What's New in v2026.5.7
New Features
|
Feature |
Details |
| 🕵️ |
Indirect PI Rules (101/102) |
50 new patterns for social authority injection and covert action concealment — adversarial attack patterns used to manipulate AI agents without triggering obvious injection keywords |
| 📦 |
Supply Chain Import Scanner |
Detects malicious package names in dependency manifests (npm, pypi, go, cargo, maven) without requiring CVE version matching. Rules with fixed: none/n/a/unfixed always fire. |
| 🔒 |
Report Payload Obfuscation |
Reports default to obfuscating dangerous strings so the report itself can't be used as a prompt injection vector. Pass --no-ai-safe to disable for verbatim findings. |
| 🛠️ |
garak + llm-guard in AI Tools |
medusa install --ai-tools now installs garak (LLM red-team framework) and llm-guard alongside modelscan |
Bug Fixes
|
Fix |
Impact |
| 🧩 |
FP over-suppression: security parent dirs |
Repos stored under any *security* parent directory had ALL findings suppressed (e.g. mcp-exploit-demo: 0→13 findings, IMCP: 0→80 findings) |
| 🍎 |
macOS/Windows multiprocessing |
Batch Trivy/Semgrep/GitLeaks caches now rehydrated in spawn-mode workers via Pool initializer — findings were missing on non-Linux platforms |
| 🏠 |
Project-root scan boundary |
Batch scanners always target the project root. Previously, including a path outside the project (e.g. ~/.cursor/mcp.json) could expand the batch scan to $HOME |
| 📦 |
gradle.lockfile picked up |
Added to special_exact_names so Trivy can scan Gradle dependency lockfiles for CVEs |
Installation
pip install medusa-security==2026.5.7
Note
This release supersedes v2026.5.6, which was withdrawn. Pin directly to 2026.5.7.
