Nightfall Release Notes

Nightfall now detects outgoing AirDrop and Bluetooth file transfers at the moment macOS reads the file, and monitors or blocks them as per the policy before content leaves the device. AirDrop and Bluetooth work as independent triggers, and activity from both appears in Forensic Search. Bluetooth events can include device name, type, vendor, product ID, and MAC address when the OS provides them, but AirDrop cannot identify the peer, so the policy applies to the AirDrop channel as a whole.

The branded block dialog that Nightfall uses for browser uploads now also appears for USB, printing, Bluetooth, clipboard paste, cloud-sync uploads, desktop-app uploads, and command-line transfers. The dialog wording is specific to each vector, and multiple files from one action share a single dialog. Each vector shows a hold state while Nightfall scans the content and a result when the scan finishes, and Copy Details includes the policy and incident identifiers.

The Windows agent now persists the last-known data loss prevention (DLP) policy and agent configuration on disk, so enforcement continues after a service restart even if Nightfall's servers are unreachable. Exfiltration and raw events queue locally until Nightfall can deliver them, and Nightfall also retries content-scan uploads that time out.

You can now write Session Replay screenshots to a storage bucket that you own in Amazon S3, Google Cloud Storage, or Azure Blob Storage, with Nightfall resolving the destination per policy.

AI Governance now inventories the integrated development environment (IDE) extensions installed across your devices. The Overview and Devices views show where each extension is installed, flag outdated versions, and open a slide-out panel of configuration files. You can also override provenance, set notification preferences, view extensions per user and per device, and export a CSV file that includes when an extension was removed.

When an AI-agent hook event involves files, the incident now includes a preview of the file content and a content hash. On Windows, users can also submit a business justification, and Nightfall shows the justification details on MCP hook violations.

File preview: Mac Agent v1.2.15.8, Windows Agent v1.4.39.8.

Justification details: Windows Agent v1.4.39.8

Forensic Search now shows content scanning findings on an event when findings exist, and hides the preview when there is nothing to review.

The browser extension now evaluates uploads made by dragging a whole folder onto a page, including sites that read dropped items with webkitGetAsEntry(). Block messages for folder drops use folder-specific wording, and Nightfall delivers allowed pastes directly to the page.

Nightfall now supports CSV export of a directory's users from Settings → Directory Sync. You can also export identity provider (IdP) users from the IdP list in Global Settings.

Nightfall now provides detectors for Taiwan driver's license numbers, vehicle license plate numbers, and bank account numbers, and context words near a match raise the confidence level to Very Likely. These detectors sit alongside the Taiwan National Identification Number, Resident Certificate Unified Identification Number, and Passport Number detectors released in August 2026.

The Windows MSI now accepts INSTALL_EXTENSIONS_FOR, so you can limit Nightfall extension management to selected browsers, such as Chrome, Edge, and Firefox. The value persists across auto-updates and takes priority over backend browser-extension configuration, and the install-time stealth setting likewise takes priority over the remote flag.

Nightfall now gives images pasted from the clipboard a content identity so it can scan them, and it gates pastes from processes attributed to a desktop app.

The Safari extension now updates automatically, so Safari coverage no longer depends on a manual extension update.

Git push policies now follow Git's own destination rules. Nightfall resolves the real remote, including push URLs and remotes that list more than one URL, so it evaluates a push against the destination that actually received the code. It also treats local remotes on the same machine as local, not as an external exfiltration path.

Windows Agent uninstall now removes Nightfall components and leftover agent processes without touching unrelated OEM driver packages, and Nightfall prompts for a reboot only when the uninstall requires one. This release also lets remote diagnostics log collection complete without a timeout, and after repeated service failures, the agent restarts with a delay and a reset period.