# v26.8.2, build 255 (2026-08-xx xx:xx UTC)
- Added protection against prompt injection. Documents, web pages, and retrieved content can carry instructions written for the AI rather than for you, for example, text telling it to ignore its rules or to hand over its instructions. AI Studio now always removes such passages before the content reaches a model, while the rest of your document stays intact and usable. When something was removed, AI Studio tells you and can show you which passages it took out. You can turn off the detailed dialog in the app settings. For IT departments: the new setting `DataApp.ShowPromptInjectionAlert` lets you configure the detailed dialog for your organization. Many thanks to Sabrina `Sabrina-devops` for implementing this feature and to Simon `SimonBpunkt` for his work on the detection patterns and their translations.
- Added configurable direct-chat launchers for assistant plugins. Plugin authors and the Assistant Builder can now open a chat with a chosen workspace, provider, profile, chat template, and data sources, while unavailable or unauthorized selections are reported before a chat is created.
- Added provider logos throughout AI Studio, making models easier to recognize at a glance. Configuration plugins can now give managed LLM, transcription, and embedding providers their own project icon with the optional `IconPath` field.
- Added the option for IT departments to enable assistant plugins they rolled out. Approving an assistant only stated that it is safe, so everybody still had to switch it on themselves. An approval can now also enable the assistant, either as a default which you may switch off again, or in a way your IT department keeps in place. The plugin page and the security card of the assistant tell you which of the two applies.
- Added knowledge about the latest AI models. AI Studio now recognizes Qwen 3.8 Flash, GLM-5.3 Flash, Meta's Muse Glimmer, NVIDIA's Nemotron 3.5, Tencent's Hunyuan Hy3, Grok 4, Claude Opus 5 and Sonnet 5, and Gemini 3.6 and 3.7. It knows what each of them is capable of, so images, videos, tool usage, and reasoning are available right away instead of staying hidden.
- Added the IONOS AI Model Hub as a provider for chats and embeddings. It runs open-source models in Germany, is subject to the GDPR, and IONOS states that your data is not used for training.
- Improved the safety of plugin symbols: AI Studio now shows the symbol of a plugin in isolation, so nothing inside a symbol can reach the rest of the app.
- Improved how much memory AI Studio needs. Working with large documents used to grow the app to several gigabytes, and on macOS that memory was never handed back. AI Studio now stays at a fraction of that and returns memory to your system. This matters most on devices with little memory, such as a Raspberry Pi.
- Improved the preview for large documents. It now shows you the beginning of your document instead of loading all of it, so the dialog opens right away. Your complete document still goes to the AI.
- Improved how AI Studio deals with rare internal hiccups. When the app window reloads, or when it briefly loses the connection to its own user interface, work which was still running in the background is now ended properly instead of leaving errors behind.
- Improved how IT departments roll plugins out. A configuration server can deliver any kind of plugin, not only configurations: one archive may carry assistant plugins and further types alongside a configuration, each in its own folder. The folder for staging a test behaves the same way, so a test can mirror the later rollout exactly. The Enterprise IT documentation describes the whole procedure.
- Changed how plugins your organization rolled out are protected. They can no longer be deleted or edited in AI Studio, which already applied to sharing and replacing them. This also covers plugins staged for a test: such a test now ends by restarting AI Studio or by removing the staged files, instead of through the plugin page.
- Fixed assistants created by the Assistant Builder being named after an internal placeholder, such as "Model decides", when you left the display name empty. The model now picks a fitting name instead.
- Fixed AI Studio reading a document to the end even after you closed its preview. Closing the dialog now stops that work immediately.
- Fixed AI Studio holding on to finished chats, presentation images, and plugin data. It releases them now, so memory no longer grows the longer you keep the app running.
- Fixed assistants handing an outdated result to the chat. When you sent several results without opening the chat in between, you now receive the one you sent last.
- Fixed rare issues when multiple configurations provided introduction texts or mandatory information under the same ID.
- Fixed the description of the global voice recording shortcut always appearing in English. On Linux, your desktop asks you to confirm such a shortcut and shows this description; it now appears in your language.
- Fixed the code editor being offered for assistant plugins your organization manages. Editing one would have withdrawn the approval of your IT department and demanded a fresh security audit.
- Fixed assistant plugins your organization deployed alongside a configuration not being recognized as centrally managed unless they declared it themselves.
- Fixed a misleading warning in the log when an organization deployed an archive that carries no configuration of its own.
- Fixed AI Studio underrating what many models can do. Newer Claude, Gemini, Grok, DeepSeek, and Qwen models were missing abilities they actually have, such as image input or tool usage. This was most noticeable with OpenRouter, where nearly every model was affected. AI Studio now derives these abilities from the same source for all providers, so a model offers the same capabilities no matter which way you reach it.