Releases

You no longer have to stop a run to change course. Type into the prompt bar while Neo is working and the instruction is injected at the next step — the current tool call keeps going, and no new task is started. The steer appears in the thread as soon as it is accepted, so you can see what you sent and what Neo did with it.

The prompt bar is now the control surface for a task. Type / to open a searchable settings menu and jump straight to mode, model, agent, sandbox, browser session, secrets, or schedule — without leaving the composer. Save the combination you use as a named preset, drop files onto the composer, and switch into chat mode when you want a conversation instead of a full run.

Share credentials with the whole project team without duplicating them. From the composer settings, bind one of your existing secrets to the project: every member can attach it to tasks, the value stays masked, and the owner is still visible. Unbind it anytime, and the share is revoked if you leave the team.

Code audits, penetration tests, and vulnerability triage now start from dedicated multi-step flows. Pick a GitHub App or personal token, search repositories and pull requests, set scope and authentication, attach files, and choose secrets before launch. Submitting opens the task directly.

Public share links now include Chat and Canvas tabs, so Insights — findings, tables, charts, and evidence — travel with the thread. Export to image, Markdown, JSON, or PDF without signing in.

Model picker now includes Claude Opus 5 and DeepSeek V4 Flash. Use them on new tasks and update existing automations to the model that fits the job.

Native apps are tighter in the places you already work. Slack respects stop and “need a human,” finds attachments anywhere in a thread, and can take workspace or per-channel instructions. Gmail drafts edit in place instead of spawning duplicates. GitHub review lists real pull requests, in-flight reviews, regression coverage, and accurate severity — and Issues can be filtered by repository.

Reliability and layout fixes across live tasks, Insights, Autopilot, GitHub, onboarding, and mobile.

Cloud browser now supports multiple concurrent sessions with full session management. Spin up several browsers in parallel, switch between them, and keep long-running sessions available while Neo works across targets.

Neo can drive the browser like a computer-use agent to collect proof of concept evidence — for example screenshotting an XSS popup, capturing a login flow, or recording the exact steps that reproduce a finding.

Connect 1Password with a service token so Neo can pull real credentials into the browser during automated testing. Credentials stay in your vault; Neo uses them only for the sessions you authorize.

Model picker now includes GPT-5.6 Sol, GPT-5.6 Terra, Kimi K3, and Grok 4.5. Use them on new tasks and update existing automations to the model that fits the job.

Create up to 50 custom subagents per user (up from 10). Build specialized agents for recon, review, triage, and reporting without hitting the old ceiling.

Issues triage is faster with saved views and fuller finding detail. Save custom filter sets so layouts by severity, status, project, or assignee are one click away, and capture reproduction steps, impact, and evidence on each issue without digging through the task trail.

Reliability fixes across network events, automations, diagrams, and client UI edge cases.

The live task view has been redesigned. Agent and sub-agent steps now stream inline and are grouped by phase, so you can see what Neo is doing at a glance. Reloading the page no longer reorders steps or drops tool output.

Every task can now generate a dynamic report with charts, tables, and diagrams, built from the work that task actually did. Open the Insights tab to generate it, then ask Neo to customize the report to your needs, and export it to PDF to share outside Neo.

We shipped a set of engineering updates and fixes to further improve code auditing workflows. Reviews now map entry points and endpoints before reading code, check every reachable path against the full set of vulnerability classes, and track coverage in a ledger so nothing gets skipped. The result is broader coverage and fewer false negatives on full-repo audits and pull request reviews.

Code review now runs with full repository context for public and private repos. Neo builds a map of your codebase, including structure, modules, and entry points, so reviews and questions are grounded in your actual code. Public repos work without any setup; private repos work once the Neo GitHub App is connected.

Stop a single agent, sub-agent, or tool without killing the task. Neo cancels just that piece of work and the rest of the run keeps going.

Neo now connects to Jira as a native app. Connect your Atlassian account from Settings → Applications, then mention @neo on an issue to triage, investigate, update, and act on the work, or start tasks from Jira issues and have Neo create and update issues as it works. Confluence connects the same way for read-only context. Learn more in the docs.

Connect Neo to Claude, Cursor, or any MCP client and run security assessments from wherever you work: start and manage tasks, review findings, check schedules, and pull reports and artifacts, all without leaving your client. Setup instructions are in Settings and the docs.

Report an issue or share feedback without leaving the app. Attach files, flag anything that is blocking you, and we follow up by email.

Reliability fixes across streaming, scheduling, sandboxes, billing, and GitHub.

When Neo is missing a capability your workflow needs, just ask for it. Describe the tool you want, whether that is hitting an internal API, querying your own database, or running a repeatable check, and Neo builds it on the spot, tries it against real inputs, and starts using it in the same task. Already rely on your favorite scripts or tools? Hand them over and Neo wraps them into ready-to-call tools instead of rebuilding from scratch. The tools run in your sandbox, are reused by Neo and its sub-agents, and stay available for future tasks, so the agent keeps getting more capable on the work you actually do.

Owners can now keep credit usage under control across the team. Set a team-wide default limit that applies to every eligible member, then override it per user when someone needs more or less headroom. Limits cap how much each member can spend without reserving credits, and changing the default can optionally clear existing per-user overrides so everyone inherits the new value.

Projects can now be team-visible or invite-only, with per-member access controls. Make a project visible to the whole team for shared work, or keep it invite-only and add specific members. Owners manage membership and visibility from the project header, so the right people see the right work.

Every project now has a Files tab backed by its sandbox workspace. The sandbox volume persists across tasks and container restarts, so anything agents read or write during a run stays available afterward. Browse the workspace, search for what you need, preview files inline, and upload your own, all in context alongside the project's tasks, issues, and members.

Schedule recurring runs for a project and let it make continuous progress on its own. Choose a daily, weekly, monthly, or custom-day frequency and a run time, then Neo picks up where the last run left off using the latest project context. Pause and resume the schedule at any time, trigger an immediate run with Run Now, and review the full execution history from the Autopilot tab.

Export task artifacts automatically over webhooks or pull them via the API. Wire task output into your own pipelines, ticketing, or storage so results flow downstream the moment they are produced, without manual copying.

Claude Opus 4.8, DeepSeek V4 Pro (high), and GLM-5.1 are now available from the model selector. Azure AI Foundry joins as a new bring-your-own-key gateway: add your Azure key and endpoint, create a deployment per model named after its Neo label, and those models appear in your picker.

Get started in minutes and subscribe to Neo on your own. Pick the number of seats, choose monthly or annual billing, and check out right from the onboarding flow. Annual plans come with a built-in discount, and you can review the per-seat breakdown before you pay. Billing, invoices, and plan changes are all managed from Settings.

Issues now pass a quality gate before they are filed, reducing false positives and low-signal findings. Medium-and-above findings must clear validation and structural checks first, so the data that lands in your issues list starts cleaner and needs less manual triage.

GitHub, Slack, and Linear are now first-class native applications, replacing the previous Composio-based integrations. Connect directly with each provider for tighter, more reliable behavior: review pull requests, run Neo from your channels and DMs, and create or update issues, all without a third-party bridge in between.

Time-to-first-token is faster and memory pressure is lower during long agent runs. Tasks start responding sooner and stay stable across extended, multi-step work.

A round of fixes across uploads, scheduling, streaming, integrations, and the sandbox.

HTTP traffic from agent runs is captured automatically and shown in a Network tab on the task view: method, URL, status, headers, body, timing, and size. A sitemap groups requests by host and path. Filter by method, status range, content type, or source (browser, CLI, script), then open any row for the full exchange.

Agents can also query that traffic with built-in tools—search across captured requests, pull a single exchange, or replay one with auth headers intact for follow-up tests.

Projects group tasks, issues, files, and members in one place. Create a project from the prompt bar or sidebar with a name and first task; work continues inside project tabs for Tasks, Issues, Files, and Settings. Task cards show status and expandable working memory (todos, facts, insights, files). Invite teammates from the project header, filter by status, and open any task inline without leaving the project.

Neo runs as a GitHub App on your org or personal account. Install the Neo GitHub App from Settings → Applications (or follow the install flow in our docs). After connect, Neo can review pull requests on push, post inline findings and a summary comment, and run @pdneo commands in the PR thread (review, investigate, validate a preview URL, and more). Private repo clones inside sandboxes use short-lived installation tokens—no PAT required.

Setup, permissions, and commands: GitHub integration docs.

A dedicated agent for ProjectDiscovery Cloud. Ask about assets, vulnerability findings, asset discoveries, leaked credentials, or Nuclei templates in chat and the orchestrator hands off to the PD Cloud agent. It uses your PDCP API key (account secret), respects PD Cloud team context (separate from your Neo team), and exposes tools for inventory, scans, leaks lookup, domain verification, and template search or management.

Type / in the prompt bar to open a searchable list of saved prompts. Pick one, fill any variables, and send. Create or edit prompts without leaving the chat—useful for repeatable pentest or audit setups with target, scope, and credential placeholders.

Home screen templates for Pentest, Vuln Triage, and Code Audit. Each dialog collects targets, scope, and optional secrets, then builds the task prompt. Pentest and Vuln Triage default to thorough (plan) mode; Code Audit uses fast mode.

New tools for X search, project APIs, OOB email capture, and network traffic inspection.

Settings shows the static egress IP Neo uses for outbound traffic so you can allowlist it on firewalls and WAFs before running tasks.

Introducing a new long-running thorough (plan) mode alongside the existing fast mode. Fast mode remains the default for quick, focused, and iterative tasks. Thorough mode is for depth: the agent asks clarifying questions about your target and objectives, builds a comprehensive plan, spins up parallel sub-agents for each part of the plan, and executes end-to-end. It takes longer and uses more credits, but it is built for broad-scope reconnaissance, multi-phase penetration tests, deep reverse engineering, and large research objectives where a quick pass would miss things. Available from the mode selector in the task UI and via the API.

A dedicated issues section at /issues with a persistent vulnerability database behind it. Browse, filter, and act on every finding your agents discover, with full details, timeline, and linked tasks on each issue. Agents read from and write to the same database, and they only file issues after a validation step, so the data starts clean. Every issue has two actions: "Challenge & Verify" re-tests exploitability by spinning up a new task against the finding, and "Escalate" pushes exploitation depth further, both available individually or as bulk actions.

Your feedback shapes future results. Mark something as a false positive, flag it as out of scope, or add business context, and agents carry that forward into every subsequent run. Over time, the system gets better at filtering noise, respecting your scope boundaries, and recognizing patterns you have already triaged. The same data feeds regression testing, so previously resolved issues are automatically re-checked in future tasks.

This release adds new agent tools across planning, issue management, SSH access, and centralized network traffic analysis.

Slack is now a native working surface for Neo, not just a notification channel. Connect your workspace from the integrations page with one-click OAuth, mention Neo in any channel or DM, and agents run security tasks, post concise summaries, and attach output files directly in the thread. Follow-ups maintain full thread context, so you can investigate a target, ask follow-up questions, and continue deeper work without re-explaining anything. Any request you would make in the Neo UI can be made from Slack. For setup instructions and usage details, see the Slack integration docs at https://docs.neo.projectdiscovery.io/integrations/slack.

Built specifically for red teaming operations. After working with multiple red teams over the past few months building custom tools and custom agents, we are releasing an official Red Team Operator agent designed to handle real-world post-exploitation workflows. It ships with nine curated offensive tools pre-installed in every sandbox (Impacket, BloodHound, NetExec, pypykatz, Hydra, John the Ripper, Kerbrute, Chisel, and Responder) and knows how to chain them strategically based on what it discovers at each step. The agent handles credential harvesting, lateral movement, privilege escalation, and domain enumeration end-to-end, pivoting between tools automatically as new information surfaces. Available in every account, all tools pre-configured and ready the moment the sandbox starts.

Connect to remote targets over SSH directly from the sandbox using key-based or password authentication. Agents can run commands, transfer files, and inspect remote systems as part of their task workflow. Configure SSH credentials from the secrets panel at neo.projectdiscovery.io. For setup instructions and usage details, see the SSH connections docs at https://docs.neo.projectdiscovery.io/concepts/ssh-connections.

Set any agent to unlisted visibility to share it via a private link without publishing it to the directory. Anyone with the link can install and run it. Revoke access at any time by switching visibility back to private.

GPT-5.5 and Kimi K2.6 are available from the model selector. Auto model selection routes each step of a task to the most suitable model based on the type of work. Multi-model support lets a parent agent and its sub-agents use different models within the same task, so you can balance cost and capability. Model preferences can be set at the project level.

The orchestrator now parallelizes sub-agent execution for speed. Instead of running one at a time, sub-agents for reconnaissance, scanning, and validation execute concurrently, and a redesigned trace UI lets you follow each one independently. Multi-step tasks finish significantly faster without any changes to how you set them up.

Agents now re-test discovered issues to confirm they are exploitable before they reach your dashboard. Each verified finding includes a structured proof-of-exploit with the exact steps, payloads, and responses used. This catches false positives before they show up in your issues list, so the data you review has already passed a second check.

Built-in agent tools for domain reconnaissance: wildcard domain search for phishing hunts, passive DNS to surface associated and typosquat domains, and subdomain enumeration with auto-export into downstream tools. Passive DNS discovery works without generating traffic to targets, so reconnaissance stays invisible.

A dedicated sub-agent with 135+ Ghidra tools for binary analysis, decompilation, and reverse engineering. Analyze binaries through natural language: decompile, extract strings, trace control flow, identify function signatures, and map cross-references. The agent runs entirely inside the isolated sandbox with no local setup required, and files can be shared between the Ghidra agent and other sandbox agents to chain binary analysis into downstream vulnerability assessment.

Save, search, and share prompts across your team. Type / in the chat to find and insert a prompt inline. Fork any prompt to create your own variation when a teammate has a good base but you need to adjust the scope or technique. Prompts are searchable by title and content, scoped to your team.

Add your own API keys for Google Vertex AI, Amazon Bedrock, or Vercel. Keys are available to all team members once configured. The model list updates dynamically based on which providers your team has enabled, so you only see models you can actually use. Usage tracking works the same regardless of provider. This is an enterprise feature. Contact your sales representative or account engineer to enable it.

Share task results via a public link. The recipient sees the full conversation, file outputs, and metadata in a clean read-only view with no Neo account required. All tool renderers work in the shared view: browser screenshots, mermaid diagrams, working memory blocks, and subdomain results render as expected. Secrets and private files are automatically redacted.

Create a workspace with role-based access, shared tasks, shared secrets, and a single environment everyone works from. Invite members by email or enable auto-join for anyone with a verified company domain. Three roles control access: admins manage billing and settings, members run tasks and manage secrets, viewers observe task output without modifying anything.

Every sandbox now ships with a local Chromium browser. For offline testing, locally deployed applications, or targets that need to be accessed without leaving the sandbox network, agents can use the built-in browser to navigate pages, fill forms, take screenshots, and interact with web applications directly inside the execution environment. No external browser service required.

The usage dashboard breaks down credit consumption by task, model, and agent, with date range filtering and per-task drill-down. Team-level tracking lets admins spot trends and manage spend across the organization. Credit balance and remaining allocation are visible at a glance from the settings page.

Connect sandboxes to internal networks via VPN so agents can reach private hosts, staging environments, and network segments that are not publicly accessible. VPN sessions are scoped to the sandbox lifecycle: established on sandbox start, torn down when the task ends. Configure VPN connections from the secrets panel using standard credentials.

Each sandbox now enforces process-level user isolation. Agent processes run under a dedicated user context, preventing cross-task interference and ensuring file permissions are scoped correctly. This also fixes edge cases where stale file locks or lingering processes from a previous task could affect the next one.

Sonnet 4.6 is now available for all user tiers, and Opus 4.6 is available with tag-based model access. Both models support Anthropic prompt caching, which reduces latency and cost on repeated tool calls within the same task. Model access is controlled via user tags set by admins.

Tasks now check credit balance before execution and at each step. If your balance is insufficient, the task stops cleanly with a clear message instead of failing mid-run. Per-task usage breakdowns in the usage dashboard show exactly where credits were consumed.

The main agent can now suggest and delegate work to specialized sub-agents mid-task. When the main agent encounters a problem that would be better handled by a different agent (browser analysis, file operations, network scanning), it proposes the delegation and transfers context automatically.

Configure and manage connector integrations directly from within the chat interface. Link external services, set tool permissions, and check connection status without leaving the task view.

Agents now maintain structured working memory that persists across steps within a task. Instead of losing context as conversations grow, agents track key findings, decisions, and intermediate results in a memory block that stays accessible throughout the entire run. This is particularly important for long-running tasks where early discoveries inform later decisions.

Agents can now search and index files within the sandbox as structured knowledge. Upload reference material, previous reports, or target documentation, and agents query it during tasks to make better-informed decisions. Knowledge is scoped to the sandbox and available to all agents operating within it.

Generate API keys directly from Neo to authenticate programmatic access without depending on a third-party auth provider. API keys work with the full REST API for task creation, status polling, and result retrieval.

Connect external tools and services to Neo via the Model Context Protocol. Connector agents bridge MCP-compatible servers into the sandbox, giving agents access to external APIs, databases, and custom tooling as native tools during task execution.

When an agent tool call fails due to a malformed input or schema mismatch, the tool repair processor automatically corrects the call and retries. This reduces task failures from transient tool errors without requiring manual intervention.

Secrets used during task execution are now redacted at the tool level before being stored or displayed. This applies to all output surfaces: task history, shared views, and streamed responses. Redaction is automatic and requires no configuration.

Set any task to run on a recurring schedule. Define the frequency, and Neo executes it automatically with the same agent configuration, secrets, and scope each time. Useful for continuous monitoring, periodic reconnaissance, or regression testing against targets that change frequently.

Share any completed task via a public link. The recipient sees the full conversation, tool outputs, and file artifacts in a read-only view. Secrets and sensitive content are automatically redacted before sharing.

Browse and install community-built agents from the public directory. Each agent comes with a description, pre-configured tools, and a system prompt tuned for a specific workflow. Install an agent and it is ready to use in your next task.

Agents can now generate Mermaid diagrams inline during tasks. Architecture maps, flow charts, mind maps, and sequence diagrams render directly in the conversation and are exportable as images.

Browse, upload, download, and edit files inside sandboxes directly from the task UI. The file navigator supports search, inline editing, and handles large file counts without freezing.

The entire task interface, including the chat, process trace, file navigator, agent directory, and schedules, now works on mobile. Layout, padding, and navigation have been rebuilt for smaller screens.

Browse, share, and install agents from a public directory. Create your own agent with a custom system prompt and tool configuration, then publish it for others to use. Agents can be shared as unlisted (private link) or listed in the public directory. Installing an agent makes it available in your task UI immediately.

Upload documents, reports, and reference material into a searchable knowledge base. Agents query the knowledge base automatically during tasks to inform their approach with target-specific context, prior findings, or scope documentation. Knowledge is indexed and available across tasks.

ProjectDiscovery Cloud Platform tools are now natively available inside every sandbox with auto-injected API credentials. Agents can run subdomain enumeration, port scanning, and vulnerability scanning through PDCP without manual API key configuration.

Agents can recall relevant context from previous tasks. When starting a new task, the agent searches past conversations and findings for relevant information, so repeated work against the same target builds on prior knowledge instead of starting from scratch.

Share completed tasks via a public link with automatic secret redaction. All sensitive values, API keys, credentials, and redact phrases are stripped from the shared view before anyone sees it. The shared view includes the full conversation, tool outputs, and file artifacts in a clean read-only format.

GPT-5.1 is available from the model selector. Haiku 3.5 is available as a fast, cost-efficient option for chat mode and lightweight tasks.

The main agent can now spawn specialized sub-agents during a task based on what it discovers. Instead of relying only on pre-configured sub-agents, the orchestrator creates new ones with custom tool sets and instructions tailored to the specific problem at hand. This means the agent adapts its approach as the task unfolds rather than following a fixed plan.

Stop any running task cleanly from the UI. The abort signal propagates to the sandbox and all active sub-agents, terminating processes and releasing resources. Aborted tasks retain their conversation history and any files produced up to that point.

A lightweight conversation mode for quick questions that do not need a full sandbox session. Chat mode uses a fast, cost-efficient model for general questions, research, and planning without spinning up infrastructure. Switch between chat and task mode depending on what you need.

Models from OpenRouter are now available in the model selector. Access Grok 4 Fast, Kimi K2, and other models through a single integration. Model availability updates as OpenRouter adds new providers.

Agents can now perform web searches and analyze web images as part of their workflow. The web research tools let agents gather open-source intelligence, check for public disclosures, and pull context from documentation without leaving the task.

Sandboxes now recover automatically from transient infrastructure failures. If a sandbox process crashes or loses connectivity, it restarts and restores state without failing the task. This eliminates a class of task failures that were caused by infrastructure, not by the agent.

Every task runs in an isolated sandbox pre-loaded with a comprehensive security toolchain. Nuclei, nmap, curl, sqlmap, masscan, ffuf, and ProjectDiscovery tools are installed and available out of the box. Agents use these tools directly through natural language without any setup, and all execution stays contained within the sandbox boundary.

A dedicated browser agent can navigate web applications, interact with pages, extract endpoints, take screenshots, and capture network requests. The browser runs in a remote session and the agent operates it through structured tools for clicking, typing, navigating, and extracting content.

Tasks run through a multi-agent system where a main orchestrator delegates work to specialized sub-agents. Dedicated agents handle reconnaissance, browser interaction, sandbox operations, and vulnerability verification. Each sub-agent has its own tool set and context optimized for its specialty.

Agents ship with dedicated tools for XSS vector testing and out-of-band (OAST) interaction verification. The XSS agent uses a curated knowledge base of context-aware payloads, and OAST tools confirm blind vulnerabilities through callback detection.

Agents can consume OpenAPI specifications and MCP servers as tool sources. Point an agent at an API spec or MCP endpoint and it gains access to every operation defined in it, with authentication support for protected APIs.

Sandboxes now run on dedicated cloud infrastructure instead of shared compute. Each sandbox gets its own isolated environment with dedicated resources, persistent storage, and no time-to-live limits. This means longer-running tasks complete without being interrupted, and sandbox performance is consistent regardless of platform load.

A dedicated verification flow for XSS and open redirect vulnerabilities. Instead of reporting potential injection points, agents now attempt to confirm exploitability by testing context-aware payloads against the target. Verified findings include the payload used and the response that confirmed the vulnerability.

Agents can now confirm blind vulnerabilities using out-of-band application security testing (OAST). Callback-based detection verifies that payloads triggered execution on the target, even when the response itself does not reveal the vulnerability. Essential for blind SSRF, blind XXE, and similar classes.

A curated knowledge base of XSS vectors indexed by injection context. Agents search this knowledge base to find payloads appropriate for the specific context they encounter (attribute, script block, event handler, URL parameter), rather than trying generic payloads.

Gemini 2.5 Pro is available from the model picker. GPT-5 High is also now available as a higher-capability variant of GPT-5 for tasks that benefit from deeper reasoning.

If your browser disconnects or you navigate away during a running task, you can return and the stream resumes from where it left off. No output is lost, and the task continues running in the background regardless of your connection.

GPT-5 is available as a model option. A new model picker in the task UI lets you choose which model to use before starting a task. Your selection is remembered across sessions. Models can be switched between tasks based on the complexity of the work.

Sandbox tool output now streams to the UI in real time. Instead of waiting for a tool to finish before seeing output, you can watch command execution, scan progress, and script output as it happens. This is especially useful for long-running tools like nuclei scans or network enumeration where you want to see results as they come in.

A dedicated summarizing agent processes sub-agent output into concise, structured summaries. When a sub-agent completes its work, the summarizer extracts key findings, strips noise, and presents results in a format the orchestrator can act on efficiently.

Agents now manage long conversations with a rolling context window that keeps the most relevant recent messages and compacts older ones. This prevents context overflow on long-running tasks and lets agents maintain coherence across many steps without losing track of important findings.

Set environment variables that are injected into the sandbox at runtime. API keys, tokens, and credentials are available to agents and tools without hardcoding them in prompts. Variable keys are included in the agent context so it knows what credentials are available.

Agents can read and analyze PDF files uploaded to the sandbox. The UI renders file previews inline, supporting PDFs, images, and code files with syntax highlighting. Larger file uploads are now supported.

Every task runs inside an isolated sandbox with shell access, Python scripting, and a pre-installed security toolchain including Nuclei and ProjectDiscovery tools. Describe what you want in natural language, and the agent plans and executes the work autonomously, running tools, writing scripts, and analyzing output step by step.

Tasks are handled by a multi-agent swarm where a main orchestrator delegates work to specialized sub-agents. Each sub-agent has a focused role and tool set. The orchestrator decides which agent to invoke based on the task requirements, and sub-agents pass results back for the orchestrator to synthesize.

Agents can list, read, write, and edit files inside the sandbox. File artifacts are stored in the cloud and available for download from the conversation. The UI shows file previews inline, including document previews and code with syntax highlighting.

Agents can search the web as part of their workflow. Useful for CVE research, checking public disclosures, finding documentation, and gathering open-source intelligence about a target.

Provide custom instructions that persist across tasks. Use them to set scope boundaries, preferred tools, output format preferences, or target-specific context that the agent should always consider.