New Features - Prisma AIRS - July 2026

Prisma AIRS now supports AI Gateway functionality. An AI Gateway acts as a centralized control plane for enterprise AI. It acts as a secure proxy built specifically for AI traffic; think of it as a digital toll booth that has complete visibility of all AI interactions within the enterprise. It helps track costs and usage across teams, models, and apps so budgets stay predictable. It allows total visibility into runtime behavior of models, apps and agents. It can integrate with different security guardrails so that every interaction can be monitored for threats. You can use this functionality to centrally enforce policies and govern how AI is being used within your organization.

Prisma AIRS AI Red Teaming introduces Custom Target Adapter, extending the platform's ability to scan any AI target an organization deploys, regardless of how that target handles authentication, session management, or response formatting. The goal is straightforward: any AI application that a human red teamer can interact with should be scannable by AI Red Teaming without requiring custom middleware.

Enterprise AI targets rarely expose a simple, stateless API. They require creating sessions before accepting messages, refreshing authentication tokens that expire mid-scan, threading conversation identifiers across multi-turn interactions, or returning AI responses in proprietary formats that standard extraction cannot parse. Until now, connecting these targets required building and maintaining a bespoke proxy server, a significant effort that could take weeks per target and introduced ongoing operational overhead. Custom Target Adapter replaces this with a standardized approach that is seamless and quick to configure.

Custom Target Adapter uses a simple Python SDK where customers implement plain functions that control how requests are prepared and how responses are processed. The SDK supports automatic token refresh with configurable expiry, session creation and state management across multi-turn conversations, flexible response extraction from any format, and explicit error signaling for rate limits, authentication failures, and content filtering. For targets that use non-HTTP protocols such as WebSocket, a full request override is available.

To configure Custom Target Adapter section in the AI Red Teaming web interface, create a Python script, define any required variables and secrets, and validate end-to-end before linking to a target. Validation runs the complete communication chain so configuration issues surface before a scan begins. A single processor configuration can be shared across multiple targets, with per-target overrides for environment-specific values.

If your organization scans AI applications that require authentication flows, session-based conversations, or return responses in custom formats, Custom Target Adapter provides native connectivity without external middleware. This is particularly valuable for teams running long-duration dynamic scans against OAuth-protected targets, testing multi-turn attack scenarios against session-based chatbots, or scanning AI applications with proprietary API contracts that standard connectors cannot accommodate.

Customizable Goal Categories is an agent scan configuration enhancement for Prisma AIRS AI Red Teaming that gives you direct control over which goal categories the system uses when generating attack goals for your AI targets. Previously, AI Red Teaming distributed these goals across different categories with no transparency into which specific goals are being tested and no mechanism for you to select the ones that matter the most for your deployment. The enhancement solves this gap by surfacing goal categories as a first-class configuration option in the new scan setup workflow.

Additionally, the agent scan report is enhanced to give you full visibility into the goal category and corresponding result. Each goal in the report carries a category badge so you can immediately see whether a goal was testing tool misuse, goal manipulation, or any other attack vector. Exported reports in CSV and PDF format include a goal_category field against each goal so you can perform this analysis in downstream tooling.

This feature would be helpful when your AI deployment has a specific, well-understood attack surface that a generic goal distribution does not adequately cover. For instance, if you are securing an agent with extensive tool-calling capabilities, opting in for Tool Misuse over others lets you maximize coverage of the exact risk vector your deployment exposes. If you are evaluating a model's risk to generate harmful content ahead of a production release, you can select Toxic Content Generation to ensure thorough testing without diluting results with categories that are not applicable to the model.

AI Red Teaming Multimodal File Attacks extends the Attack Library scan to include file-based attack delivery for AI targets that accept document uploads. When you enable this feature, the scan delivers PDF and Markdown (MD) files with malicious prompts from a curated library alongside your existing text-based attacks and surfaces the results in the same scan report. This gives you coverage of the file ingestion attack surface that text-only scans cannot reach.

To configure a target for file-based attacks, you enable the File Modality option in the target configuration wizard and map the file content and MIME type fields to the corresponding fields in your API request. If you paste a cURL command, the system auto-detects the file fields in the request. When you run an Attack Library scan against this target, you select the Attack Modality (Text only or Text and File) to control how AI Red Teaming delivers attacks. After the scan completes, you can filter the Attack Details report by Attack Modality to view text or file-based findings.

If your AI deployment includes an application or agent that processes uploaded files, such as a document summarizer, text-only scans cannot test those file ingestion pathways. An attacker can embed prompt injection instructions, system prompt extraction commands, or data exfiltration payloads within the text layer of a PDF or MD file. The target processes the document, executes the embedded instructions, and the attack succeeds (none of which a text-only scan detects). The file-based attack testing tests these pathways by delivering curated documents with malicious prompts through the same scan pipeline you already use.

Note: The PDF and MD file formats are supported. File attacks consume the same scan quota as text attacks, and no changes to your existing license are required.

Palo Alto Networks is migrating Prisma AIRS Discovery services to a new infrastructure (the Multi Cloud Security Fabric (MSF) platform)). This change affects existing customers who have onboarded cloud accounts and requires action depending on your cloud provider:

Azure

• Azure accounts will be disabled after migration due to a perimeter firewall public IP change.

• To restore access, add the new perimeter firewall public IPs to your allow list for Azure storage flow logs.

• Cloud IP Tag (CIPT) service remains unaffected and continues to function during and after migration.

AWS

• Account enable/disable status is not affected.

• Customers with public clusters must add new perimeter firewall public IPs to their API server allow list to continue discovering container workloads.

• Cloud IP Tag (CIPT) service is unaffected.

GCP

• GCP accounts will be disabled after migration due to the new Service Account on MSF infrastructure.

• You need to download and apply the GCP account onboarding terraform after migration.

• CIPT continues to function on the existing account; once a new GCP account is onboarded and CIPT is reconfigured, the old account can be deleted.

Note : Delicensing will not be available during the migration maintenance window.

Strata Cloud Manager now supports tenant-level onboarding for Azure Tenants in Prisma AIRS, enabling you to bring your entire tenant under SCM management in one streamlined workflow—eliminating the need to onboard each subscription individually.

The Security Lifecycle Review (SLR) report gives you a comprehensive view of application workloads, traffic flows, and threats detected across your cloud infrastructure. Prisma AIRS expands SLR coverage to Azure by adding support for inline and monitor-mode AI Runtime firewalls, while restructuring multi-account reports for clarity.

Prisma AIRS AI Red Teaming now includes Tool Chaining as a new attack category within agent-led scans. When you select the Tool Chaining category in Agent Scans, the scan tests whether an AI agent can be manipulated into combining multiple individually safe tools into a dangerous sequence that results in unauthorized actions such as credential theft, data exfiltration, or unauthorized transactions.

Modern AI agents are designed to chain tools together to complete tasks, such as looking up account information, retrieving credentials, drafting messages, and sending communications as part of a single workflow. While each tool may pass its own security review in isolation, the combinations an agent constructs at runtime can create an attack surface that does not exist in traditional applications. An attacker who crafts the right request can cause the agent to execute a sequence of approved tools that, taken together, produce a harmful outcome, such as retrieving API keys and transmitting them to an external address, without any single tool behaving outside its intended function.

This capability systematically analyzes the agent's available tools, identifies which combinations can produce these outcomes, and validates that data can actually flow through each chain before testing it. This approach ensures that every chain tested represents a real, exploitable path rather than a theoretical concern. Results appear alongside existing findings in the scan report, grouped by outcome category.

Organizations deploying AI agents with access to multiple tools, particularly agents that handle credentials, manage data across systems, communicate externally, or modify access permissions, should enable this capability to identify exploitable tool combinations before attackers do. This is especially relevant for customer-facing agents, internal workflow automations, and any agent that bridges sensitive data sources with external communication channels.

Prisma AIRS removes the requirement of needing a minimum of 4 vCPUs. Prior to this release, Prisma AIRS required a minimum of 4 vCPUs, making it cost-prohibitive for customers migrating from 2 vCPU VM-Series firewalls — particularly for non-AI workloads. This feature introduces 2 vCPU support to reduce that barrier and improve adoption.

Note: 2 vCPU Prisma AIRS supports non-AI workloads only. AI traffic inspection requires a minimum of 4 vCPU. When you configure AI policy on a 2 vCPU device it will generate warnings and errors at both commit time and runtime.

The following use cases are supported:

• Container security. Enforce security policy for containerized workloads on lightweight 2 vCPU instances.
• Micro-perimeter. Protect east-west traffic and segment micro-services, consistent with existing 2 vCPU VM-Series deployments.

  Note: High-Speed Forwarding (HSF) is not supported on 2 vCPU Prisma AIRS.