> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/version-1.60.md).
# Version 1.60
Version 1.60 adds File Security reports for Google Drive, OAuth authentication for the Material MCP server, and speeds up [OAuth app](/learn-more/risk-areas/malicious-oauth-apps.md) investigation. It also sharpens issue investigation and continues to expand built-in email threat coverage.
***
## :tada: New
### File Security reports
[File Security](/getting-started/deployment-guides/your-first-30-days/7-enable-file-security.md) reports give you a single place to see your file exposure at a glance. This new dashboard shows what sensitive content lives in Google Drive and how it's being shared. The Overview maps how many sensitive files are shared publicly, externally, and with your entire company, along with trusted external shares and files shared with only a subset of the company. Results from your [custom detections](https://docs.material.security/getting-started/fundamentals/detect/custom-detections) appear alongside it.
The File Security report
The report gives you three ways to work with your file exposure:
* **Export to PDF:** save the full report, including the Overview, sensitive files by category, and custom detections, as a PDF to share or archive
* **Date filtering and comparison:** narrow the report to any date range, defaulting to the past month, then compare that range against the one before it to see whether your exposure is growing or shrinking.
* **Custom detections chart:** each detection shows period-over-period comparison bars, with hover detail for the exact counts
Hover any period for exact counts
{% hint style="info" %}
File Security reports are available for all customers with Advanced licenses.
{% endhint %}
### Connect to the Material MCP server with OAuth
Customers on all plans can now connect their AI tools via OAuth to the [Material MCP server](https://docs.material.security/reference/material-mcp-server), instead of creating and managing a long-lived API token by hand.
From the top toolbar click **Integrations**, expand **API**, then click **Tokens and MCP Connections**. Open the **Connect to MCP** dialog for setup instructions tailored to your client, then sign in to authorize the connection.
Setup instructions are tailored to the client you select
***
## ✨ Enhancements
### OAuth Apps
#### See when a token was revoked
An app's Accounts tab now shows a **Revoked at** timestamp for each revoked account, and the app timeline records both the revoke and the end-user notification as events. You can line these up against alerts in your [SIEM or EDR ](https://docs.material.security/learn-more/reference/event-subscriptions)when you're piecing together an incident.
Revoked at timestamps on the Accounts tab
#### A clearer Accounts tab
The **Remediation** column is now hidden by default on an app's Accounts tab, so the view starts less cluttered. You can turn it back on from the table's display options. When an account's token can't be revoked, the tooltip now explains the reason.
#### More accurate app trust assessment
When Material assesses whether an OAuth app is trustworthy, it no longer counts a vendor's support-email domain against the app. Removing this means fewer legitimate apps get flagged.
***
### Expanded detection coverage
{% hint style="success" %}
New detection coverage rolls out continuously, independent of our release cycle. The items below are what's new since the previous release.
{% endhint %}
Material's built-in [email threat detections](https://docs.material.security/learn-more/risk-areas/email-threats/detect/) catch more real-world attacks, with no configuration required.
Material now automatically flags more attack types, including:
* Credential phishing that pairs a newly registered sender domain with a look-alike sender and suspicious language
* Open-redirect links that abuse Microsoft OAuth
* Callback phishing hidden in DocuSign comment fields
* Typosquatted, recently registered domains impersonating your [trusted senders](https://docs.material.security/getting-started/fundamentals/detect/trusted-entities)
* Fake PDF invoices sent from newly registered domains
***
### Apps and accounts
#### App risk at a glance in Blast Radius
The apps list in an account's Blast Radius panel now shows each app's classification and risk badge, so you can see which connected apps carry the most risk without leaving the panel.
Classification and risk badges in Blast Radius
#### Filter apps by when they first appeared
The apps list has a new **First seen** date-range filter, so you can focus on apps that first appeared in a window you choose, for example everything new in the past week.
***
### Issues and investigation
#### Message analysis opens by default
The [**Message analysis**](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details) section on an email threat issue now expands by default, so the detail and reasoning are in front of you as soon as you open the issue.
#### Triage custom message detections as Unknown
Custom message detections can now apply an **Unknown** classification, alongside Safe, Malicious, and Spam. This is useful when a detection should surface a message for review without asserting a verdict.
#### Issue Summary explains email threat issues in plain language
Every email threat issue now includes an [**Issue Summary**](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details)**:** an LLM-generated, plain-language explanation of why the message was flagged, so you can see the risk at a glance instead of piecing it together from the raw signals.
***
### Files
#### Scroll straight through file search results
File search results now load as you scroll, instead of moving through them one page at a time, so working through a large result set is smoother.
{% hint style="info" %}
Learn more about [file search](https://docs.material.security/getting-started/fundamentals/explore/file-search).
{% endhint %}
***
### Administration
* **Timeline preferences stick.** Your timeline sort order and date format now carry over across sessions and across the different pages that show a timeline, so you don't have to reset them each time.
* **Clearer acknowledgement emails.** The default end-user acknowledgement email templates have been reworded to be clearer.
***
## 🐛 Fixes
**Issues and investigation**
* The Issues list now updates right away when an issue's status changes to or from resolved, so what you see matches the issue's actual state.
* The **View on issues table** link from a detection's details works again, so you can jump straight from a detection to the issues it created.
**OAuth Apps**
* Account names on an app's detail view no longer disappear for accounts that don't have a display name.
**Remediation and account security**
* Material now recognizes a Gmail filter that quietly sends all incoming mail to Trash as a sign of account compromise, including filters built with a catch-all search that older detection missed.
* Revoking a user's Google sessions now works even when that account isn't a super admin.
* Restoring a deleted Outlook calendar event no longer creates duplicate copies of it.
**Platform and administration**
* Deep links, for example from a Slack notification, now survive SSO login on custom-domain instances instead of dropping you on the main dashboard.
* Large Google Drive file searches, such as filtering for files shared externally, now return quickly instead of timing out.
* Messages held by Email Bomb Protection are now findable via `message.status.is_surge` in Outlook.
* Re-adding a trusted sender with different capitalization now saves correctly, instead of silently doing nothing.
* CSV exports of message search results now handle true and false columns correctly.
* In ATO Resilience, you can remove a lock exception once its grace period has been cleared.
* Fixed a crash in Firefox and a related error-handling issue.
* Fixed a crash when switching tabs in areas that share a tabbed layout.
* UI polish: a consistent Spam badge color, a clearer **Unsaved** label in place of "Unstaged," and more consistent icon and accent colors.
***
## :books: New and Updated Documentation
**Updated**
* [Detected and similar messages](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details/detected-and-similar-messages): Explains that Auto Threat Hunt runs automatically for both Material-detected and user-reported messages, and how that differs from a user report.
* [Issue Details](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details): Clarifies the difference between sender reputation signals and the detection reasons that created an issue.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/whats-new/version-1.60.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.