Cloud Security Updates, AI Agent Governance, and Active Threats

Major cloud and platform providers advanced identity, connectivity, and data capabilities while publishing new guardrails for AI agents. Several AWS releases target centralized workforce access, exposure verification, and lower-latency networking at scale, with Microsoft and Google adding governance and runtime controls for agentic workloads. Separately, new research documents how autonomous tooling is changing both offensive operations and defensive workflows, and an exchange breach highlights the risks of overprivileged internal AI systems.

Identity, Authentication, and Exposure Management

AWS Account Access Manager introduces centralized workforce access without discarding account‑native IAM role flexibility. Administrators can assign existing per‑account roles to users and groups managed in IAM Identity Center, preserve custom trust policies, tags, and naming, and maintain user attribution in assumed‑role sessions via trusted identity propagation. The capability exposes distinct account‑access APIs and CloudTrail events and is operable through console, CLI, SDKs, and common IaC tools, enabling organizations to scale access governance while retaining IAM primitives.

Cognito SLA for the Plus feature plan now commits to 99.99% monthly uptime, an increase over the prior 99.9%. Essentials and Lite plans remain at 99.9%. Beyond availability, Plus includes adaptive authentication, compromised credentials detection, and enhanced logging and export, aligning higher resilience guarantees with threat‑protection features. Organizations can switch user pools to Plus via console, CLI, or SDKs.

Security Hub Network Scanning is now available in AWS GovCloud (US), actively probing public IPs, virtual machines, and load balancers to confirm internet reachability. The feature emits a finding per reachable port with evidence and is correlated by Security Hub Exposures with other findings and configurations. Existing customers can enable it at account, Region, or organization scope; it is on by default for new Security Hub customers and included with Security Hub Essentials at no additional cost.

Parameter Store adds 13 built‑in data types—covering formats such as aws:region, aws:account:id, boolean, integer, float, hostname, email, and IPv4/IPv6—to validate values on creation or update. Advanced parameters also gain url, json, and jsonc types. Validation applies to String, SecureString, and (for several types) StringList entries, and types can be combined with AllowedPattern for tighter constraints. The additions shift routine validation into the service, reducing runtime failures from malformed configuration.

SageMaker AI Studio now supports IAM Identity Center multi‑region replication, letting organizations keep a primary identity instance in one Region while deploying SageMaker AI Studio domains in others. This decouples identity from workload and data residency locations, easing compliance and sovereignty requirements across global operations without sacrificing centralized SSO and governance.

Network Path and Scale Efficiencies

AWS Interconnect – last mile expanded to a new Northern Virginia metro, providing managed, private connectivity that removes customer cross‑connect and router configuration steps. Each connection is provisioned across two physically diverse locations with four redundant links, backed by a 99.99% availability SLA to the Direct Connect port, and encrypts traffic with MACsec by default. Lumen offers generally available connections nationwide in the continental US, while Megaport and Equinix provide the metro in preview; customers can provision via console, CLI, or API.

Network Load Balancer is now available directly in the Phoenix Local Zone (us‑west‑2‑phx‑2a), eliminating previous back‑and‑forth traffic to the parent Region and stabilizing latency for local targets. The update benefits latency‑sensitive applications such as real‑time gaming, streaming, and live financial services and keeps routing within the Local Zone footprint.

FSx for Lustre Intelligent‑Tiering file systems now support up to 192,000 metadata IOPS—16× the previous 12,000—accelerating operations like create, list, read, and delete for metadata‑bound HPC and ML workloads. The higher limits, available for new Intelligent‑Tiering file systems in Regions that support the class, aim to shorten time‑to‑results while preserving the storage class’s elastic cost model.

Lambda durable functions increased default quotas substantially, raising running executions per account from 1 million to 5 million in most Regions and boosting key API request rates by 10× (with double these defaults in us‑east‑1, us‑west‑2, and eu‑west‑1). Higher limits make it easier to scale long‑running, checkpointed workflows and improve observability by allowing more frequent status checks, listings, and history reads without prior quota requests.

Managed AI Agents and Data Processing

Web Answer on Amazon Bedrock AgentCore is generally available, returning synthesized, cited answers to natural‑language questions via a single API call. The tool plans searches, runs parallel queries, and determines sufficiency of evidence, with domain allow/deny lists and publish‑date filters to constrain sources. It integrates over MCP with IAM authentication, advertises zero data egress for the integration, is initially available in US East (N. Virginia), and is billed per tool call.

BigQuery AI.AGG (preview) brings LLM‑powered semantic aggregation into SQL, orchestrating distributed batching, parallel Gemini inference, and recursive synthesis until a single summary per GROUP BY is produced. It supports images via Object Tables and OBJ.GET_ACCESS_URL and provides guidance on deterministic prompts, few‑shot anchoring, and cost control. Preview guardrails include a 10,000‑token output cap per group, 10 MiB payload limits, recommended fewer than 10 images per multimodal row, and suggested query scales up to 20 million rows and 1,000 groups.

Agent Substrate, gVisor, and OpenRL were donated to the CNCF Sandbox, with Agent Substrate reaching 1.0 and general availability on GKE. The stack separates agent state from compute, snapshots idle agents and restores them in under 500 ms for higher density, provides userspace‑kernel isolation for untrusted code, and offers a Kubernetes‑native RL loop. Donation aims to establish neutral governance and invite contributions across vendors while enabling secure, efficient scaling of autonomous agents.

Microsoft Security updates introduce agent governance features (Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access), make Microsoft Execution Containers generally available for OS‑enforced containment, and expand Defender capabilities, including consolidated MDR expert experiences and discovery of over 50 local AI agents across Windows and macOS. An enhanced Defender for SQL Servers agent is GA for Azure Government with resource‑ and subscription‑level enablement, and new guidance ties threat observations to prioritized security initiatives.

On‑Premises Security investments target server workloads with a validated Baseline Security Mode for Exchange, SharePoint, and Skype for Business, faster out‑of‑cycle fixes, and planned automatic update application in connected environments in Q1 2027. Microsoft is expanding Emergency Mitigation Service (EM S 2.0) defaults for Exchange and Skype for Business in December 2026 and for SharePoint in January 2027, and will add hardened defaults with drift detection in Q1 2027.

Offensive AI, Autonomy, and a Major Breach

OpenAI Pipeline research details an autonomous system that discovered, validated, and exploited Linux kernel vulnerabilities, generating 948 working local privilege‑escalation exploits in one campaign at an estimated $1,213,430 in API cost (about $1,279 per exploit). The effort included candidate patch generation with human review and strengthened validation after early misattribution issues. Experts cited in the report recommend prioritizing remediation on multi‑tenant hosts, CI/CD runners, shared bastions, container platforms, and developer fleets while tracking backports as fixes propagate.

ARTEX Report from Check Point Research describes semi‑ and fully autonomous AI agents conducting reconnaissance, exploitation, and validation across thousands of exposed panels, with operators often setting high‑level objectives and letting agent fleets run. Campaigns targeted cryptocurrency services, gambling, payment infrastructure, and gray‑market iOS signing, exploiting issues from missing authentication to RCE. Agents selected models based on capability and cost, with guardrails observed only in one model before operators switched to permissive alternatives, and one documented case progressed to a supply‑chain compromise via exposed cloud credentials.

Binance Heist reporting outlines a multi‑stage compromise that used malware on developer workstations and an overprivileged internal AI tool to reach wallet infrastructure, resulting in approximately $6.34 billion stolen. The attackers compromised two engineers months apart, pivoted through the AI tool, leveraged a long‑lived deployment token, and deployed a container that interacted with the signing service. The incident underscores governance and control requirements for internal AI agents, the need for strict workstation and credential hygiene, and procedural safeguards for production actions.