Skip to content

What's New in Nullafi Shield v3.11.1

v3.11.1Released: October 26, 2026  ·  Container image: public.ecr.aws/nullafi/shield:v3.11.1

Overview

  • 0

    New Features

  • 2

    Improvements

  • 2

    Bug Fixes

  • 0

    Security Fixes

Version 3.11.1 extends response protection to the answers of the most widely used AI assistants — claude.ai, ChatGPT and the OpenAI Responses API — and fixes group-based rule exceptions and API Scan block responses.

Improvements & Bug Fixes

Full list of resolved issues and quality improvements in this release.

Type Description ID
Improvement Response rules — including Obfuscate and De-cypher — now apply to streamed AI answers from claude.ai (web and Claude Desktop), ChatGPT web, and the OpenAI Responses API used by ChatGPT desktop and Codex. Users see their original values restored in the answer when a Cypher rule protected the prompt, and sensitive values are masked even when the AI writes them out across several pieces of the stream. ChatGPT desktop and Codex are covered when configured to use streaming (SSE) mode rather than their default WebSocket connection. NS-809
Improvement Shield now recognizes the AI provider of a streamed answer from the content of the stream rather than the request address, so protection keeps working when an AI vendor changes or adds endpoints. This also closes gaps where some parts of an answer — such as tool-call content written by AI agents — could reach the user without being de-cyphered. NS-812
Fix Fixed an issue where rules using the Group is not equal or Group does not contain conditions applied to everyone, including members of the excluded group. Group-based exceptions such as "everyone except Executives" now work as expected for both API and ICAP proxy rules. NS-813
Fix Fixed an issue where API Scan did not return a block response when a request triggered a Block rule. NS-808

Upgrade Instructions

Follow these steps before upgrading in production. Estimated time: 10 minutes.

  1. Back up your database and configuration files Take a full snapshot of your database and export your current configuration — including your .env and any custom policy files. Store backups off-instance before proceeding.

  2. Pull and deploy the updated container image

    docker pull public.ecr.aws/nullafi/shield:v3.11.1

    Configure your container runtime scripts or commands to use the new image. (If using Nullafi's sample Docker Compose files, modify the .env file so that SHIELD_IMAGE points to the new image.) Restart the Shield service after pulling the updated image.

nullafi.com  ·  docs.nullafi.com  ·  support@nullafi.com  ·  Previous releases