an MDM blocks extension changes.
The specific command to utilize this feature is:
sudo /usr/local/teramind/agent/bin/uninstall.sh -a skip_extensions
Improvements
Instance-Hosted Images in On-Premises Email Notifications
Category: Web (SMTP Settings)
The IMAGES FROM INSTANCE option under Settings > SMTP is now properly honored. When enabled, email notifications now reference images hosted on the local instance rather than loading them from teramind.co. This improves email rendering reliability in air-gapped, restricted-network, or proxy-enforced environments where external URLs may be blocked.
Clearer Server Update Error Messages
Category: Web (Server Update)
The server update process (TMU update) on the Settings > About screen now displays specific, actionable error messages in the UI. For example, if a downgrade is attempted, you will see a clear explanation rather than a generic failure. This helps administrators troubleshoot update issues faster without needing to check logs.
More Reliable Large TMU File Uploads
Category: Web (Server Update)
Uploading large .tmu update files on the Settings > About page no longer fails on slower or less stable network connections. The upload mechanism has been improved to handle interruptions gracefully.
Full Distinguished Name Tooltip in AD/LDAP Pickers
Category: Web (Active Directory Settings)
Organizational Unit (OU) entries in the Settings > Active Directory configuration pickers now display a tooltip showing the full details such as the Distinguished Name (DN), Path, etc. on hover. This makes it easy to differentiate between OUs that share the same display name across different parts of your directory tree.
Support for Custom Management Ports in Session Player
Category: Web (Live Player / History Player)
The Session Player now function correctly on deployments configured with a custom management port. Previously, video playback failed in these environments due to incorrect port handling.
Restored Browser Plugins Rule Functionality
Category: Web (Behavior Rules) / Windows Agent
A configuration issue has been addressed where Browser Plugins rules were not triggering due to excluded file system driver paths. These behavior rules will now trigger as expected to detect installed extensions or plugins, providing more robust security oversight and ensuring your compliance policies remain active.
Eliminated Unnecessary Browser LNA Pop-Ups
Category: Windows Agent
We’ve resolved the issue of local network access (LNA) pop-ups that appeared every time a website was accessed for the first time after updating Chrome to version 147 or later. This fix is designed to persist in GPO/MDM environments and ensure a smoother, uninterrupted browsing experience for users by removing redundant security prompts.
[Mac] Installation Package Security
Category: Mac Agent
The Agent now verifies the installation package name at the start of every install. This verification process ensures only authentic packages are executed, effectively protecting your environment against phishing attacks where malicious actors may disguise malware under trusted names.
[Mac] Cleaner VPN Content Filter Configuration
Category: Mac Agent
For deployments that use Teramind’s VPN mobile configuration profile, the Agent now ensures only one "port:8080" content filter entry is present under System Settings → Network → Filters. The entry is now managed by the mobile configuration and is non-editable by end users to improve compatibility with MDM-driven profiles.
This improvement addresses duplicate entries and configuration drift caused by mixed deployment methods, such as using a mobileconfig file in conjunction with scripts. The updated profile also improves network monitoring and hides the VPN configuration popup on Tahoe.
Other Improvements & Updates
Windows Agent
WhatsApp Desktop & Web Message Reliability: Resolved an issue where WhatsApp messages could be duplicated or dropped during reply threads. Message capture now runs seamlessly across both the desktop app and web client.
Restored Microsoft Teams Business Meeting Monitoring: Updated our Teams parser to align with recent traffic format and endpoint changes in the new Microsoft Teams client, fully restoring outgoing meeting capture for business accounts.
Restored Zoom Web Instant Messaging Tracking: Adapted our parsing method to support Zoom’s updated web messaging protocol, ensuring all instant messages sent through the browser-based client are accurately captured.
Camera Usage Reporting Accuracy: The Camera Usage BI report now accurately reports camera usage durations in the Time column, ensuring reliable data for compliance and workforce analytics.
Improved Agent Reliability: Optimized local data processing in offline mode, improving Agent reliability and reducing the risk of data loss or inconsistencies.
Clipboard Rule Compatibility: Fixed an issue where Clipboard content sharing rules incorrectly blocked paste actions in Microsoft 365 Copilot. Teams can now use AI productivity tools without disrupting DLP policies.
Improved Support for File Upload Tracking in IM Apps: We have updated our IM tracking to support new APIs across several major platforms, including Microsoft Teams (Desktop and Web), LinkedIn, Google Chat, WhatsApp (Desktop and Web), and Slack (Desktop and Web). This resolves a previous limitation where behavior rules configured to track file uploads were not consistently enforced by some of these applications. File upload tracking now works correctly across all of these IM platforms.
Accurate Threshold Detection in Advanced Mode Action: File detection rules configured with Advanced mode thresholds (e.g., Frequency > 5, Set action: Block) now trigger with precise accuracy. This grants administrators finer control over action triggers based on frequency and risk severity-based thresholds.
Support for Hostname Resolution for Network Rules: Network behavior rules now support hostname resolution in addition to IP addresses. This upgrade makes it much easier to define rules targeting specific domains and web services.
Mac Agent
Smarter Network Monitoring with Certificate Awareness: The Agent now gracefully handles scenarios where the MITM certificate is missing, expired, or untrusted in the system keychain. Instead of disrupting user connections, the Agent intelligently skips traffic interception when a certificate cannot be verified, resulting in a much smoother and more reliable monitoring experience.
Firefox URL Tracking Restored: Web page addresses are now correctly recognized in Firefox version 150 and above, ensuring uninterrupted browsing activity monitoring for users on the latest Firefox releases.
Web
Resolved Live Player Failure: Fixed an issue where the Live Player was not functioning for certain sessions.
Video Export Completion: Video exports no longer get stuck indefinitely in a "rendering" state. Exports now complete as expected or marked them as failed with proper error codes.
Auto Export Restored: Resolved issues where scheduled export was not working for Time Tracking, Time Cards, and Time Records reports.
Export Success Confirmation: The export success confirmation modal now appears correctly after an export completes.
Scheduled Export ZIP Files: Scheduled export ZIP files now extract correctly without corruption.
System Page Report Exports: Resolved an issue where certain reports could not be exported from the System > Report export page.Case-Insensitive Export Email Field: The outgoing export delivery email field is no longer case-sensitive, preventing failed scheduled report deliveries caused by capitalization differences.
Focus Dashboard Email Log Widget: Resolved a rendering issue with the Email Log widget on the Focus Dashboard – it now displays email data correctly.
Time Cards UI Restored: Resolved a rendering issue that caused the Time Cards page to display incorrectly.Manual Time in Total Worked: Manually logged time entries are now correctly included in the Productivity > Time Worked report.
Active Directory Settings Performance: The browser no longer becomes unresponsive when navigating to Active Directory settings in large AD environments.
Monitoring Profile AD Group Conflicts: Fixed monitoring profile assignment hierarchy so AD group-based assignments correctly apply when no direct user or computer assignment exists, preventing users from defaulting to the wrong monitoring profile.
LDAP Group Auto-Population: The LDAP configuration page no longer incorrectly auto-populates "Monitor / Don't Monitor" groups when adding a new monitored group.
Shared Lists in OCR Rules: Changes to shared lists are now properly reflected in OCR rules.
Activity Falsification Keystroke Data: Activity Falsification (Key Pressing) alerts now correctly display all captured keystroke data. Previously, invisible keys such as the Space key were rendered as blank. These are now displayed using their corresponding key labels (e.g., <Space>).
Regex Escape Characters in Rules: Saving Behavior Rules with regex conditions no longer causes escape characters to be doubled when curly braced are used.
OCR False Positive Alerts: The system no longer sends "delay too high" OCR alerts when no Agents are connected.
Longer Postcodes in Locations: Configure > Locations now supports international postcodes longer than 6 characters. Previously, entering a longer postcode would silently disable the "Update location" button, preventing access points from being saved.
Default Monitoring Profile Objects: Fixed an issue that prevented selecting objects to track in the Default monitoring profile.
Restricted Recordings Access: Users with appropriate permissions can now play restricted recordings in the History Player, resolving a previous access error.
RBAC Recording Access: Resolved an application error that prevented RBAC users from accessing screen recordings.
RBAC Password Confirmation: Fixed an issue where updating an employee's RBAC policy failed with "Need confirmation with password" when the Password confirmation method was enabled.
Operational Administrator Visibility: The Operational Administrator role can now see all assigned computers as expected.
Renamed GoogleAI Web: "GoogleAI Web" has been renamed to “Google AI Mode” in LLM monitoring settings and behavior rules to better reflect the feature it tracks and maintain naming consistency across the platform.
LLM Report Permissions: Employees without the View LLM report permissions can no longer see the LLM report listed in BI Reports.
Custom Port Node Connectivity: Resolved an issue where nodes could not connect to the master and TeraCV returned 403 errors when a custom management port was configured.
Docker Container Stability: Docker containers are no longer unexpectedly re-created after saving changes on the Settings > Alerts page.
Post-Update Maintenance Mode: Resolved an issue where the system entered maintenance mode unexpectedly after deploying a new build.