AI Agent Governance, Cloud Controls, and Active Exploits

Enterprises saw new guardrails for autonomous software and control planes as Microsoft introduced an open-source runtime layer for agent safety with its Agent Governance Toolkit, while Anthropic detailed restricted, defender-focused use of a frontier model under Project Glasswing to find and fix software flaws. Major cloud platforms added scheduling, storage, and data interoperability features aimed at AI/ML reliability and performance. In parallel, critical vulnerabilities affecting web plugins, AI workflow builders, and enterprise middleware drew urgent patch guidance, and state-linked operations underscored the risks from SOHO router compromise to industrial controller disruption.

Runtime governance and control planes

Microsoft’s runtime-focused Agent Governance Toolkit targets the OWASP top risks for agentic systems by adding policy enforcement, identity, and execution controls across heterogeneous stacks. The suite is framework-agnostic and borrows mature patterns from operating systems and service meshes to isolate components and control tool access. If adopted with disciplined operations, it can improve visibility and reduce common failure modes for autonomous workflows.

AWS broadened browser-automation fidelity for AI agents and testing tools with OS-level interaction in AgentCore Browser, enabling native mouse, keyboard, and system dialog handling beyond the Chrome DevTools Protocol. The added capabilities expand what vision-based and end-to-end workflows can reliably accomplish, but they also heighten the need for tight permissions, logging, and input-simulation governance.

Anthropic’s restricted-release Glasswing effort positions a preview model to assist vetted partners in proactively finding and remediating vulnerabilities at scale. The company describes thousands of previously unknown issues identified across major platforms, coupled with credits and donations to accelerate coordinated fixes. The dual-use risk is explicit in the summary: improvements in automated patching also raise the ceiling for automated exploitation, reinforcing the need for strict access control and community governance.

Kaspersky emphasized the importance of management-layer security with a hardened, secure-by-default stance in its latest console release and a step-by-step hardening reference. The Kaspersky guide details enforced two-factor authentication, privilege reviews, API protections, stronger encryption, and auditing to prevent adversaries from abusing centralized controls to silence alerts or push malicious configurations.

Cloud AI/ML operations and data platforms

For distributed training on EKS, AWS added gang scheduling to HyperPod, ensuring multi-pod jobs only start when all components are ready, with configurable timeouts and retry/backoff policies to avoid deadlocks and waste. On Google Cloud, GKE FUSE Profiles automate cache sizing and media choices for AI/ML workloads, reducing tuning errors and improving reliability for training, serving, and checkpointing. AWS also introduced WorkSpaces Advisor to analyze desktop fleet signals with generative AI and surface prioritized remediations to cut investigation time and improve end-user experience.

Data-platform openness and performance continued to converge. Google previewed bidirectional interoperability between BigQuery and Apache Iceberg engines via a managed REST catalog, bringing unified governance and performance features to multi-engine lakehouses; see BigQuery Iceberg for details. On AWS, OpenSearch i8ge instances powered by Graviton4 target storage-heavy workloads with lower latency variability and higher throughput, while Database@AWS expanded to twelve Regions to support in-region Oracle Exadata/RAC deployments operated through AWS facilities.

For incident responders, AWS Security published a reference design for collecting forensic artifacts into S3 with temporary credentials, least privilege, strong encryption, object-lock protections, and end-to-end auditing. The post includes CDK stacks and an automated workflow to vend scoped credentials and orchestrate collection; see the AWS framework for implementation details.

Advisories and patching under pressure

A critical file-upload flaw in the Ninja Forms – File Upload Plugin for WordPress (up to 3.3.26) enables unauthenticated arbitrary file uploads leading to remote code execution and full site takeover. The developer issued a complete patch in 3.3.27; users should update immediately and review servers for webshells or suspicious artifacts; coverage via Ninja Forms.

Threat actors are actively exploiting a code-injection issue in Flowise, a platform for building LLM and agent workflows. Tracked as CVE-2025-59528, it allows remote code execution via improper handling of untrusted MCP configurations; patches landed in v3.0.6 with the latest at v3.1.1. Organizations should inventory exposed instances and update promptly; see Flowise CVE. Separately, a 13-year-old remote code execution path in Apache ActiveMQ Classic (CVE-2026-34197) was fixed in 5.19.4 and 6.2.3; restrict Jolokia and apply patches now; details via ActiveMQ RCE. And CISA ordered federal agencies to remediate an exploited Ivanti Endpoint Manager Mobile code-injection flaw (CVE-2026-1340) by April 11 or discontinue affected systems; see Ivanti EPMM. The common thread is straightforward remote execution on internet-exposed services, which reduces attacker dwell time between discovery and impact.

State-linked operations and disruption

Microsoft attributed large-scale DNS hijacking and TLS man-in-the-middle activity to the Russian-aligned group Forest Blizzard (APT28), which compromised SOHO routers to redirect selected targets to malicious endpoints and harvest Outlook web sessions. The campaign spanned thousands of consumer devices and hundreds of organizations across sensitive sectors; see Forest Blizzard. In a related enforcement move, the DOJ and FBI’s Operation Masquerade removed attacker DNS resolvers from compromised routers and restored legitimate settings under court authorization; details via Operation Masquerade. Trend Micro also reported a sustained spear-phishing campaign by APT28 using a novel PRISMEX malware set with steganography, DLL hijacking, and cloud storage for C2, aimed at Ukrainian organizations and NATO partners; see PRISMEX. Together, these reports highlight the group’s use of commodity infrastructure and rapid exploit weaponization to blend espionage and disruptive potential.

Separately, US agencies linked an Iranian-affiliated actor to manipulations of internet-exposed Rockwell Automation and Allen‑Bradley PLCs across multiple critical infrastructure sectors, altering displays and installing remote access tools at municipal and other facilities. Agencies urged immediate segmentation, strict access mediation, monitoring of OT ports, and placement of controllers in run mode where applicable to block remote changes; see PLC attacks. The operational takeaway is clear: exposed edge devices—whether home routers or legacy controllers—remain efficient entry points for credential theft and service disruption.