Octopus Deploy Remote MCP: Agents Can Now Ship Releases
Octopus Deploy remote MCP lets AI agents deploy releases and run runbooks through a built-in /mcp endpoint. What it exposes, and the guardrails to set first.
Docker Hub Access Token Vulnerability: A Two-Year Silent Transfer
A Docker Hub access token vulnerability let account conversion hand live PATs to another user for two years. What Docker found and changed, and what to check.
kagent Agent Builder: Three Guardrails a Prompt Can't Replace
A kagent agent builder on Kubernetes turns one sentence into a running AI agent. A CNCF lab shows why allowlists, approval and RBAC, not prompts, keep it safe.
AWS Digital Sovereignty Lens: A Well-Architected Framework for Regulated Cloud Workloads
AWS's Digital Sovereignty Lens adds 21 questions and 37 best practices for data residency, access control, continuity, and auditability on regulated workloads.
Zero-Trust AI Agent Access in Practice: IBM watsonx and HashiCorp Boundary
A HashiCorp proof of concept gives AI agents infrastructure access via Boundary and Vault without exposing credentials, with IBM watsonx doing the reasoning.
Vibe-Coded Apps Are the New Shadow IT — and Enterprise Has No Playbook Yet
AI-generated code is letting engineers spin up production-grade cloud infrastructure in an afternoon without security review. Platform teams are watching and mostly unprepared.
HashiCorp Vault Agentic IAM Is Now GA: Managing AI Agents Like Identities
Vault Enterprise 2.1 brings AI agent identity management to general availability — per-request OAuth controls, a centralized agent registry, and Terraform provisioning for agent credentials.
Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles Are Now GA
Kubernetes v1.37 graduates Pod Certificates and Cluster Trust Bundles to stable. They replace bearer token JWTs with proof-of-possession mTLS credentials — closing a workload identity gap that has existed since the beginning.
Kubernetes v1.37 Pod Certificates: Why Bearer Tokens Were Never Enough
Pod Certificates and Cluster Trust Bundles hit GA in Kubernetes v1.37, replacing bearer token identity with proof-of-possession X.509 credentials.
How to Migrate AWS Organizations Without Breaking RAM Shares and Lake Formation
When accounts leave AWS Organizations, RAM shares silently break—halting Terraform deployments mid-migration. The bridge-share pattern preserved permissions across 382 accounts.
How Bedrock AgentCore Propagates User Identity to JFrog Artifactory — and Why It Matters
When an AI agent calls a tool on behalf of a user, who gets the audit trail? Bedrock AgentCore's On-Behalf-Of token exchange solves the shared-credential problem that makes agent-to-Artifactory calls untrustworthy.
AWS Retired This EKS Auth Method — and 81% of Clusters Haven't Noticed
AWS deprecated ConfigMap-based EKS cluster authentication, but 81% of clusters still run the legacy method. Here's what the migration window looks like and what's at stake.
Scale Your Platform Without Becoming the Bottleneck: The JFrog Projects Framework
Growing engineering orgs hit a wall when centralized platform admins become the constraint. JFrog Projects introduces delegated administration, project-scoped RBAC, and isolation by default — with a model that scales to 120,000+ repos.
Datadog's Azure Integration No Longer Needs a Secret to Rotate
Secretless authentication replaces static client secrets with OIDC-based federated identity. No expiration dates, no rotation schedules, no telemetry gaps when someone forgets to update a credential.
The npm Attack That Turned Provenance Attestations Into Camouflage
The August 2026 npm worm compromised packages with 150M+ weekly downloads by publishing from legitimate GitHub Actions runners — making valid provenance attestations a false safety signal.
Shadow AI in CI/CD: The Six-Stage Threat Model from Laptop to Kubernetes
CNCF maps six attack surfaces where unapproved AI agents gain privileged access in the software pipeline — every enterprise has at least one gap, and CI credentials are the target.
5 AWS Updates That Matter This Week: Bedrock Price Cuts, Prometheus, IAM
AWS cut Bedrock GPT-5.6 pricing up to 80%, shipped managed Prometheus collectors for CloudWatch, and added multi-region IAM Identity Center — here's what to actually act on.
Three Layers to Stop ML Data Exfiltration in AWS SageMaker Environments
iBusiness built a three-layered security architecture using SageMaker AI, WorkSpaces Secure Browser, and VPC isolation — cutting per-user cost 80% while closing every major data movement path.
Okta Brings AI Agent Governance Inside FedRAMP Boundaries First
Okta is now the first identity platform to extend AI agent lifecycle management into FedRAMP and HIPAA environments — meaning federal agencies can finally deploy agents against regulated data.
Workday's Argument: AI Guardrails Must Live at the Inference Layer
Workday CTO Gabe Monroy argues that for HR and payroll data, agent gateways and external wrappers sit at the wrong layer — guardrails have to be wired into inference itself.
AWS Security Agent Adds STRIDE Threat Modeling, Kiro Power, and Claude Code Plugin
AWS Security Agent now generates STRIDE-based threat models from design docs or source code, surfaces findings in Kiro and Claude Code IDEs, and adds full-repo code scanning with remediation — moving security earlier in the development workflow.
HCP Vault Dedicated Gets Cluster Disaster Recovery — and a DR Testing Path
HashiCorp's HCP Vault Dedicated now supports cluster-level disaster recovery in public preview, enabling failover for cluster-specific incidents and — critically — scheduled DR testing without waiting for a regional outage.
Bedrock + Verified Permissions: Two-Layer Authorization for Multi-Tenant RAG
AWS's reference architecture solves enterprise RAG's hardest problem — keeping department data siloed without duplicating infrastructure — using Cedar policies and independent authorization layers.
Agentjacking: How a Public Sentry Key Hijacks Claude Code, Cursor, and Codex
A newly documented attack called agentjacking exploits Sentry's MCP integration to inject fake bug reports into AI coding agents, which then execute malicious commands with developer-level privileges.
MCP's Missing Enterprise Authorization Layer Is Now Filled
The Enterprise-Managed Authorization extension for the Model Context Protocol eliminates per-server OAuth consent prompts, letting IT admins provision MCP server access centrally through existing identity providers.
When AI Attacks at Machine Speed: The End of Static Credentials
An exposed AWS key can be pivoted to database access in 18 minutes by an AI agent. Why static credentials are no longer a viable security posture.
Why AI Agent Identities Are Your Next Enterprise Security Crisis
67% of AI agents run on unauthorized accounts. Third-party breaches are up 60% YoY. The enterprise identity problem for AI agents is structural—and growing.
AI Agents Have an Access Problem. HashiCorp's Answer Is Just-in-Time Everything.
Traditional IAM wasn't built for AI agents that access infrastructure in unpredictable, dynamic ways. HashiCorp lays out the five requirements for production agentic AI access — and how Boundary and Vault provide the just-in-time credential layer that agents actually need.
SCIM in HashiCorp Vault: Identity Provisioning Without the Policy Risk
Vault 2.0 SCIM beta lets SailPoint and Okta provision users and groups — with deliberate architectural separation that blocks identity managers from touching Vault policies.
Datadog API Authentication Detection: Why Three States Beat Two
Datadog App & API Protection adds three-state auth classification to eliminate false positives. How evidence-based detection works at scale.
AWS MCP Server: IAM-Native Access to 15,000+ AWS APIs
AWS's official MCP server covers 15,000+ APIs through one tool with IAM-native auth. Free, agent-agnostic, and available for Claude Code, Cursor, and Kiro.
HashiCorp Vault SPIFFE: The Identity Layer Agentic AI Has Been Missing
Vault Enterprise 1.21 now issues SPIFFE identities to AI agents and non-human workloads — giving autonomous systems the cryptographic credentials zero-trust security requires.
HashiCorp Vault SSH: Short-Lived Certificates Replace Static Keys at Scale
HashiCorp Vault's SSH Secrets Engine replaces long-lived static SSH keys with 30-minute certificates signed by an internal CA. How the architecture eliminates four structural risks in enterprise SSH access management.
Terraform + AWS Native OIDC: Eliminating Static Credentials From Multi-Account IaC
AWS Account Factory for Terraform now supports native OIDC with a single config flag — no stored secrets, auto-generated IAM roles, and consistent zero-standing-credential provisioning across every account.