Skip to content
ReleasesGitHub

Agent Proxy releases

Download

  1. Choose a release

    Version
    1.20.2559
    Older releaseReleased 2025-01-28

  2. Choose a platform

    PlatformWindows
    Architectureamd64

  3. Download and verify

    aembit_agent_proxy_windows_amd64_1.20.2559.msiWindows · amd64 · 14.6 MB.sha256.sha256.sig
    Download
    Verify this downloadsha256 + gpg

    1. Fetch the artifact and its sidecars

      Every release ships a bare-hash checksum and a detached GPG signature over that checksum.

      curl -O https://releases.aembit.io/agent_proxy/1.20.2559/windows/amd64/aembit_agent_proxy_windows_amd64_1.20.2559.msi
curl -O https://releases.aembit.io/agent_proxy/1.20.2559/windows/amd64/aembit_agent_proxy_windows_amd64_1.20.2559.msi.sha256
curl -O https://releases.aembit.io/agent_proxy/1.20.2559/windows/amd64/aembit_agent_proxy_windows_amd64_1.20.2559.msi.sha256.sig

    2. Import Aembit’s signing key

      One time per machine.

      curl -sS https://keybase.io/aembit/pgp_keys.asc | gpg --import

    3. Check the signature on the checksum

      This proves the checksum came from Aembit and was not altered in transit.

      gpg --verify aembit_agent_proxy_windows_amd64_1.20.2559.msi.sha256.sig aembit_agent_proxy_windows_amd64_1.20.2559.msi.sha256
gpg: Signature made …
gpg: Good signature from "Aembit, Inc. <keybase@aembit.io>" [unknown]
Primary key fingerprint: EA3D 8D2F DAC6 BD81 3716  3D00 D655 E647 29BC 67D7

    4. Compare the artifact against the checksum

      PowerShell. The .sha256 file holds only a hash, so compare the two values directly.

      $want = (Get-Content aembit_agent_proxy_windows_amd64_1.20.2559.msi.sha256).Trim()
$got  = (Get-FileHash -Algorithm SHA256 aembit_agent_proxy_windows_amd64_1.20.2559.msi).Hash.ToLower()
if ($got -eq $want) { "OK" } else { "MISMATCH" }
    Expected digest
    70969f94849559f89f69e70b8376b12e14561b0be91caf4dd010e368ef88578c

All releases

38 Agent Proxy releases in total. Select a version to update the steps above.

VersionReleasedNotesLinux amd64Windows amd64
1.34.5755latest2026-08-27Honor the gRPC keep-alive properties in the Windows installer; add the authorization chain to workload events; keep the outcome fields on Aembit-generated response events; validate arguments in the Linux installer✓✓
1.32.49992026-06-04Add gRPC keep-alive and HTTP/2 ping options, with keep-alive settings in the Linux and Windows installers; add the HTTP idle timeout setting to the Windows installer; add a private key rotation period for x509 credentials; resolve all directive variables in a single GetCredentials call; restore AGENT_TRUST_PATH; handle dmidecode errors when gathering the serial number; include the error body when a server connection fails✓✓
1.31.47982026-05-21Add support for x509/mTLS client credential injection✓✓
1.31.47642026-05-02Remove S3 upload size restriction; add support for gathering dynamic claims from environment variables✓✓
1.31.46702026-04-17Add upstream HTTP proxy support✓✓
1.30.44332026-03-11Apply stability improvements for S3 uploads and downloads✓✓
1.29.42982026-02-26Extend Oracle protocol support with username injection for thick and thin clients and Oracle events; add the command line to process assessments; cache process assessments with a file hash cache; skip the TCP connection handler when process identification is disabled; add logging for process assessments✓✓
1.28.40632026-01-16Add initial Oracle database protocol support with O5LOGON authentication; add eBPF-based network request logging; compute payload signatures on streaming bodies; redact OIDC tokens in logs; fix Lambda pause detection activating when it should not; share the conntrack netlink connection across assessments✓✓
1.27.38652025-12-04Support multiple AWS STS Credential Providers in a single Access Policy via Access Key ID mapping✓✓
1.26.36392025-10-21Gather Kubernetes environment variable assessments only on Kubernetes; reduce CPU use when sending events; set permissions on parent directories in the VM installer; apply base image security updates✓✓
1.25.36002025-10-02Apply a security fix to the container base-images✓✓
1.25.34942025-08-22Add support for the generic OIDC Trust Provider; download the tenant root CA certificate at startup; collect additional network interface information in assessments; determine User-Agent strings at runtime; remove the cloud location override; reject 0 for certain startup arguments✓✓
1.24.33242025-07-22Add an in-proxy network diagnostic tool; add raw IP address support; standardize timing environment variables on a _SECS suffix; make the container start script honor AEMBIT_LOG_LEVEL; remove the process command line assessment; fix a token expiration threshold bug; fix the VM installer setting steering hosts twice✓✓
1.23.30022025-05-26Fetch STS data only on ECS and Lambda; omit the tenant root CA certificate when loading the bundle; report the build version to Aembit Cloud✓✓
1.22.29052025-04-21Validate JWT signatures and issuers, with trusted issuers as a startup argument; use the original destination when connecting; fix explicit steering host matching; patch base image vulnerabilities✓✓
1.21.27892025-04-02Add Kerberos and Prometheus support to the Windows installer; upgrade AWS configuration handling✓✓
1.21.27142025-03-05Fix an error when calculating the expiration time of an empty certificate✓–
1.21.26962025-03-03Add AWS SigV4A signing; remove the KMS constraint from AWS SigV4 signatures; fix the immediate termination shutdown strategy✓✓
1.21.26702025-02-20Add Vault login support✓✓
1.20.25592025-01-28Initial Windows Server release of Agent Proxy–✓
1.19.24392024-12-26Add SELinux support to the VM installer with RHEL rulesets; add a Windows build with host assessments and an MSI installer; fix constant reloading of native certificates; fix a DNS resolution race; add an option to disable the directive cache; log startup arguments✓–
1.18.22622024-10-23Remove the expiration on the VM service user; rename the steering methods; exclude the AWS instance metadata address from steering rules✓–
1.17.22552024-10-09Add Prometheus metrics for connections, credential injection, process statistics, and control plane status, with a port override and an option to disable the endpoint; gather only the assessments that apply to the deployment model✓–
1.17.21692024-09-17Add a rolling network trace; add the virtual appliance deployment model; enforce TLS in the container start script and add TLS debug logging; add metrics plumbing✓–
1.17.21552024-09-05Add an HTTP idle timeout; consolidate token refresh handling✓–
1.16.21392024-08-27Collect information for multiple Credential Providers; shut down on errors in critical tasks; fix HTTP data collection on requests without a JSON body; update the log level environment variable✓–
1.15.20932024-07-03Steer only specific traffic to Agent Proxy, including Docker containers, with custom steering; add an edge monitor script; add a registration timeout; replace AEMBIT_AGENT_VM_INSTALL with AEMBIT_AGENT_PROXY_DEPLOYMENT_MODEL; fix root certificates loading twice at boot✓–
1.14.19802024-06-03✓–
1.14.19592024-05-30Raise the open files limit on VM installs; remove OpenSSL usage; lower the log level when STS environment variables are missing✓–
1.14.19132024-05-14Add AWS Role Trust Provider support for EC2; do TCP passthrough over HTTP when TLS Decrypt is not set; add the resource set ID; fix a Lambda event-flush race; install the journald namespace config only on systemd newer than 245✓–
1.13.18512024-04-19Serve health data on the health endpoint separately from the service server; add the Lambda ARN Client Workload identifier with paused-container checks; add CNAME support; flush events on immediate termination; statically link the binaries against musl✓–
1.13.18182024-04-08Listen on all local addresses for DNS proxying; add protocol identification; add a health port✓–
1.12.16992024-03-12Terminate immediately on SIGTERM; merge the iptables and firewalld rule scripts; fix Kerberos calls over TLS; allow upgrades without redefining environment variables; lower the log level of routine messages✓–
1.12.16212024-02-29Add Kerberos attestation through Agent Controller with keytab and TGT support in the VM installer; fix DNS messages larger than 512 bytes failing to resolve; allow an https Agent Controller address in the installer; cache Kerberos assessments✓–
1.11.15512024-02-08Resolve multiple credentials in one request; make the HTTP server port configurable; add firewalld support to the VM installer; check for the iptables dependency at install; build against an older glibc; add the Server Workload to TCP passthrough events; add a timeout when fetching tokens from Agent Controller✓–
1.10.14412024-01-04Validate process identification with conntrack events; fetch Redis credentials just in time; add TTL information when caching credentials; add a backoff interval for command queue polling✓–
1.10.14152023-12-07Add Azure attestation support; add the system serial number and endpoint security agent data to assessments; add a sudoers file and harden file permissions in the VM installer; bundle AWS certificates in the container; include a message in events when directive retrieval fails✓–
1.9.13372023-11-08✓–

New to Agent Proxy? View the install and deploy guide.

Configuring Agent Proxy? View the environment variable reference.

Looking for what changed? View Agent Proxy in the changelog.

Copyright © 2026. All rights reserved.Privacy PolicyTerms of ServiceTrust CenterMetadata collectionContact Aembit