Security | Vanderburgh.it

Security · September 9, 2026

AI-assisted secret triage becomes trustworthy when its attribution and risk reasoning remain visible and remediation stays human-owned

GitGuardian says Public Secrets Monitoring now runs two AI agents and deep analysis on every public GitHub and Docker Hub incident, returning a company-related verdict, risk score, and visible reasoning. The company reports that AI-service credentials reached 1.27 million exposed instances last year, and that 24,008 unique secrets appeared in public MCP configuration files. New workspaces receive the analysis by default, with existing workspaces rolling out gradually; the workflow does not close incidents automatically.

Public-secret monitoring product announcement GitGuardian

Open edition

Agents · September 8, 2026

Self-hosted coding-agent workers improve execution control only when the cloud control plane and data flows remain explicit

Cursor has introduced Self-Hosted Machines, allowing Cloud Agents to execute tool calls on dynamically scheduled workers inside a team's network while Cursor continues to run the agent loop, planning, and inference. Workers keep a long-lived outbound HTTPS connection to Cursor; they can be organised into shared pools that scale with queued work and serve multiple repositories. Cursor notes that tool output may include code and that agent transcripts may be processed and stored in its cloud.

Self-hosted agent-worker product announcement Cursor

Open edition

Security · September 7, 2026

AI vulnerability triage becomes operational when code findings are ranked against live traffic, security signals, and the controls already in place

Cloudflare has announced invitation-only Early Access for Vulnerability Discovery and Remediation in Cloudflare Managed Defense. For codebases a customer authorizes it to inspect, the service uses OpenAI Daybreak models for reconnaissance, hunting, and validation, then combines source-code evidence with route activity, traffic, security events, and WAF context. It proposes code patches and mitigations for review; customers decide whether to implement them, and any WAF rule deployment requires authorization.

Early Access vulnerability-remediation announcement Cloudflare

Open edition

Security · September 4, 2026

AI agents need centrally managed cross-application authorization when every user reconnect and static credential becomes a governance gap

Auth0 has launched Early Access Client App capabilities for Cross App Access, an architecture for B2B applications and AI agents that request data from external APIs or Model Context Protocol servers. Auth0 says the implementation uses the emerging Enterprise-Managed Authorization extension and IETF Identity Assertion Authorization Grant work so enterprise IT can approve access through existing identity-provider trust rather than relying on static API keys or repeated user connection prompts.

Enterprise-managed authorization Early Access announcement Auth0

Open edition

Security · September 3, 2026

Frontier-model safeguards become easier to operationalise when monitoring evidence remains in the customer-controlled cloud boundary

Anthropic has announced Enterprise Frontier Safeguards, combining zero data retention with automated detection of serious misuse. The service is designed to keep monitoring data in cloud infrastructure controlled by the customer, with customer-managed encryption keys and automated review available as opt-in controls. Anthropic says rollout will begin in phases later this fall across Claude products and supported cloud platforms.

Enterprise safeguard announcement Anthropic

Open edition

Agents · September 3, 2026

Agent governance needs a complete inventory before teams can judge ownership, permissions, and blast radius

Okta has added AI-agent discovery to all existing Identity Security Posture Management subscriptions. Its inventory can surface endpoint agents and MCP servers, builder-platform agents, OAuth grants, and shadow AI applications, then place agent-related misconfigurations alongside other identity risks. Some discovery sources remain Early Access or planned, so coverage should be validated against the organisation's actual endpoints and builder platforms.

Identity Security Posture Management product announcement Okta

Open edition

Security · September 2, 2026

Agentic operations need a governed execution model when analysis can turn directly into enterprise action

Palo Alto Networks has acquired Console, an AI-native platform designed for agentic workflows across enterprise operations. Palo Alto Networks says Console will deepen Cortex capabilities that help teams investigate signals, prioritise work, and act across their environment; the announcement describes natural-language workflows that can automate alerts, issues, and requests.

Agentic operations acquisition announcement Palo Alto Networks

Open edition

Business · September 2, 2026

AI service governance needs a live risk-and-accountability plan when regulatory oversight reaches the platform layer

The European Commission has designated ChatGPT a Very Large Online Search Engine under the Digital Services Act after the service declared at least 45 million average monthly EU users. The designation gives OpenAI four months, through January 2027, to meet additional obligations covering systemic-risk assessment and mitigation, transparency, and independent audits.

Digital Services Act designation notice European Commission

Open edition

Security · September 1, 2026

AI gateways become operationally useful when model access, tools, and network permissions can be governed through one identity-aware control point

Tailscale has made Aperture generally available for securing and managing AI agents and LLM sessions. Its documented controls include model access and spend controls, request and response hooks, guardrails, logging, MCP support, API proxying, and approval-based access to tailnet nodes and SSH resources.

AI gateway general-availability announcement Tailscale

Open edition

Tools · September 1, 2026

Coding-agent rollouts need a migration path when a model provider can change the terms of a familiar developer tool

OpenAI says it plans to wind down its contract providing OpenAI models to Cursor and has proposed a transition period through November 12, 2026; Cursor could choose to end access sooner. OpenAI documents two continuation paths inside Cursor: bring an API key for local Chat and Agent features, or use the Codex IDE extension with a ChatGPT subscription or API key.

Official product-transition guidance OpenAI

Open edition

Infrastructure · August 26, 2026

Regulated AI workloads need model access that fits the cloud boundary and operating controls they already use

AWS has made OpenAI GPT-5.6 Terra and Luna generally available through Amazon Bedrock in AWS GovCloud (US-East and US-West). The models offer a million-token context window and prompt caching, but the operational value is that teams with a GovCloud boundary can evaluate the models through their existing AWS account, policy, monitoring, and cost-management practices rather than create an unmanaged parallel route.

Amazon Bedrock availability announcement AWS

Open edition

Security · August 26, 2026

MCP access becomes easier to govern when each agent connection inherits identity-provider policy and the user’s existing role

Supabase has made enterprise-managed authentication generally available for its MCP server on Team and Enterprise plans. With SSO and a supported identity provider, an administrator can authorize a client centrally while each employee’s access remains limited to their existing Supabase role and project permissions. Supabase documents short-lived, non-refreshable access tokens and central revocation through Authorized Apps.

Enterprise-managed MCP authentication announcement and documentation Supabase

Open edition

Agents · August 25, 2026

Coding agents need permission-aware context across repositories without turning source access into an invisible data-sharing decision

Atlassian Code Context combines lexical and semantic code search with work and organisational context from the Teamwork Graph. It can give coding agents access to relevant material across connected repositories while evaluating existing source-control permissions, but third-party agents still process retrieved code under their own service terms.

Permission-aware code-context announcement Atlassian

Open edition

Business · August 25, 2026

Domain-owned models can change professional AI economics when control and specialised evaluation matter more than maximum generality

Thomson Reuters has launched Thomson, an internally developed model built from an open-source foundation and specialised with its professional content and subject-matter expertise. The company controls the model and is putting it into legal workflows, presenting a different route from relying exclusively on third-party frontier models plus retrieval.

Domain-specific model announcement Thomson Reuters

Open edition

Tools · August 19, 2026

Copilot adoption needs a coherent user entry point while work identity and tenant controls remain distinct

TLDR IT reported that Microsoft started unifying its consumer and Microsoft 365 Copilot experiences on August 18, ahead of a broader application overhaul. Personal and work use still separate through Microsoft and Entra identities, preserving the enterprise tenant and compliance boundary. The useful change is not simply a new interface: it reduces the chance that users treat personal and governed work AI as interchangeable products.

Copilot product-consolidation report Computerworld

Open edition

Tools · August 18, 2026

Agent operations need end-to-end observability when model behaviour becomes part of the production incident path

TLDR IT reported Dynatrace's plan to acquire Arize for roughly $915 million. Arize brings visibility into model outputs, agent behaviour, and tool use; Dynatrace contributes application and infrastructure telemetry. Together, that points to a practical requirement: teams must be able to follow an agent failure from a surprising output or tool call through the affected service, transaction, and customer workflow.

AI observability acquisition report DevOps.com

Open edition

Security · August 18, 2026

No-code agent automations need least-privilege identities and approvals before they gain reach across business systems

Google is adding least-privilege agent identities, audit trails, flow-level access controls, human approvals, and DLP protections to Workspace Studio. The relevance is broader than one platform: as employees build automations that act across mail, files, and collaboration systems, the control contract has to travel with each flow rather than depend on an administrator spotting risk after release.

Enterprise agent-automation controls announcement Google Workspace Updates

Open edition

Agents · August 18, 2026

Enterprise agents need bounded autonomy when a useful action can also change a real business outcome

TLDR IT highlighted a pragmatic operating pattern for enterprise agents: define narrow tool permissions, verification checks, durable audit trails, staged rollout, cost and step limits, and human approval where impact is higher. These controls do not make an agent less useful; they make the difference between a demonstrator and a service that can be trusted with consequential work.

Enterprise agent-governance analysis InfoWorld

Open edition

Business · August 14, 2026

Enterprise AI delivery needs accountable capability when model partnerships become a services operating model

TLDR IT reported that IBM is establishing a dedicated OpenAI consulting practice and plans to certify tens of thousands of consultants for AI work in finance, government, telecom, and retail. The operational signal is that enterprise adoption increasingly depends on reusable delivery methods, domain expertise, and accountable service ownership alongside the model itself.

Enterprise AI partnership report TechCrunch

Open edition

Security · August 14, 2026

Enterprise agents need a central control plane when routing, identity, policy, and cost decisions must stay consistent

TLDR IT highlighted A10 AI Gateway, a central control plane intended to route requests, apply identity-based policy and usage limits, monitor activity, and manage costs across enterprise AI agents, applications, and large language models. Its stated support for on-premises, private-cloud, and air-gapped environments reflects the need to govern AI where the workload actually runs.

Enterprise AI gateway announcement Help Net Security

Open edition