Cloud and AI Security: New Agent Tools, Perimeters, and IPv6

Cloud and platform providers rolled out a dense set of updates that strengthen AI agent orchestration, tighten network and data perimeters, and extend core infrastructure primitives for precision, reliability, and compliance. Several launches focus on making secure-by-default architectures easier to deploy across regions and sovereign environments, while new end‑user protections address social‑engineering risks on mobile. Below is a structured brief of the most material changes for security and platform teams.

Agent Platforms and Orchestration Move Forward

Amazon expanded Web Search for agents built on AWS Bedrock AgentCore to US East (Ohio), US West (Oregon), Asia Pacific (Sydney), and AWS GovCloud (US‑West). The fully managed tool provides current web grounding for agent responses, reducing latency by keeping retrieval closer to users and allowing regulated workloads in GovCloud to meet compliance and data‑residency requirements.

Google introduced the Gemini agent as a persistent coworker for startups in a Google blog, emphasizing continuous memory, sub‑agent orchestration, and native integrations with Workspace and developer/data tools. The platform separates orchestration from the model layer so teams can route tasks to frontier, third‑party, or lightweight open models, with built‑in security, policy enforcement, and hard real‑time billing caps.

AWS made the AWS Lambda Durable Execution SDK for Go generally available, enabling resilient long‑running workflows with automatic checkpointing, year‑long waits for external events or approvals, durable function chaining, and native testing and linting tools to catch resume‑time pitfalls.

Meta’s coding‑optimized Muse Spark Open is now in SageMaker JumpStart, with deployment options detailed in the JumpStart model listing. The Mixture‑of‑Experts design (816B total, 42B active) offers a 1M‑token context and multimodal support, and arrives in BF16 and NVFP4 variants to balance performance and memory footprint for agentic coding and long‑horizon developer workflows.

Temporal Cloud introduced a preview that runs managed workers as Cloud Run worker pools, described in a Google Cloud post. Temporal monitors queue latency to drive autoscaling, keeps spare capacity to smooth spikes, and uses Worker Versioning so in‑flight workflows finish on the original binary while new executions roll to updated builds.

Google detailed a preview integration that connects Gemini to its borderless Lakehouse in a Google Cloud update. Agents and users can query distributed data across clouds and SaaS without copying, with GA features including cross‑cloud interconnect and caching, Iceberg V3 support, managed Spark interoperability, catalog federation, and metadata unification aimed at improving grounding accuracy and controlling token costs.

Perimeters, Gateways, and Data Governance

Cloudflare introduced a fully programmable secure web gateway by embedding Workers into Gateway and DLP policy evaluation, as outlined in the Cloudflare blog. A Forward action can proxy matched HTTP requests to a Worker for inline transformation, while Custom Functions return typed values usable as selectors. The design keeps compute co‑located with policy enforcement to minimize latency; Forward is in public beta and Custom Functions are planned for GA later in the year.

Google Cloud modernized perimeter operations for VPC‑SC, adding folder‑level membership and Dry‑Run testing, richer ingress/egress rule references (folders, organizations, PSC endpoints, service URL patterns), and optional org‑restriction headers on egress. A Guided Violation Remediation feature analyzes blocked requests and proposes scoped policy updates that can be validated in Dry‑Run before enforcement.

AWS enabled end‑to‑end IPv6 for private origins by adding dual‑stack support for VPC origins in CloudFront update. Application and Network Load Balancers and EC2 origins can remain private while receiving IPv6 traffic directly from CloudFront, removing the need to expose origins or maintain IPv4‑only backends.

Amazon extended Amazon MSK Connect and AWS Glue Schema Registry to the AWS European Sovereign Cloud (Germany), giving Kafka users managed connectors and centralized schema governance within that jurisdiction, per the Amazon MSK announcement.

HealthOmics now supports cross‑account shared VPCs via AWS RAM, placing each account’s workflows into centrally managed subnets and security groups. This removes the need for duplicative PrivateLink endpoints, peering, and route tables, simplifying private data access and network control in multi‑account bioinformatics environments.

Amazon Redshift expanded long‑term system table retention by storing system tables as Iceberg‑format Amazon S3 Tables, as described in the Amazon Redshift update. AWS manages partitioning, compaction, and lifecycle, enabling compliance and observability use cases while allowing queries from Redshift, Athena, DuckDB, and other Iceberg‑compatible engines.

Time, Compute, and Reliability Building Blocks

AWS expanded microsecond‑accurate time via the Amazon Time Sync Service to 135 additional EC2 instance types in all commercial regions, according to the Time Sync release. By launching instances in a Precision Time Placement Group, customers can access a hardware PTP clock with nanosecond‑precision timestamps, and optionally pair it with Cluster Placement Groups for low‑latency, tightly synchronized distributed workloads.

The EC2 T8i burstable family reached South America (São Paulo), as noted in the EC2 T8i announcement. Built on Intel Xeon 6 and the latest Nitro cards, T8i offers up to 30% better price performance over T3 and targets low‑to‑moderate CPU workloads while preserving the familiar CPU credit model and Free Tier options for selected sizes.

Amazon added timestamp‑based stream consumption to DynamoDB Streams via the AT_TIMESTAMP iterator. The feature integrates with the Kinesis Client Library adapter to resume precisely without reprocessing the full retention window, supporting recovery, targeted replay, backlog skipping, and synchronization after PITR exports across all AWS Regions, including GovCloud and China.

AWS updated its Windows modernization program so customers can deploy converted Aurora PostgreSQL clusters cross‑region in seven more geographies, per the AWS Transform note. The workflow converts SQL Server DDL and updates .NET data access to be PostgreSQL‑compatible while allowing the database to land in a different region to support data residency, latency, and disaster recovery objectives.

End‑User Protections and Discovery Signals

Google rolled out AI‑assisted defenses for messaging and call scams on Android, reported by BleepingComputer. Cloud‑based analysis for unknown senders in Google Messages is opt‑in, while on‑device checks warn on unfamiliar links; Android and Chrome/WebView now mask sensitive fields during screen sharing, block silent call‑forwarding attempts, and expand verified‑bank call protections to more institutions.

Cloudflare and OpenAI ran a 1%‑scale research pilot to improve AI‑driven discovery, as described in the Cloudflare blog. Signals from Cloudflare’s network helped OpenAI find and index hundreds of millions of previously unknown pages, reduce wasted crawling, and flag potentially harmful or compromised pages at the URL level, with controls preserved for domain owners and no use of these signals as training data.