Release Notes

October 27, 2026

Rules for programs installed by the Nix package manager now keep matching after a package update.
The Control Center now shows the menu of a widget and the actions of a listing entry on right-click.
You can now move the connection alert by dragging at the process name. The process menu opens when you release the mouse button.
Various small improvements in the Network Monitor, for example thousands separators in the counts of the connection log and inspector headers.

Fixed an agent restart loop after an update that was installed while no user was logged in. Little Snitch now opens the installer to complete the update.
Fixed temporary rules created in the Control Center having no effect on system processes.
Fixed duplicate rules appearing after editing a rule created by the Control Center.
Fixed Google Chrome sometimes appearing twice in the Control Center, with a temporary rule timer shown on only one of the entries.
Fixed animation glitches in the traffic chart of the Control Center on macOS 15 when hovering the network activity list with the mouse.
Various fixes in the connection alert.
Various other bug fixes and improvements under the hood.

October 20, 2026

The Control Center replaces the status menu of earlier versions. It was redesigned and rewritten from the ground up and is now fully interactive.
New quick controls provide convenient access to Silent Mode, the active profile, and other settings.
Connections in the “Recently Denied” list can now be allowed temporarily right away, for example to fix a stalled download.
Likewise, processes in the list of recent network activity can now be denied temporarily, for example to stop suspicious traffic until its cause is found.
The traffic chart, showing the network activity over time, is now interactive. Moving the cursor over the chart shows the activity at that point in time.
A customizable set of widgets provides real-time status information, such as the current traffic rates, as well as statistics for the last 24 hours, such as the total traffic volume, the number of blocked or denied connections, or the number of encrypted DNS lookups. Widgets can be added, removed, resized, and arranged in any order.
The Control Center can be detached from the menu bar and kept visible as a separate window, even floating above other windows.
A system-wide hotkey for opening the Control Center can be configured in Settings > Control Center.

Network Monitor has a new connection log view. It provides a chronological, timestamped list of all network connections.
The log lets you watch the connection activity of your entire Mac or just a single app in real time.
The log shows only the connections related to those currently displayed or selected in the connection list. This quickly narrows thousands of entries down to the connections of a certain type, of a specific process, or to a specific domain or country.
Connections can be quickly denied or re-allowed from the connection log’s context menu.

The new Research Assistant in the connection alert can help you figure out the purpose of unfamiliar connections. When a connection alert pops up, you can ask the assistant to provide background information about the connecting process, why it likely wants to connect to a particular server, and what might happen if the connection were denied. This can help you decide whether to allow or deny it.
The assistant never runs automatically. It only acts on your explicit request, when you ask it to learn more about a particular connection.
Requests are sent to a server operated by Objective Development in the EU. If the server doesn’t yet have the requested information available, it researches the connection using an external AI service provider (currently Anthropic), which never learns who is asking.
Only technical details of the connection are sent: the process name and its code signature identifiers, the server it wants to reach, and basic connection details such as the port. No file paths, user names, license keys, or device identifiers are included.
You can review the connection details before they are sent.

With page focus enabled in the traffic chart, the connection list now stays in sync with the chart and shows only the connections of the time range currently shown.
Each page of the traffic chart now shows the time range it covers.

Connections that were blocked by a blocklist are now indicated with a blocklist icon in the connection list. Clicking that icon opens a menu to access and modify the corresponding blocklist entry.
Selecting a row in the connection list now shows a focus icon. A single click on it narrows Network Monitor down to that process, domain, hostname, IP address, or country.
The context menu of the connection list was improved. For example, it now allows copying the name or path of a process, a hostname, a domain, or an IP address.
Temporary rules can now be created from the context menu, allowing or denying connections for 5 minutes or until logout.
A new view option lets you hide traffic from network extensions in the connection list.

A new “Rules” section in the inspector now provides immediate access to the rules that apply to a selected connection in the connection list.
Rules can be modified right from the Rules section: they can be edited, disabled, given a higher priority, or deleted.

The connection alert now provides access to the new Research Assistant (see above).
When several connection attempts are waiting for an answer, the button next to “Deny…” shows how many, for example “+2”. Its menu lists the pending connection attempts, so they can be answered in any order.
Clicking the process name opens a menu with actions for the process: showing its rules, showing it in Network Monitor or in Finder, activating the app, copying its name, or quitting the app (or killing the process).
When a connection alert is left unanswered for a while, it now tells when the connection attempt was made, for example “5 minutes ago” or “yesterday at 10:19”.

It’s now possible to specify a secondary DNS resolver that will be used automatically as a fallback when the primary resolver cannot be reached.
The list of DNS providers now shows each provider’s country of jurisdiction.
New metrics show the success and failure rates of each DNS resolver.
A detailed log now helps troubleshoot DNS resolution issues.

Much larger blocklists are now supported.
Improved presentation of blocklist entries, showing usage information (last used date, usage count) next to each entry.
Much improved performance when analyzing a rule set to find out which rules are redundant.
Improved rule search that delivers better results when searching for a particular rule.
Rules that have been exported to an .lsrules file can now be imported using the new File > Import Rules command.
The rule inspector now explains why a rule is currently inactive (shown dimmed), for example because it’s disabled or belongs to a profile that’s currently inactive.
The rule inspector also explains why a rule cannot be edited (disabled, modified, or deleted), for example because the rule set is locked or the rule is protected for some other reason.
A new Uninstall Little Snitch command in the Help menu of the Little Snitch app lets you perform a complete uninstall, optionally also deleting all related user data such as rules, traffic history, and settings.
Improved overall UI performance.

Little Snitch 7 now has a new, redesigned app icon.
The entire user interface has been modernized to match the Liquid Glass design language of macOS 26 and later.