Sandboxes Are Becoming the New Security Perimeter for AI Agents
As autonomous AI agents move from chat interfaces to executing arbitrary code, browsing external endpoints, and invoking cloud APIs, traditional security boundaries are collapsing. To prevent prompt injections, poisoned code execution, and indirect sandbox escapes, platform engineering teams are shifting security to the runtime level—leveraging lightweight microVMs, gVisor, Kata Containers, and the Kubernetes Agent Sandbox project to turn execution runtimes into the new security perimeter.
Kubernetes Just Got A Chatty New Assistant, And It Speaks Fluent YAML
Red Hat has introduced an open-source Model Context Protocol (MCP) server for Kubernetes and OpenShift, allowing AI coding assistants to interact directly with cluster resources using natural language. Unlike wrappers that execute command-line utilities, this Go-based tool connects directly to the Kubernetes API server, delivering high-performance, RBAC-enforced cluster troubleshooting and resource management.
How Sysdig Is Taking Cloud Security Headless for AI Agents
As attack windows shrink to machine speed, security operations are shifting from reactive dashboard triage to programmable, agent-driven workflows. Sysdig’s headless cloud security leverages the Model Context Protocol (MCP) to embed real-time CNAPP runtime telemetry directly into AI coding agents like Claude Code, Cursor, and Codex—enabling automated vulnerability prioritization, threat investigation, and contextual remediation directly within existing developer environments.
AWS Patches SDK Flaw That Let A Region Field Steal Credentials
Unvalidated input in regional endpoint templates across seven AWS SDKs allowed malformed region strings to redirect signed API requests to external servers. By manipulating URL parsing with @ and # separators during AssumeRoleWithWebIdentity calls, security researchers at Pi Inc. demonstrated how a single unvalidated input field could expose plaintext bearer tokens and lead to total production cloud compromise.
How Tigera Enforces Zero Trust on Kubernetes With Calico
Default flat networking inside Kubernetes clusters allows compromised workloads to freely navigate internal services and attempt lateral movement. Discover how Tigera leverages Calico to enforce Zero Trust security—combining default-deny posture, identity-aware microsegmentation, ordered policy tiers, and native flow log engines like Goldmane and Whisker to secure east-west cloud-native traffic.
Secure-by-Design Cloud Security: How Native Moves Security Into the Architecture
Detection-based cloud security tools leaves a critical exposure window where attackers can exploit misconfigurations before remediation occurs. On the Software Plaza podcast, Native co-founder Gal Ordo explains how shift-down security translates architectural policy intent directly into native cloud-provider primitives—enforcing secure-by-design boundaries across AWS, Azure, Google Cloud, and OCI to eliminate risks before deployment.
Cloudflare surges as AI demand pushes revenue to $696 million
As machine-to-machine traffic officially surpasses human browsing across global networks, Cloudflare reported Q2 2026 revenue of $696.1 million—a 36% year-over-year surge driven by agentic AI workloads. Explore how the platform’s serverless architecture, 7.4 million active developers, and rising enterprise adoption are reshaping edge security and network economics without entering the hyperscaler capital expenditure arms race.
How a stolen API key cost a Fortune 500 company $2 million in overnight cloud bills
A single hardcoded API key committed to a public GitHub repository resulted in a $2 million overnight cloud bill after automated bots hijacked access to spin up high-cost GPU instances. In the AI era, the financial blast radius of credential theft has expanded exponentially—shifting secret management from basic repository scanning to real-time billing anomaly enforcement and temporary workload identity federation.
How Sonatype Guards the Software Supply Chain from Code to Cloud
Modern applications are built on open-source packages, containers, APIs, and AI models operating at machine scale. In its 2026 State of the Software Supply Chain report, Sonatype highlights how shift-left security is evolving into end-to-end supply chain governance—combining upstream firewalling, contextual SCA, automated remediation, and continuous SBOM management to secure components from intake to cloud.
How AI Agents Are Rewriting Cloud Secrets Management
Autonomous AI agents are transforming cloud credentials from static secrets into dynamic non-human identities. Discover how enterprise platform and security teams are moving beyond traditional Vault storage to enforce agent-specific identities, short-lived workload credentials, and granular runtime authorization controls to prevent excessive agency in cloud environments.
How HashiCorp’s Vault Plug-In Streamlines Kubernetes Key Management
As Kubernetes deployments scale across multiple clusters, securing etcd secrets with centralized envelope encryption becomes vital. Discover how HashiCorp’s Vault Enterprise KMSv2 plug-in leverages local Data Encryption Key (DEK) seeds to eliminate API bottlenecks, reduce network overhead during cluster reboots, and streamline multi-cluster key management.
The npm Attack That Turned Provenance Attestations into Camouflage
Software supply chain security relies heavily on build authenticity, but cryptographic verification is only as strong as account security. Discover how recent npm attacks exploited trusted publishing workflows to generate valid provenance attestations for malicious packages, exposing why origin tracking must be paired with runtime dependency inspection and continuous identity protection.
