All news with #tool calling security tag

🛡️ Anthropic expanded its Compliance API on August 11, 2026, to include local session transcript endpoints for Claude Code, improving visibility into what endpoint AI agents do. The new endpoints log text, tool_use, and tool_result blocks, capturing prompts, bash commands, reads/writes, and MCP interactions. However, transcripts alone don't prove intent or legitimacy, so organizations should combine managed settings, Compliance API logs, and endpoint telemetry like OpenTelemetry and EDR to form a practical governance model. Treat session transcripts as sensitive data and apply retention and detection controls.

🛡️ This post shows how to extend Amazon Bedrock Guardrails beyond the model boundary to tool calls and external data flows using the Strands Agents SDK lifecycle hooks. It explains three validation checkpoints—BeforeInvocationEvent, BeforeToolCallEvent, and AfterToolCallEvent—that run without changing agent or tool logic. The guide includes implementation details using boto3 and a reusable GuardrailHook that can be scoped per tool and deployed to Bedrock Agent Core Runtime. Examples and testing steps help validate guardrail behavior.

🧭 At Google Cloud we examine how multi-agent systems should delegate tasks intelligently, drawing on Google DeepMind’s Intelligent AI Delegation research. The article outlines four principles: contract-first decomposition, cost-aware model routing, strict data minimization and cryptographic verification, and introducing dynamic cognitive friction to avoid blind compliance. These principles aim to improve reliability, security, and cost-efficiency when agents coordinate in enterprise workflows.

🔐 Security researchers say the real risk with AI agents lies less in the model and more in the surrounding harness — the code that turns model output into actions. Vulnerabilities in harness architecture, implementation choices, and the expanding supply chain of skills and plugins have enabled credential theft, code execution, and persistent malware. Experts urge CISOs to inventory harnesses, restrict their permissions, and independently test vendor claims to reduce exposure.

🛡️ Security advisories from Amazon Web Services, Google, and Vercel detail vulnerabilities in agent harnesses that allowed caller-supplied or forged tool-call data to reach execution without a verifying model turn. AWS patched its managed Bedrock AgentCore service, Google fixed ADK for Python in v2.5.0, and Vercel released fixes for its Codex and OpenCode harness packages. Each vendor's path differed in attack surface and required conditions, and mitigations focus on validating and binding tool invocations to authenticated model events.

🛡️ Cloudflare describes WriteGuard, a centralized policy, attribution, and auditing layer for MCP servers now available in private beta. It sits between MCP clients and tool handlers to classify calls by risk, attach agent attribution, scrub audit events, and block dangerous actions before execution. The post explains how WriteGuard integrates with existing identity flows, per-tool configuration, and an asynchronous audit Worker to make agentic writes visible and controllable across MCP-connected systems.

🛡️ Comparisons of orchestration frameworks often focus on developer experience and ecosystem maturity, but rarely on security under adversarial conditions. The author ran adversarial tests—tool call hijacking, memory poisoning, cross-tool injection and more—against agents using the same model wrapped by different frameworks. The results showed compromise rates varying from 11.9% to 31.1%, demonstrating that framework design choices materially affect agent security. The article urges teams to evaluate frameworks with adversarial testing rather than relying solely on model-level safety claims.

🔐 Cloudflare introduces Wallets to give AI agents stable identities and payment capabilities for buying APIs and content. Account Wallets hold funds and set policies while Virtual Wallets let agents spend within defined guardrails. Wallets integrate with the Monetization Gateway and x402 micropayments to enable low-friction, machine-native commerce and optional human-readable agent handles.

🤖 Looker introduces Agentic Workflows in preview to automate metric monitoring and root-cause analysis using intelligent background agents. Users can create continuous monitoring routines via the Conversational Analytics chat by prompting the agent to watch metrics and set thresholds. When a threshold is crossed, the agent runs Key Driver Analysis to identify drivers of the change and delivers a diagnostic summary to Slack or email. Administrators retain centralized oversight while business users can manage their own monitors.

🛠️ Amazon CloudWatch launches Coding Agent Insights to give engineering leaders visibility into how AI coding tools drive value across their organizations. The feature integrates with Claude apps gateway for AWS to collect telemetry from Claude Code without additional instrumentation and supports other agents like Codex and GitHub Copilot. It builds on OpenTelemetry metrics and surfaces agent telemetry alongside existing CloudWatch operational data to help track spend, adoption, and productivity. The capability is available in most AWS commercial regions with standard CloudWatch metric ingestion pricing.

🧭 AWS Database Migration Service (DMS) Schema Conversion now integrates AI agent automation via the AWS MCP Server. Agents like Kiro, Claude Code, and Cursor can connect and run migration workflows from IDEs using natural language, performing tasks such as creating projects, browsing source metadata, converting schemas, and exporting results. The dms-schema-conversion skill provides predefined procedures and operational sequencing to guide agents and reduce trial-and-error, and agents can assist with converting stored procedures, functions, and triggers. This capability is available for all existing DMS Schema Conversion engine pairs at no additional charge; regional availability is listed on the Supported AWS Regions page.

🔒 This post describes a reference implementation using Cedar on AWS to prevent silent privilege escalation in multi-agent AI delegation chains. It outlines a three-layer policy model—agent-to-tool, agent-to-agent delegation, and originating user authorization—using verified token claims and HMAC-signed context. The architecture uses an MCP adapter Lambda and a Cedar evaluator Lambda to enforce policies sequentially and halt on the first deny. It includes schema, entity registrations, policy examples, deployment steps, and end-to-end test scenarios demonstrating how the model enforces least privilege.

🔒 AWS Secrets Manager introduces a secret safety skill in the aws-core plugin for the Agent Toolkit for AWS, enabling AI coding agents to use secrets without exposing values to models or session logs. The skill prevents models from requesting raw secret values and prompts developers to clarify intent while constructing commands that reference secrets. A child process resolves secret references at execution time, keeping plaintext secrets out of agent context and logs. The feature is available across supported agent harnesses and Regions where Secrets Manager is offered.

🔎 Amazon Bedrock AgentCore now offers Web Search generally available in US East (N. Virginia). The fully managed tool provides agents with current web knowledge, combining an Amazon-operated web index and structured knowledge graph data to return high-value excerpts, entity data, and verified facts. Web Search integrates with AgentCore via the Model Context Protocol (MCP) and keeps data residency within your secured AWS environment with zero data egress.

🚀 Today Google Cloud announced that Gemini 3.1 Flash-Lite is generally available on Gemini Enterprise. Built for ultra-low latency, high-volume workloads, and maximal cost-efficiency, Flash-Lite is positioned for production deployments that require fast, iterative responses and precise agentic capabilities such as tool calling and orchestration. Early adopters report significant reductions in latency and operating cost while retaining robust reasoning for developer assistants, customer service agents, and multimodal creative pipelines.

💳 Amazon Bedrock AgentCore now offers a preview of AgentCore payments, enabling AI agents to autonomously discover and pay for APIs, MCP servers, web content, and other agents. Built with Coinbase and Stripe, the feature manages wallet authentication, x402 protocol negotiation, stablecoin payment execution, and proof delivery without interrupting an agent's reasoning loop. Developers can attach a Coinbase CDP or Stripe Privy wallet, set session-level spending limits enforced at the infrastructure layer, and observe every transaction through AgentCore's existing logs, metrics, and traces. The Coinbase x402 Bazaar MCP server is accessible via AgentCore Gateway, and the preview is available in four AWS Regions.

🔎 Cloudflare has renamed Browser Rendering to Browser Run and expanded it into a remote browser platform tailored for AI agents. It runs full Chrome sessions across Cloudflare’s global network and can be driven by code or AI using Puppeteer, Playwright, Quick Actions, direct CDP access, or MCP/WebMCP. New features include Live View for real-time inspection, Human-in-the-Loop handoffs for operator intervention, a CDP endpoint for low-level automation, and Session Recordings for replay and debugging. The service raises concurrency and Quick Actions limits and is available on Workers Free and Paid plans.

🔒 Ceros, an AI Trust Layer from Beyond Identity, runs alongside Claude Code on developers' machines to provide real-time visibility, runtime policy enforcement, and cryptographically signed audit records. Installation is non-disruptive—two CLI commands and a brief enrollment tie sessions to verified human identities with hardware-bound keys. The admin console surfaces conversation transcripts, tool invocations, MCP server connections, and signed activity logs that support compliance.

🔧 Amazon Bedrock now supports server-side tool execution by integrating AgentCore Gateway with the Responses API. Customers can supply an AgentCore Gateway ARN and Bedrock will discover and invoke gateway tools during inference, eliminating client-side orchestration. Tool results are executed and streamed server-side in real time, with IAM-based access control preserved. This reduces latency and simplifies agentic workflows.

🤖 Amazon Web Services today announced that Amazon Aurora DSQL now integrates with Kiro powers and AI agent skills to accelerate database-backed application development. The integration packages the Aurora DSQL Model Context Protocol (MCP) server with development best practices so AI agents can assist with schema design, performance tuning, and routine database operations out of the box. Kiro powers provides a curated registry of MCP servers, steering files, and agent hooks with one-click installation in the Kiro IDE. The Aurora DSQL skill extends the same guidance to other agent ecosystems via a Skills CLI, allowing agents to dynamically load Postgres-compatible SQL patterns, distributed design advice, and IAM authentication guidance.