Search the archive

NVIDIA OPEN AGENT SAFETY PLATFORM: A REFERENCE FOR CONTINUOUS IN-SILICON AGENT MONITORING

NVIDIA's Open Agent Safety Platform pairs OpenShell, an Apache 2.0 sandboxed runtime that turns operator instructions into verifiable file, network, tool, and credential policies, with Sentry, a monitor that runs on BlueField-4 DPUs. In Vera Rubin PODs, the DPU sits on the node's only path to the model, so it can enforce policy at line speed outside the agent's reach. NVIDIA's argument is that agents can't be trusted to govern themselves, so safety controls have to sit below them in hardware.

MICROSOFT'S COPILOT SUPER APP COMES WITH A METER ATTACHED

Microsoft is splitting Copilot pricing in two. A per-user subscription still covers "Everyday AI" in Office apps, while agentic features like Cowork, Code, Autopilot, and frontier models are billed by usage on top of the seat. Admins get spending caps and alerts, but budgets that were fixed per head now have to absorb costs from agents that run without a user prompting them.

WHAT HAPPENS WHEN THE CLOUD BLOWS UP?

Missile and drone strikes during the March 2026 Iran conflict hit AWS facilities in the UAE and Bahrain. AWS says the damage exceeded what its multi-AZ design can withstand, and restoration isn't expected until early 2027. The piece argues that availability zones don't fail independently when a whole region is physically attacked, and that continuity plans should account for that.

TEST-DRIVING JEV ON A SECURITY TASK: IDENTITY RESOLUTION

Vincenzo Iozzo tested Jev, a specialized classification model, on matching accounts across systems to the same person in five real organizations. Jev scored 0.948 F1 on large orgs at $0.62 per 1,000 accounts, beating Claude Haiku 4.5 (0.894 F1, 19x the cost) and Sonnet 5 (0.911 F1, 47x the cost) at roughly a tenth of their latency. His conclusion is that small calibrated models beat prompted frontier LLMs on bounded, high-volume security classification.

MICROSOFT ANNOUNCES GENERAL AVAILABILITY OF WSLC: LINUX CONTAINERS ON WINDOWS

WSLC, Microsoft's native way to run Linux containers on Windows, is now generally available through a new wslc.exe command. Each session gets its own storage VHD, stronger isolation, and a new networking model compared with standard WSL. The code is open source in the microsoft/wsl GitHub repository.

INTRODUCING THREAT SIGNALS: AGENTIC SKILLS FOR OPEN-SOURCE THREAT INTELLIGENCE, FREE FOR EVERY CLOUDFLARE ACCOUNT

Cloudflare's Threat Signals uses agentic skills to read open-source threat reports from RSS feeds, summarize them, extract indicators of compromise, and tag threats. It then links those findings to WAF rules while keeping the context of the original source. Cloudflare also made its Threat Events Platform free for every account, with paid tiers for more feeds, proprietary data, and custom skills.

BUILDING A POST-QUANTUM CERTIFICATE AUTHORITY WITH MERKLE TREE CERTIFICATES

Cloudflare is becoming a certificate authority that issues Merkle Tree Certificates for free, and it is targeting Chrome's quantum-resistant root store in early 2027. Post-quantum signatures are about 40x larger than classical ones, so MTCs batch many certificates under a single CA signature and build transparency logging into issuance. In a Chrome experiment covering 50% of Beta users, the lightweight MTC format already made handshakes 9% faster.

GOOGLE SEEMINGLY CONFIRMS PLANS TO KILL CHROMEOS IN 2034

A new Google support page for enterprise and education customers says ChromeOS support will continue through mid-2034, and newer Chromebooks will be migrated to the Android-based Googlebook OS. This is a problem for schools, because Googlebooks start at $899 and won't have comparable management tools for a year or more.

A DATA CENTER IS A DEPENDENCY GRAPH BEFORE IT IS A BUILDING

A finished hyperscale region can sit idle for 6 to 12 months because hundreds of interdependent services have to come up in the right order, and some depend on each other, such as DNS relying on inventory while inventory relies on DNS.

AGENT MEMORY IS A SEARCH PROBLEM, NOT A STORAGE PROBLEM

Tiger Data skipped fact extraction, knowledge graphs, and memory managers.

HOW TO ROLL OUT GENIE ONE: A STEP-BY-STEP ENTERPRISE PLAYBOOK

Databricks published a four-phase rollout plan for Genie One, its AI coworker for business data questions.

Save your seat here.

OVER 16,000 SUPABASE DATABASES EXPOSE PII, PASSWORDS, AUTH TOKENS

UpGuard identified more than 16,000 Supabase databases exposing readable tables. Analysis of their schemas indicated that more than half could expose personal information, with smaller subsets potentially exposing passwords or authentication tokens. The issue is misconfigured access controls rather than a newly discovered platform vulnerability, reinforcing the need for database authorization, exposure testing, and clear ownership of internally built tools.

MICROSOFT PAUSES KB5002907 UPDATE AFTER OFFICE LICENSE DEACTIVATIONS

Microsoft has paused optional update KB5002907 after reports that it left some Office 2016 and 2019 installations unlicensed or, rarely, removed. Its recovery guidance is to reactivate or reinstall the affected product. Importantly, the update makes no changes where Microsoft 365 Apps updates are managed through Group Policy or Cloud Update. Support teams should check update history before treating unexpected licensing tickets as subscription or account problems.

7 REASONS IT MANAGERS FAIL TO EXCEED YOUR EXPECTATIONS

Promoting a strong technologist does not automatically prepare them to manage people, business relationships, or competing operational priorities. This piece examines unclear expectations, insufficient leadership development, and the tendency to reward technical output without developing management skills. It is a useful operating-model check for CIOs overseeing support, infrastructure, SaaS, and business systems: define what managers own, coach them on business outcomes, and provide advancement paths for specialists who should remain individual contributors.

THE SAASPOCALYPSE THAT WASN'T, WITH ATLASSIAN CEO MIKE CANNON-BROOKES

In this Decoder interview, Mike Cannon-Brookes explains why Atlassian combined internal IT and AI enablement under its people leadership: employee adoption and changes to business systems are tightly connected. He also argues that AI will change SaaS workflows without eliminating the need for structured systems and human judgment. For CIOs, the interesting question is who owns the combined work of employee enablement, system integration, and AI cost management, rather than treating each as a separate rollout.

ANTHROPIC TURNS CLAUDE INTO AN AI MARKETPLACE WITH 2,000+ PLUGINS AND CONNECTORS

Anthropic's marketplace brings together more than 2,000 plugins and connectors, partner-built agents, and services, with eligible partner software purchasable using a portion of committed Anthropic spending. For an internal AI platform team, the significant change is the growing catalog of connections between assistants and business systems, along with another procurement channel to manage. Marketplace availability should not replace reviewing permissions, data access, integration ownership, and how access will be removed when someone leaves.

WORKDAY LAUNCHES TOTAL BENEFITS, BRINGING HEALTH, WEALTH, AND WELLBEING SUPPORT TOGETHER IN ONE PLACE

Workday has announced Total Benefits, combining benefits-provider integrations, administration services, and employee guidance in one offering. Workday Wellness is now available to US customers, while benefits guidance through its Self-Service Agent is expected to become generally available in October. Evaluation should cover provider compatibility, sensitive employee-data sharing, and whether the new workflows can replace existing portals and manual administration rather than simply adding another layer.

HOW TO DISABLE BITLOCKER IN WINDOWS 11 (AND WHEN YOU SHOULDN'T)

Disabling BitLocker starts decrypting the drive, while suspending protection leaves the data encrypted but temporarily makes the encryption key accessible. This walkthrough explains the distinction and why short-term firmware maintenance or troubleshooting often calls for suspension rather than removing encryption entirely. The operational takeaway is to make resuming and verifying protection part of the endpoint maintenance runbook, not optional cleanup after the support ticket closes.

MICROSOFT ADDS PAY-AS-YOU-GO PRICING FOR EXTRA ONEDRIVE STORAGE

Microsoft 365 customers can now use consumption-based billing when users exceed their licensed OneDrive storage instead of purchasing additional capacity upfront. Admins choose which users are eligible and can set budgets and alerts. Additional storage costs $0.20/GB/month. Enterprise SaaS is shifting toward usage-based pricing, giving IT more flexibility but also making cost monitoring part of day-to-day platform management.

NEW GOOGLE MEET 'TAKE NOTES FOR ME' SETTINGS FOR ADMINS AND END USERS TAKE EFFECT SEPTEMBER 29TH

Google will begin applying new automatic-note settings on September 29.

CLOUDFLARE FIXES CONTAINERS CROSS-TENANT FLAW EXPOSING CUSTOMER DATA

Cloudflare says it completed remediation of a cross-tenant storage-reuse flaw affecting Containers and Sandboxes by September 19, found no evidence of malicious exploitation in available telemetry, and requires no customer-side action.

OPENAI AGENTS UPLOADED USER IMAGES TO THE PUBLIC INTERNET WITHOUT THE COMPANY'S KNOWLEDGE

AI agents operating in OpenAI's research environment uploaded user-provided images to public image-hosting sites without the company's knowledge. OpenAI identified 53 instances, underscoring a new class of enterprise AI risk: autonomous agents with access to sensitive data can take unintended external actions even when they aren't explicitly instructed to do so.

KITEWORKS TELLS CUSTOMERS TO SHUT DOWN SERVERS OVER THREAT OF AN IMMINENT ATTACK

Secure file-sharing provider Kiteworks took the unusual step of asking customers to temporarily shut down servers after receiving intelligence about a potentially imminent cyberattack. The precaution is particularly notable given Kiteworks' role in handling sensitive enterprise file transfers and communications.

THE ENTERPRISE NEEDS TO KILL THE "SSO TAX"

The long-running practice of SaaS vendors reserving SSO for expensive enterprise plans effectively makes companies pay extra for a basic security control. The model needs to change, as identity becomes even more important in an AI- and SaaS-heavy workplace, citing data that 37% of enterprise SaaS applications remain outside SSO.

ENTERPRISE AI CODING AGENTS ARE BECOMING AN IT PROCUREMENT PROBLEM TOO

A comparison of GitHub Copilot, AWS Kiro, Cursor, and Cognition highlights how enterprise evaluation of coding agents now extends well beyond developer productivity. IP indemnification, data residency, prompt retention, audit logs, and enterprise pricing are increasingly becoming security, legal, and IT considerations when these tools are deployed at scale.

AI AGENTS EXPOSE A SECURITY GAP BETWEEN THE DATA THEY CAN READ AND THE SYSTEMS THEY CAN CHANGE

Traditional application permissions weren't designed for autonomous agents that can read information in one system, reason about it, and then take actions somewhere else. Enterprises need to think beyond model security and start controlling the full agent execution path: identity, data access, tools, and actions.

MICROSOFT ADDS AN IT-GOVERNED RUNTIME FOR EMPLOYEE-BUILT AI APPS AND AGENTS

Copilot Managed Runtime gives organizations infrastructure for running apps created through Copilot Code, Cowork, and Copilot Studio inside the Microsoft 365 environment. Microsoft is also introducing a centralized plugin registry where IT can approve and manage plugins, pointing toward a future where managing employee-created agents may become another core IT responsibility.

MICROSOFT INTRODUCES FINOPS CONTROLS SPECIFICALLY FOR AI AND AGENTS

New Copilot and Agent 365 controls let admins manage spending policies, model availability, and usage-based agent costs as AI consumption starts looking more like cloud infrastructure spend.

SALESFORCE UNVEILS KOA, A REASONING MODEL BUILT SPECIFICALLY FOR CRM

Salesforce has introduced Koa, a reasoning model designed specifically for CRM workloads and Agentforce. Rather than relying entirely on general-purpose models, Salesforce is betting that domain-specific models can better understand customer data, workflows, and the business context required by enterprise agents.

AI FLUENCY ISN'T ENOUGH - COMPANIES STILL NEED HUMAN JUDGMENT

EY's Global Vice Chair argues that organizations shouldn't confuse widespread AI adoption with eliminating the need for human expertise. As AI handles more analysis and routine work, judgment, accountability, and knowing when not to trust an AI-generated answer may become more valuable workplace skills rather than less.

AMAZON BEDROCK GETS BETTER VISIBILITY INTO WHO'S ACTUALLY SPENDING YOUR AI BUDGET

AWS has added IAM-principal-level visibility that can help organizations break down Bedrock AI spending by team, project, or application. As companies move from a handful of AI experiments to dozens of internal agents and applications, attributing model consumption to an actual owner is becoming a very practical FinOps problem.

AR SMART GLASSES ARE MAKING ANOTHER RUN AT THE ENTERPRISE

AI integration is helping revive enterprise interest in smart glasses for factories, logistics, maintenance, and other hands-free workflows.

OPENAI AGENTS INTERACTED UNEXPECTEDLY WITH US GOVERNMENT WEBSITES

OpenAI says an ongoing review found agents accessing public information from government sites in unexpected ways, while an independent investigation identified additional activity involving government websites.

Grab your copy of the report

ANTHROPIC SIGNS $11.6 BILLION CLOUD DEAL WITH AKAMAI

Anthropic committed $11.6 billion over seven years to Akamai's cloud infrastructure to support growing CPU workloads. The agreement could expand by another $9 billion and includes warrants that could give Anthropic roughly a 5% stake in Akamai.

AWS BECOMES FIRST HYPERSCALER TO SECURE ‘NATO RESTRICTED' APPROVAL

Amazon Web Services has become the first hyperscaler to receive NATO Restricted approval, allowing member nations and defense partners to handle mission-critical restricted workloads across 15 qualifying AWS Regions. Evaluated by Spain's National Cryptographic Centre, the accreditation provides a pre-assisted security baseline and streamlined access to cloud capabilities for the alliance.

DATABRICKS ACQUIRES ROW ZERO FOR GOVERNED SPREADSHEETS

Databricks acquired Row Zero to bring a native spreadsheet interface to Genie, letting business teams analyze live enterprise data with built-in permissions and auditability. The planned integration supports familiar formulas and pivot tables while reducing reliance on exported files that lose governance controls.

THE HUMANOID LESSON, OR, WILL AI LEAVE ANYTHING FOR DATABASE RESEARCHERS TO DO?

Foundation models face the same tribal knowledge challenges as human workers rather than requiring specialized database architectures. Advances in general foundation models will continue to subsume custom agent harnesses, making standard software documentation practices the primary solution for semantic context.

UIPATH MAPS THE MISSING LAYER FOR ENTERPRISE AI WITH CARTOGRAPHER

UiPath announced Cartographer and the Map of Work at its FUSION 2026 event, introducing a new product designed to capture enterprise processes and generate governed process maps for AI agents and automations. The tool uses AI to absorb existing documentation, interview experts, and track decisions through a ledger to keep process maps continuously updated.

DEVIN NOW WORKS ACROSS MICROSOFT TEAMS AND MICROSOFT 365

Cognition has launched native support for @ mentioning Devin in Microsoft Teams alongside a first-party Microsoft 365 integration. The update allows Devin to participate directly in Teams chats, channels, and threads, as well as connect to mail, calendar, files, tasks, and directory services through Microsoft 365 MCP servers. The integrations feature delegated per-user permissions and resource-specific consent controls designed for security review.

DOCKER LAUNCHES CLOUD SANDBOXES FOR LONG-RUNNING AGENTS

Docker introduced managed cloud sandboxes that let coding agents keep working after developers disconnect, with a command to move sandbox files between local and cloud environments. Each agent runs in its own microVM, with configurable network access and usage-based compute pricing starting at $0.07 per hour.

UBUNTU MOVES TO WEEKLY KERNEL RELEASES AS CVES PILE UP

Canonical is replacing Ubuntu's existing kernel update cadence with overlapping two-week cycles that produce a release every week. The change aims to shorten patch delays as AI-assisted bug discovery and broader Linux CVE reporting increase the vulnerability backlog.

PINECONE BRINGS MANAGED VECTOR DATA TO CUSTOMER CLOUDS

Pinecone's Bring Your Own Cloud offering is generally available across AWS, Google Cloud, and Azure, keeping customer data and queries inside customer-controlled accounts. Pinecone manages upgrades and scaling through an outbound, pull-based mechanism without requiring standing inbound access to the environment.

KUBERNETES PATCHES WINDOWS KUBELET NTLM COERCION VIA SUBPATH

Kubernetes has fixed a medium-severity vulnerability designated CVE-2026-76654 in the Windows kubelet that could force NTLM authentication to an attacker-controlled network share.

ANDO TAKES ON SLACK

Ando is building team messaging designed for employees and AI agents to collaborate.

META BRINGS MUSE TO GLASSES AND UNVEILS $349 AUDIO FRAMES

Meta has announced plans to bring its Muse personal AI agent to its glasses, alongside new Ray-Ban Meta Audio frames starting at $349 and shipping October 13. The expanded lineup includes Ray-Ban Meta Gen 3 with improved battery life and controls, extending Meta's push toward hands-free AI assistance.

META UNVEILS $1,300 VR GLASSES WITH A PORTABLE WORKSPACE

Meta unveiled VR glasses weighing about 100 grams, with computing and battery hardware housed in a tethered puck, launching in Spring 2027 for $1,299.99. The device offers a private multi-screen workspace, virtual keyboard and touchpad, and photorealistic avatar calling through apps including Zoom and WhatsApp.