AI research company i14 partnered with AWS to port its Laplace 3B model, a 24-layer architecture built on Gated Linear Attention (GLA) instead of standard transformer attention, onto AWS Trainium2 using native PyTorch (TorchNeuron Native). Rather than a KV cache that expands with every token, the model keeps a constant 29.5 MB recurrent state per sequence. On a single trn2.48xlarge instance, the team reached about 120,000 training tokens per second and served 11,544 output tokens per second across 1,280 simultaneous sequences through an unmodified vLLM engine.
CISA has confirmed real-world exploitation of six vulnerabilities and placed them on its Known Exploited Vulnerabilities Catalog. Four of the six hit Plex Media Server, covering two SSRF bugs, a URI-scheme handling flaw and a file-path control issue; the remaining two are an OS command injection in EG Secure Solutions SiteGuard Server Edition and an uncontrolled search path flaw in Siemens Software Center. Because the flaws are already being exploited, Binding Operational Directive 26-04 forces federal civilian agencies to fast-track fixes on any exposed system that could hand attackers full control, and to check for prior compromise first.
A joint advisory from the FBI, CISA, USSS and European law-enforcement agencies details the SafePay ransomware group, active since August 2024 and responsible for at least 600 attacks across North America, South America, Europe and Australia. SafePay gains access via stolen/brute-forced credentials, phishing, and exploitation of known VPN and edge-device vulnerabilities, then uses legitimate admin tools to move laterally, disable defenses, exfiltrate data and encrypt files with a ChaCha20/RSA hybrid scheme before demanding ransom.
AWS introduced Agent Registry, a managed catalog service for Model Context Protocol (MCP) servers, agents, and agent skills. Instead of hardcoding every tool into an orchestrator, agents can now search an approved, versioned catalog at runtime and build a client from the returned descriptor. A reference sample demonstrates a Discover → Instantiate → Execute loop using Amazon Bedrock AgentCore Gateway and AgentCore runtime, with Anthropic Claude Sonnet as the foundation model.
Eon, a data protection ISV running on AWS, replaced per-tool credentials and local MCP servers with a single Amazon Bedrock AgentCore MCP Gateway. The gateway uses Cedar-based policies to enforce least-privilege access for both human engineers and an autonomous SRE agent running Claude on Amazon Bedrock, routing calls to MCP servers hosted on AgentCore Runtimes across multiple AWS accounts. Developer onboarding time dropped from about two days to about two minutes after rolling the system out to 100+ developers and roughly 10,000 sessions.
AWS and Keyfactor published a reference design that fixes a known weak point in Model Context Protocol (MCP) deployments: MCP has no built-in way to authenticate which agent is actually making a request. The architecture adds three trust layers — user-to-system, agent-to-agent, and agent-to-tool-server — built on signed request envelopes, delegation assertions signed by the user, RFC 8693 audience-restricted tokens, and live OCSP revocation checks. A working example runs on Amazon Bedrock and the AWS Strands Agents SDK with Keyfactor EJBCA issuing and validating the X.509 certificates, and the full code is on GitHub.
AWS has rolled out structured outputs across every Anthropic Claude model hosted on Amazon Bedrock, reaching both the standard runtime endpoint and the newer Mantle endpoint built for agentic workloads. Instead of hoping the model returns valid JSON, developers can now lock responses to an exact schema through constrained decoding, which blocks the model from generating tokens that would break the format. A companion feature, strict tool use, applies the same guarantee to function-calling arguments so agent workflows don't fail on malformed inputs.
AWS has rolled out Pegasus 1.5, a video-language model built by TwelveLabs, as a fully managed option inside Amazon Bedrock. Unlike earlier versions that answered one question per clip, this release scans an entire video and outputs a JSON list of every moment matching criteria you define, complete with start and end times. It also handles longer recordings — up to two hours in one call — and lets you feed in a video straight from an S3 bucket or as a base64 string, skipping any indexing step.
AWS and Deepgram jointly rebuilt the Nova-3 speech-to-text model to run natively on Trainium2 chips instead of standard GPU-based PyTorch setups, targeting large offline transcription jobs. The work involved rewriting bottleneck layers as custom kernels and replacing Deepgram's Python serving layer with a Rust runtime calling Trainium directly. The result: a single trn2.3xlarge instance running eight parallel model copies delivers 11-70% more transcribed audio per dollar than Deepgram's prior infrastructure, with similar savings potentially available to customers self-hosting on SageMaker.
AWS released a push-based NIXL connector for vLLM that changes how key-value (KV) cache data moves between prefill and decode instances in disaggregated LLM serving. Instead of the decode instance pulling KV blocks after prefill finishes, the decode instance registers its target memory in advance and the prefill instance writes the KV data directly once ready, moving coordination work off the critical path. Benchmarked on a 1-prefill/1-decode Qwen3-32B deployment using EC2 P5en instances with EFA, push mode delivered up to 3x better time-to-first-token (TTFT) and up to 30% better time-per-output-token (TPOT) than the default pull mode, especially under high request rates.
AWS tested its AWS Security Agent (now part of AWS Continuum) against a freshly built benchmark of 37 real, recently disclosed CVEs, each run as a live containerized target with a hidden flag. Starting from a low-privilege endpoint with only a one-line hint and no proof-of-concept, the agent, running on Claude Opus 5, captured 33 of 37 flags through genuine end-to-end exploitation after an integrity audit, with 2 captures reclassified as unintended-path solves and 2 genuine misses where the agent broke the target before extracting the flag. AWS built this benchmark to avoid the contamination problem of public CVE suites, which models may have memorized from training data.
AWS published a governance framework called Trust in Depth, designed to let AI agents operate with more autonomy while staying within enforceable limits. It combines scoping agent permissions before deployment, giving each agent a verifiable identity, enforcing boundaries at runtime via policy gateways, and observing agent behavior afterward. The framework leans on automated reasoning (mathematical proof) for rules that can be precisely defined, and human judgment for ambiguous cases, using AWS tools like Bedrock AgentCore, Guardrails, Kiro, Strands, Agent Registry and CloudWatch Omni.
CISA confirmed real-world exploitation of four vulnerabilities and placed them on its Known Exploited Vulnerabilities Catalog. The affected products span network security and backup infrastructure: Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and two separate flaws in Ahsay's AhsayCBS backup platform. Under Binding Operational Directive 26-04, federal civilian agencies must now remediate these on an accelerated timeline, and CISA urges every organization to do the same.
Tamnoon built Tami, an agentic orchestrator on Amazon Bedrock that investigates cloud security findings from CNAPPs and cloud providers, scores remediation safety, and generates fixes with guardrails. The company reports a greater than 90% reduction in critical cloud exposure within 90 days with zero production issues. The system uses four specialized agents (investigation, safety-scoring, remediation, code-generation) each calling different foundation models through Bedrock, with Bedrock Guardrails and Cross-Region inference providing safety and scale.
Attackers are already abusing a command injection flaw in Microsoft Windows (CVE-2026-96951) and an authentication bypass via spoofing in Ivanti Connect Secure (CVE-2026-104935), prompting CISA to add both to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 26-04, federal civilian agencies must now fast-track fixes for internet-exposed systems that could be fully taken over through these flaws. CISA is also pushing all organizations, not just government ones, to adopt the same risk-based patching approach.
Orca Security built Discovery AI, an Amazon Bedrock-based agent that turns plain-English security questions into structured queries against its Sonar system, which tracks over 900 cloud resource types. Rather than relying on one large model with the full schema stuffed into every prompt, the production version splits the work across nine specialized stages and multiple foundation models. The result: dramatically lower cost, faster responses, and better accuracy on complex queries, now running live since March 2026.
AWS detailed three kernel-level optimizations for Mixture-of-Experts (MoE) model serving on Hopper GPUs, implemented in collaboration with the vLLM community and shipped in Amazon SageMaker AI's LMI container. The changes target the inefficiencies of fused MoE computation during low-batch decode, which previously left Tensor Cores underutilized. Combined, the optimizations deliver up to 10% higher throughput and up to 9% faster time-to-first-token (TTFT).
AWS released Part 1 of a two-part guide showing how to build a post-quantum software supply chain using ML-DSA signatures (NIST FIPS 204) across AWS KMS, AWS Private CA, and IAM Roles Anywhere. The guide covers signing binaries, container images, and SBOMs, and is positioned as the first full cloud-provider walkthrough for post-quantum signing, from root-of-trust creation to policy enforcement. It responds to upcoming mandates: the NSA's CNSA 2.0 requiring exclusive quantum-resistant signatures by 2030, and the EU Cyber Resilience Act taking full effect in December 2027.
AWS published a follow-up security guide explaining how organizations can enforce which ML-DSA (post-quantum signature) parameter sets are allowed across their AWS environment. It covers using Service Control Policies (SCPs) at the organization or OU level and IAM permission boundaries to block creation and use of non-approved ML-DSA variants (e.g., blocking ML-DSA-44 while allowing ML-DSA-65/87). The guide also covers AWS Private CA and certificate controls, and discusses the trade-off between deny-lists (default-allow for new variants) and allow-lists (default-deny, requiring policy updates for new approved algorithms).
AWS published a joint engineering write-up with Postman describing how Agent Mode, Postman's AI-native interface for API testing and documentation, was built to run in production at scale. Rather than model quality, the team found that tool sprawl and missing context were the biggest obstacles to reliable agent behavior. The post details architectural patterns including dynamic tool scoping, schema-based query access, dedicated context handlers, and how Amazon Bedrock provides model flexibility, cross-Region inference, data residency controls, and prompt caching.
AWS published a case study on Amazon Bedrock AgentCore payments, a managed feature that lets AI agents autonomously pay for services like model inference, one request at a time, using the x402 payment protocol. Incarna used it to let its agents pay BlockRun, a multi-provider inference router, for each individual model call, settling in USDC on the Base blockchain. AWS says Incarna cut integration time from a scoped two to three months down to three days and about 200 lines of code. During the beta, agents processed over 1,000 payments ranging from $0.001 to $0.05 per call.
Cisco Talos' CAIRN research classifies a new malware archetype, 'A3: AI-Analysis Evasion,' where malicious code embeds natural-language text designed to manipulate language models used in automated malware triage. Talos traced the technique across four malware families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) and 84 samples from January 2025 to July 2026, showing it spreading from a simple copy-pasted comment to templated, multi-model-targeted 'template spraying' and fake intimidation messages. Controlled testing with a panel of five local LLMs found the simplest direct-instruction technique shifted model verdicts toward 'benign' in roughly 35% of runs, while more elaborate tricks had little effect or backfired by increasing suspicion.
Cisco Talos' Vulnerability Discovery & Research team disclosed a set of vulnerabilities across Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows, all of which have already been patched by their respective vendors. The flaws range from privilege escalation and information disclosure to remote code execution and use-after-free bugs. Snort rule sets are available to detect exploitation attempts of these issues.
AWS describes a new two-stage access control architecture for Retrieval Augmented Generation (RAG) in Amazon Quick and Amazon Bedrock Knowledge Bases. Instead of relying only on periodically synced access control lists (ACLs), the system now verifies permissions in real time against the authoritative data source (e.g. Google Drive, SharePoint, Confluence) at query time, before passing content to the LLM. AWS says this closes security gaps caused by stale or incorrectly mapped permissions between sync cycles. Mondelēz International, with over 35,000 employees, is cited as a customer using this approach.