What changed
FastGPT 4.16 moved sandboxes to app-and-user scope with separate session directories, added expiring read-only preview links, encrypted system-tool keys, cold-archived audit logs to S3, and fixed path traversal, session authorization, and possible API-key or internal-configuration exposure.
Why it matters
The release materially changes execution isolation, credential protection, retained evidence, preview exposure, and upgrade safety in a runnable open-source agent platform.
What to do
Dry-run every migration, deploy matched component images, separate the preview origin, then verify resource and network limits, key encryption, audit archives, and rollback.
Caveat
FastGPT warns that same-origin previews expose authenticated credentials and APIs; the release does not enforce a separate origin automatically. Mixed-version deployments are also unsupported.