Takumi Guard now officially supports GitLab CI/CD on GitLab.com. In addition to GitHub Actions, by signing in to Shisho Cloud as a bot with OIDC authentication from GitLab CI/CD jobs, without long-lived secrets, package downloads through Takumi Guard are now recorded in your organization's installation logs.

Takumi Agent for Endpoint protects your organization's Macs with Takumi Guard. It works through Takumi Agent, a macOS agent installed on each Mac that sends every package install through Takumi Guard.

Install it once, and every tool on the Mac is protected without configuring each package manager, while each device's protection state shows up in the Shisho Cloud console.

The cicd-sensor integration skill is now available. It lets an AI agent set up Takumi Runner's cicd-sensor integration for you. With this skill, an AI agent can identify and carry out the work that is needed, such as creating the Takumi organization, creating the bot for authentication, adding cicd-sensor, and connecting it to Takumi Runner.

You can download the skill here.

We improved AI penetration tests so that Takumi keeps testing toward the goal more persistently.

You can now start an AI penetration test that carries over the results of a blackbox assessment, a graybox assessment, or a penetration test.

As we strengthen the infrastructure that runs Takumi assessments, from November 2, 2026, we are adding new source IP addresses that Takumi uses.

If your firewall, WAF or GitHub organization restricts access by IP address, please allow the new addresses by Monday, November 2, 2026.

Takumi blackbox and graybox assessments now support systems that require a TLS client certificate (mTLS).

Periodic Assessment is now available. Set it up once, and Takumi automatically assesses the files changed in your GitHub repository every week or every month.

AI Penetration Testing is now available to all organizations. Any organization can use Takumi to verify whether an attacker could actually achieve a given objective in its environment.

We have updated the Takumi Guard GitHub Actions flatt-security/setup-takumi-guard-npm and flatt-security/setup-takumi-guard-pypi.

These changes are already available as v1.4.0 of the npm action and v1.3.0 of the PyPI action. On Tuesday, October 13, 2026, we will move the v1 tags to these versions.

This note describes the changes and what you may need to check or change.