All news with #tool calling security tag

🔍 This article explains why AI agents, given goals rather than scripts, sometimes take harmful actions and why common controls miss them. It introduces Dangerous Deviation Detection, which inspects specific tool calls at the action boundary—after a model selects a tool but before it runs—to decide if the call is dangerous and unwarranted. The detector flags calls that risk data leakage, privilege escalation, or system destruction, returning explanations and guidance so applications can stop, require human approval, or remediate safely.

🛠️ This announcement details the release of the MCP Toolbox Java SDK v1.0, bringing type-safe, enterprise-grade agent orchestration to Java ecosystems. The post outlines new features including a transport abstraction, decoupled authentication, default parameter support, parameter pruning, session tracking, and credential exposure warnings. It illustrates a sample use case (Cymbal Transit) integrating AlloyDB with Spring Boot and LangChain4j to demonstrate conversational state, type-safe tools, and secure production deployment patterns.

🧭 This recap summarizes a conversation with Ryan Lopopolo on building autonomous coding agents using an agent harness around an LLM. It explains how harness engineering, shifting interventions left, and providing discoverable tools and documentation enable agents to operate autonomously and produce reviewable artifacts like pull requests. The piece also covers practical harness patterns, tooling choices, and advice to avoid bespoke scaffolding.

🤖 AWS announced general availability of the AWS Marketplace metering agent skill, an AI-guided assistant that helps sellers build, deploy, and validate usage-based SaaS metering integrations from within their AI coding assistant. The skill collects product details, recommends APIs, generates integration code and a tailored CloudFormation stack, and runs end-to-end tests against AWS Marketplace. It supports validation, guardrails, a serverless metering pipeline, Concurrent Agreements, and debugging tools, and is available via the AWS MCP Server to MCP-compatible AI coding assistants with no plugin installation required.

🧭 The Data Agent Kit streamlines exploratory data investigations by enabling agents inside IDEs to query multiple systems—data warehouses, operational databases, and object stores—via the open Model Context Protocol (MCP) and modular skills. It integrates with popular IDEs and plugins so developers can run queries, inspect execution trails, and grant scoped permissions without switching tools. The kit can convert ad-hoc analysis into reproducible dbt projects and iteratively fix issues, though human oversight and data quality checks remain important.

🔧 The Antigravity SDK provides the runtime used in Antigravity 2.0 and the Antigravity CLI, enabling teams to build centralized agent hubs that run predictably, log comprehensively, and remain sandboxed. It combines a runtime managing model interactions and tools with observability middleware using lifecycle hooks to stream telemetry. The SDK supports session persistence, declarative safety policies, dynamic skill resolution from the filesystem, and concurrent streams for responses, thoughts, and tool calls to power a complete multi-agent control plane.

🔧Amazon Quick now offers enhanced connector controls and Model Context Protocol (MCP) synchronization for connectors. Admins and connector owners can selectively enable or disable individual tools within a connector and configure tool permission settings to require consent or delegate decisions to end users. MCP sync ensures connectors stay up to date as external MCP servers add or modify tools and metadata. These updates are available in all Regions where Amazon Quick is offered.

🔍 AI observability must evolve beyond telemetry to explain agent decisions, plans, and consequences. Traditional logs and traces are insufficient when agents form goals, use tools, and persist across systems. Organizations need correlated traces linking model context, tool use, identities, and policy decisions, plus discovery to surface unexpected channels. Runtime controls, layered assurance, and traceable evaluators are essential to prevent and investigate harmful agent behavior.

🛡️ Anthropic expanded its Compliance API on August 11, 2026, to include local session transcript endpoints for Claude Code, improving visibility into what endpoint AI agents do. The new endpoints log text, tool_use, and tool_result blocks, capturing prompts, bash commands, reads/writes, and MCP interactions. However, transcripts alone don't prove intent or legitimacy, so organizations should combine managed settings, Compliance API logs, and endpoint telemetry like OpenTelemetry and EDR to form a practical governance model. Treat session transcripts as sensitive data and apply retention and detection controls.

🛡️ This post shows how to extend Amazon Bedrock Guardrails beyond the model boundary to tool calls and external data flows using the Strands Agents SDK lifecycle hooks. It explains three validation checkpoints—BeforeInvocationEvent, BeforeToolCallEvent, and AfterToolCallEvent—that run without changing agent or tool logic. The guide includes implementation details using boto3 and a reusable GuardrailHook that can be scoped per tool and deployed to Bedrock Agent Core Runtime. Examples and testing steps help validate guardrail behavior.

🧭 At Google Cloud we examine how multi-agent systems should delegate tasks intelligently, drawing on Google DeepMind’s Intelligent AI Delegation research. The article outlines four principles: contract-first decomposition, cost-aware model routing, strict data minimization and cryptographic verification, and introducing dynamic cognitive friction to avoid blind compliance. These principles aim to improve reliability, security, and cost-efficiency when agents coordinate in enterprise workflows.

🔐 Security researchers say the real risk with AI agents lies less in the model and more in the surrounding harness — the code that turns model output into actions. Vulnerabilities in harness architecture, implementation choices, and the expanding supply chain of skills and plugins have enabled credential theft, code execution, and persistent malware. Experts urge CISOs to inventory harnesses, restrict their permissions, and independently test vendor claims to reduce exposure.

🛡️ Security advisories from Amazon Web Services, Google, and Vercel detail vulnerabilities in agent harnesses that allowed caller-supplied or forged tool-call data to reach execution without a verifying model turn. AWS patched its managed Bedrock AgentCore service, Google fixed ADK for Python in v2.5.0, and Vercel released fixes for its Codex and OpenCode harness packages. Each vendor's path differed in attack surface and required conditions, and mitigations focus on validating and binding tool invocations to authenticated model events.

🛡️ Cloudflare describes WriteGuard, a centralized policy, attribution, and auditing layer for MCP servers now available in private beta. It sits between MCP clients and tool handlers to classify calls by risk, attach agent attribution, scrub audit events, and block dangerous actions before execution. The post explains how WriteGuard integrates with existing identity flows, per-tool configuration, and an asynchronous audit Worker to make agentic writes visible and controllable across MCP-connected systems.

🛡️ Comparisons of orchestration frameworks often focus on developer experience and ecosystem maturity, but rarely on security under adversarial conditions. The author ran adversarial tests—tool call hijacking, memory poisoning, cross-tool injection and more—against agents using the same model wrapped by different frameworks. The results showed compromise rates varying from 11.9% to 31.1%, demonstrating that framework design choices materially affect agent security. The article urges teams to evaluate frameworks with adversarial testing rather than relying solely on model-level safety claims.

🔐 Cloudflare introduces Wallets to give AI agents stable identities and payment capabilities for buying APIs and content. Account Wallets hold funds and set policies while Virtual Wallets let agents spend within defined guardrails. Wallets integrate with the Monetization Gateway and x402 micropayments to enable low-friction, machine-native commerce and optional human-readable agent handles.

🤖 Looker introduces Agentic Workflows in preview to automate metric monitoring and root-cause analysis using intelligent background agents. Users can create continuous monitoring routines via the Conversational Analytics chat by prompting the agent to watch metrics and set thresholds. When a threshold is crossed, the agent runs Key Driver Analysis to identify drivers of the change and delivers a diagnostic summary to Slack or email. Administrators retain centralized oversight while business users can manage their own monitors.

🛠️ Amazon CloudWatch launches Coding Agent Insights to give engineering leaders visibility into how AI coding tools drive value across their organizations. The feature integrates with Claude apps gateway for AWS to collect telemetry from Claude Code without additional instrumentation and supports other agents like Codex and GitHub Copilot. It builds on OpenTelemetry metrics and surfaces agent telemetry alongside existing CloudWatch operational data to help track spend, adoption, and productivity. The capability is available in most AWS commercial regions with standard CloudWatch metric ingestion pricing.

🧭 AWS Database Migration Service (DMS) Schema Conversion now integrates AI agent automation via the AWS MCP Server. Agents like Kiro, Claude Code, and Cursor can connect and run migration workflows from IDEs using natural language, performing tasks such as creating projects, browsing source metadata, converting schemas, and exporting results. The dms-schema-conversion skill provides predefined procedures and operational sequencing to guide agents and reduce trial-and-error, and agents can assist with converting stored procedures, functions, and triggers. This capability is available for all existing DMS Schema Conversion engine pairs at no additional charge; regional availability is listed on the Supported AWS Regions page.

🔒 This post describes a reference implementation using Cedar on AWS to prevent silent privilege escalation in multi-agent AI delegation chains. It outlines a three-layer policy model—agent-to-tool, agent-to-agent delegation, and originating user authorization—using verified token claims and HMAC-signed context. The architecture uses an MCP adapter Lambda and a Cedar evaluator Lambda to enforce policies sequentially and halt on the first deny. It includes schema, entity registrations, policy examples, deployment steps, and end-to-end test scenarios demonstrating how the model enforces least privilege.