AWS Security Hub adds an SBOM inventory for compute resources
AWS Security Hub now provides a Software Bill of Materials (SBOM) inventory for packages and applications installed on EC2 instances, ECR container images, and Lambda functions. The inventory is built from SBOMs generated by Amazon Inspector and lists each package’s version, type, and the number of resources where it is installed. Teams can filter or group by package attributes, account, and Region, inspect a resource’s installed software, and query the inventory through the Security Hub API. The feature is included with Security Hub Essentials at no additional cost and populates automatically where Inspector is enabled.
Impact
For teams already using Inspector, the inventory could make it easier to check package presence during triage. Coverage depends on which resources and Regions are integrated and whether Inspector is enabled.
Who needs to act
Security and cloud teams responsible for software inventory and finding response.
Recommendation
Check whether Inspector is enabled for relevant resources, then assess filters, grouping, and API queries in existing triage workflows.
AWS announces general availability of Web Answer on Bedrock AgentCore
Web Answer is generally available as a managed Amazon Bedrock AgentCore tool. An agent sends a natural-language question and receives a synthesized answer with citations through a tool call. AWS says the service plans searches, runs several in parallel, reads pages to check facts, and links claims to source URLs. Integration uses AgentCore Gateway, which authenticates calls with IAM or JWT and returns the result to the agent as an MCP tool. Domain filters can be configured; the tool also accepts publication-date-range and country filters.
Impact
For agents that need current information, the integration could reduce the need to maintain a separate search, retrieval, synthesis, and citation pipeline. Suitability depends on source quality and validation for the intended use case.
Who needs to act
Teams building web-research agents with AgentCore Gateway.
Recommendation
Test the tool with representative questions, check its citations, and configure domain filters where needed. Consider invocation costs and Gateway permissions before production integration.
Grafana adds section-level and reusable cross-dashboard variables
Grafana announced section-level variables for rows and tabs, which are generally available, and cross-dashboard variables, which are in public preview. Section variables apply to panels in that row or tab; resolution checks the nearest section first, followed by parent sections and then the dashboard. Cross-dashboard variables can have global or folder scope and must be selected in each dashboard’s settings. The definition is shared, while each dashboard keeps its own selected value. They can also be managed as API resources and provisioned with Terraform.
Impact
For organizations with repeated controls, sharing could reduce duplicate maintenance. Public preview status and explicit dashboard opt-in call for care before standardizing their use.
Who needs to act
Observability teams maintaining shared or large dashboards.
Recommendation
Try section-level variables to organize local controls. For cross-dashboard variables, assess the preview on noncritical dashboards and define scope, selection, and precedence clearly.
BigQuery introduces AI.AGG for semantic aggregation in preview
Google Cloud describes AI.AGG, currently in preview, as a managed semantic aggregation function integrated into BigQuery GoogleSQL. The function applies natural-language instructions to groups of rows and recursively combines intermediate summaries until it produces an output for each SQL group. According to the post, BigQuery organizes batches and parallel inference and uses Vertex AI. The function accepts text and multimodal inputs; for images stored in Cloud Storage, the post cites BigQuery Object Tables and OBJ.GET_ACCESS_URL, without data movement or transcoding. It also warns that the recursive architecture can send Gemini more tokens than the source data contains.
Impact
For analysis of large text datasets, the function could reduce the need to build external splitting and synthesis pipelines. Because it is in preview and processing can increase token usage, teams should assess cost and behavior before adoption.
Who needs to act
Data, analytics, and operations teams analyzing text or records in BigQuery.
Recommendation
Run a pilot with explicit filters and limits, estimate usage with AI.COUNT_TOKENS, and check outputs on representative data before expanding queries.
Agent Substrate 1.0 reaches general availability on GKE
Google announced the donation of Agent Substrate, gVisor, and OpenRL to the CNCF after the projects entered the CNCF Sandbox. Agent Substrate has reached version 1.0 and is generally available on GKE. According to the description, it separates agent sessions and identities from execution capacity: idle sessions can be saved and resumed when activity returns. The post also says the project can run on Kubernetes clusters and uses OCI containers. gVisor provides isolation for untrusted code, while OpenRL orchestrates reinforcement-learning post-training workflows on Kubernetes. The donated projects are going through CNCF Sandbox onboarding; gVisor is on a path toward Incubation.
Impact
For teams running agents with pauses between calls, separating sessions from active compute could help reduce resources held by idle workloads. Suitability depends on isolation requirements, architecture, and validation in the team’s own environment.
Who needs to act
AI platform teams, SREs, and teams operating agents or execution environments on Kubernetes, particularly on GKE.
Recommendation
If this pattern is on your roadmap, assess the architecture and security boundaries in a pilot; also confirm service availability and requirements for your intended environment.
LangGraph 1.2.20 adds strict mode for resuming interrupts
LangGraph version 1.2.20 includes a change that gives each interrupt() call within a task its own ID. It also adds a strict resume mode that rejects stale interrupt answers. The release notes additionally report a correction to the documentation reference shown for multiple-interrupt errors and development dependency updates. The feed does not detail how to configure the new mode or specify which applications need to change. The update is relevant to workflows that pause for a response and then resume execution, particularly when multiple interrupts or out-of-context answers are possible.
Impact
In applications with interrupted and resumed workflows, individual IDs and rejection of stale answers could help prevent incorrect associations. The effect depends on how each application manages state and resumes.
Who needs to act
Teams maintaining LangGraph-based applications that use interrupt() or task resumption.
Recommendation
Review the release notes and test interruption and resumption paths before upgrading production applications; confirm that strict mode matches the intended behavior.
ECS Managed Instances add json-file log collection through managed daemons
AWS added support for the json-file log driver in application containers on Amazon ECS Managed Instances and for log-driver volumes in Amazon ECS Managed Daemons. With these features, a managed daemon can read the files through a mounted volume without specifying host bind-mount paths or requiring root privileges. Logs are stored in directories associated with each container ID and retained until the container is removed. AWS says the setup can forward logs to a chosen destination and use the team’s observability agent. The feature is available in commercial AWS Regions where ECS Managed Instances and Managed Daemons are available, at no additional cost.
Impact
File-based collection could make it easier to use observability agents that support the Docker json-file format. The change may require updates to task definitions and to log-retention and forwarding practices.
Who needs to act
Platform and observability teams using ECS Managed Instances and Managed Daemons.
Recommendation
Check agent compatibility and test the logConfiguration, volume, and mountPoints setup on a task before expanding the change.
Google Cloud introduces AlloyDB Express in preview
AlloyDB Express is a new AlloyDB for PostgreSQL offering aimed at developers and coding agents. According to the announcement, a database can be created in under two seconds, and the instance automatically pauses after 15 minutes without activity, resuming when a new query arrives. The service is in preview and includes a free tier. Google also says users can upgrade to AlloyDB with one click while keeping data, schemas, users, and connection strings. The offering includes vector, text, and hybrid search capabilities.
Impact
For intermittent development and testing workloads, automatic pausing may reduce the time compute is active. The actual benefit depends on usage patterns and storage and query costs.
Who needs to act
Development, platform, and FinOps teams evaluating PostgreSQL databases for prototypes and tests.
Recommendation
If it fits the architecture, test it in a non-production environment and validate costs, security requirements, and resume behavior before adoption.
Cloudflare adds visibility and policies for personal agents
Cloudflare announced new traffic analytics and access controls for supported personal agents visiting websites. In Security Analytics, the Personal Assistants category lets teams filter this traffic; a new widget shows which agents visit a site and how many requests they send. Teams can also filter by agent to inspect requested paths, status codes, and source networks. In Security Settings, site owners can set an overall Agents policy and different policies for each supported agent: allow, block on pages with ads, or block. Existing Search and Training policies remain unchanged.
Impact
These controls may help teams distinguish agent traffic and tailor access to site content and business models. Identification alone does not resolve every question about user context or reputation, which Cloudflare describes as future work.
Who needs to act
Security, fraud, and web operations teams receiving automated traffic.
Recommendation
Review the analytics and per-agent rules before changing blocks; assess potential effects on legitimate customer journeys.
OpenShell outlines isolated agent execution on Kubernetes
A CNCF guide presents OpenShell, a CNCF Sandbox project started by NVIDIA, as a runtime for running agents in Kubernetes sandboxes. It applies filesystem, process, network, and credential controls; outbound traffic is denied by default, and rules can consider the binary, host, port, and HTTP method. The Kubernetes backend uses the Agent Sandbox project's Sandbox resource and represents agents as familiar objects such as Pods, Services, PVCs, Secrets, and NetworkPolicies. The guide notes that sandboxes can currently be created through the Gateway API, not the Kubernetes API, and that one Supervisor Pod per agent may constrain scale in large environments.
Impact
This model may give teams more control over agent actions and network requests than network rules alone provide. It also adds components and calls for evaluating cluster capacity and existing controls.
Who needs to act
Platform engineering, Kubernetes administrators, and security teams running agents with access to credentials or networks.
Recommendation
Before a pilot, validate CNI NetworkPolicy enforcement, admission policies, and operational limits; account for the Gateway API limitation.
