In Takumi blackbox assessments, APIs that have no web UI can now be specified as an assessment target.
Instead of crawling with a web browser, Takumi extracts the endpoints to assess from the attached schema files, such as an OpenAPI specification or a GraphQL schema.
We are expanding access to AI Penetration Testing, which we began rolling out on June 15, 2026, to more customers. The feature verifies whether a given objective is achievable, from the perspective of a real attacker.
Set a target and a concrete objective — such as accessing user data — and Takumi autonomously chains reconnaissance, vulnerability discovery, and exploitation.
The feature is not yet available to all customers, so if you'd like to use it, register from the application page.
Takumi Images is now available in beta. It provides maintained container images that are continuously rebuilt and scanned so your applications can start from base images where known vulnerabilities have already been addressed.
The images are published through the OCI registry images.flatt.tech.
Takumi Runner now lets you search the trace data it has collected over a date range you specify. Previously you could only search the trace data of a single job, but with this search feature you can detect suspicious activity across every job within a given period.
This page also walks through how to use the search feature with real-world examples, such as the axios supply chain attack in March 2026. See Examples below.
The Takumi Guard log viewer has been rebuilt as a single, unified Log Browser that replaces the previous log search page. Search a package, browse recent activity across your organization, group installs by repository, workflow, or user, and share a link to exactly what you are looking at.
Takumi Guard admin deployment now configures Packagist — the PHP/Composer ecosystem — on every target machine, alongside npm, PyPI, RubyGems, and Go modules.
Takumi Guard's setup script (setup.sh / setup.ps1) now includes a healthcheck subcommand that verifies Guard is correctly configured and actively blocking malicious packages — all without modifying any files or requiring API credentials.
Takumi Guard now rewrites tarball download URLs for npm v11.15.0 and later, keeping installs working with npm's new supply chain protections. Users on these npm versions will see Takumi Guard's registry URL in their package-lock.json files.
Takumi Guard now supports Packagist alongside npm, PyPI, RubyGems, and Go.
PHP projects using Composer can now route composer install and composer update through Takumi Guard to block known-malicious packages before they reach your CI or development environment.
Anthropic's new Mythos-class model, Claude Fable 5, was released today, June 10, 2026. Here we share how Takumi byGMO, our AI agent for security assessment and penetration testing, will support this model.
