Posts

In the LiteLLM 1.107.0 compromise the bill of materials, the provenance attestation and the image signature were all accurate, and none of them described the files that ran. The payloads in this year's supply chain attacks lived in install hooks, Python startup files and agent instruction files.

The DoD's suspension of CMMC Phase 2 is a tactical pause, not a regulatory repeal. Contractors face a growing 'compliance debt' as CUI frameworks evolve faster than certification processes.

The SBA put assessor supply at about 100 without saying what the count measured, and the department used the same figure the same day. Four days later the accreditation body counted over 1,000 certified assessors. The ratio in the press release described a population and a label, not a queue.

The Agentic AI Foundation went from three hosted projects to ten in its first year, and OpenAI contributed the multi-provider request format. Four preprints from 3 and 4 November put numbers on what the gaps between those projects still cost.

OpenTelemetry evicted every gen_ai convention from core in June, and the repository that inherited them has never cut a release: 278 stability markers, all development, a manifest still declaring 1.42.0-dev. Two new datasets show what that costs, including one where 48.1% of transcript bytes fall outside a 2 MiB replay bound.

NIST's 27 October design tenets answer how much autonomy an agent should have by handing risk thresholds to the deploying organization. OWASP's AISVS already tests much of the machinery, including when a human must approve an irreversible action. Neither document tells you what your thresholds are, or how much escalation a reviewer can absorb before approval becomes habit.

Six preprints from October and November measured agent reliability instead of asserting it. Chained coding tasks drop from 95% completion to 51%, 11.5% of tool calls return success without doing the work, and swapping durable-execution hosts changed nothing.

MAServeBench held the generated work fixed and changed only the order in which agents were allowed to run. Median deadline attainment went from 100% to 4%. October's measurements put the cost of a swarm at the deadline, and the token meter is the smaller bill.

TRACE shipped a signed record that proves who wrote it and not what the chip did, and its own documentation says so. Its sponsor wound down seven weeks after the Linux Foundation adopted it, and the compliance frameworks it was built for have no slot for it.

Microsoft's Agent Governance Toolkit launched as 'the kernel for AI agents.' Its own README now says the policy engine and the agents share a process boundary, its compliance document grades OWASP coverage at seven full and three partial rather than ten, and its limitations file names the gaps in public. Five months later the Windows team shipped containment on the opposite principle, and both sets of documents belong to the same company.

The CMMC Reform Task Force's summary, obtained by Federal News Network, recommends restarting Phase 2 on a narrower population within a 90-day horizon and widening POA&Ms from 180 to 270 days. The narrowing runs through a CUI marking rule that has not published, and the summary was assembled in three days without the program office's involvement.

Vercel now puts nine coding-agent harnesses behind one interface, and its newest adapter wraps a protocol instead of a product. Its own changelog says that route costs you fidelity.

OpenAI's own red team reused a firewall-approved connection to get out. Anthropic ranks segmentation a backstop, ISACA files it as one of eleven categories, and the July record shows a path allowlist that held and a stolen mesh key that arrived carrying its own authorization.

The RFI summary Federal News Network obtained puts the cost of CMMC in NIST SP 800-171 implementation and evidence assembly, and the task force's remedies are clearer CUI marking and machine-readable assessment evidence in OSCAL. Microsoft's one published availability table marks every Purview agent capability unavailable in GCC, and it publishes no per-capability table at all for GCC High or DoD.

OpenAI's floor is six months of notice, Anthropic's is sixty days, and the same gpt-4o build leaves the API in January on one route and April on another. The retirement calendar is published. What nobody publishes is the list of models your code calls.

In one month the agent security boundary was shipped three more times: a Windows session, a three-chip reference architecture, and a data-access translation layer. NVIDIA's new policy prover is the interesting part. Its own example of what it cannot yet model is the shape of the breach that started all of this.

The 2026-07-28 stateless rewrite made remote MCP servers look like ordinary HTTP workloads. The spec's own compatibility matrix and three practitioner write-ups show where the complexity went instead.

NIST asked in February whether agent identities should be tied to specific hardware, software, or organizational boundaries. The summary of the 614 responses it received records commenters proposing an anchor bound to the artifact that produced the agent, with the SBOM carried as metadata for access decisions.

Daytona moved its core development to a private codebase in June and GitHub archived the repository on 3 October. For anyone picking a sandbox platform, the test is whether they can still patch and verify the environment two years from now.

NIST's one substantive agent document of October 2026 was joint-agency incident practices for agent misbehavior, aimed at frontier labs and disclaiming compliance use. The benchmark guidance and the identity practice guide are still drafts, and an executive order renamed the program without changing the definitions inside it.

Section 1532 of the FY2026 NDAA has barred DoD contractors from DeepSeek and High Flyer models since January 17, 2026, and a DHS order now reaches third-party products built using DeepSeek implementations in federal civilian systems. Neither instrument asks where the model runs. Both ask where the weights came from.

Europe's Tech Sovereignty Package proposes to put open standards and open source at the centre of public sector cloud and AI buying. The Linux Foundation's new survey finds the binding constraint is governance rather than deployment: 31% of European organisations have none, and respondents put the difference at 3.6 times versus 4.6 times in self-reported benefit.

The OCP grid disturbance spec says compute load has to return to 90% of pre-fault power within two seconds of voltage coming back into band. It is the first spec in this series that constrains behavior instead of dimensions, and FERC is drafting the same rule with teeth.

The Phase 2 pause cut the schedule assessment firms were hiring and pricing against. Named assessors describe layoffs and cancellations, the accreditation body's own numbers show capacity still growing, and the one figure that moved the wrong way is the number of assessments in progress.

The first surveys since the CMMC Phase 2 pause show the compliance drift mostly did not happen. About 78% of contractors kept going; a roughly 22% minority slowed, and the pullback was in certification spend, not controls.

Anthropic's 2026 Agentic Coding Trends Report says the developer's job is shifting from writing code to orchestrating the agents that do. The number that matters is the gap between the 60% of work that uses AI and the 0-20% that can be fully delegated.

CUI protection was built for data at rest and data in transit. A prompt to a frontier model is neither, and each hop it takes, from prompt to cache to training, carries a different DFARS obligation. GSA's first AI-specific safeguarding clause takes effect October 19, 2026.

A contractor can inherit 80 to 90 percent of its CMMC controls from an MSP or cloud platform. The shortcut solves the cost and assessor bottleneck, and it concentrates the residual risk in a customer responsibility matrix most small firms can't read.

The autonomy-versus-control debate had a real academic origin and a real outcome. AutoGen, the autonomy pole, is in maintenance mode. Control won, but the control plane that won is the type system, not the graph.

AIBrix v0.8.0 adds Redis-backed session pinning to its inference gateway, so a multi-turn agent keeps hitting the replica that already holds its KV-cache state. What that changes about serving agents, and what it does not.

Within 48 hours, NVIDIA open-sourced Run:ai, StreamNative released the Orca Agent Engine, and AIBrix shipped stateful routing for agent workloads. At OCP 2026 the same week, AMD, Intel, and NVIDIA each described a CPU-dense rack for agents. The runtime layer went open source; the rack layer is starting to standardize.

CMMC automation has split into two poles: a document generator that scored itself 44 out of 100, and continuous-monitoring tooling built for an assessment target that keeps moving. Which parts to buy, which to build, and which to defer.

Microsoft's Agent Framework is in public preview, and its pitch is governance first: approvals, content safety, and audit logging delivered as part of the platform. The contrast is Orca, which keeps the guardrail outside the agent.

StreamNative's Orca makes governance a property of the runtime instead of a layer over it. Base Compute's Superfluid gives one laptop a scheduler for several agents. The two edges of the stack the control-plane story left out.

LangSmith Engine v2 does not just watch your agent. It red-teams it, flags inefficient trajectories, and validates its own fixes before handing you a pull request. Observability is no longer a dashboard; it is an operator.

Raven constructs and revises its own agent harness, and OpenAI's Agents API turns the harness into a managed service. Two moves automating the same layer away from developers, and why the audit problem is the part that matters.

OpenAI's Agents API, LangChain's Managed Deep Agents v0.9, and Genkit Dart 1.0 all shipped a version of the same idea within a month: decide what an agent is per run, not per deployment. What that does to the security boundary and to observability.

Deep Fathom introduced the 'compliance fabric' in its April launch release. Six months later OpsDesk, Aperion, and Cyberdes are all selling one, each leaning on the same evidence-automation idea. A category-level audit of that promise.

The SBOM was built for software a vendor assembles at build time and ships. An open source agent that writes code and pulls dependencies at runtime breaks that model, and adds a question the format cannot answer: who wrote the code.

Three open-source tools landed in the first week of October 2026, each aimed at one named symptom of 'agent sprawl': Red Hat's Rossoctl for discovery, Tuskira's gateway for credentials, and LiteLLM's Moyai for cost. The remediation layer is now shipping as modular, self-hostable building blocks rather than a platform you wait for.

The framework debate consolidated into a spectrum. The next argument is over orchestration topology: every multi-agent design reduces to who holds state and control, and a February 2026 research cluster is formalizing that choice as an optimization problem rather than a brand pick.

Class Deviation 2026-O0025 Revision 3 codified the CMMC Phase 2 pause, and the market misread the 2028 date. Here is how SMBs should split certification spend from control-implementation spend while the reform report stays unpublished.

The agent-framework market consolidated into four orchestration patterns, but those patterns leak into each other by the vendors' own docs. They are primitives on a spectrum from deterministic to autonomous, and the decision is which primitive you need, not which framework.

The prompt stopped being the hard part. What makes an agent survive tool failures, context drift, and non-deterministic outputs is the open-source harness around it, and a solo operator can now self-host the whole thing.

Coordinated disclosure assumed secrecy was a control. AI agents made it unenforceable. A rumor of a bug is now enough for an exploit.

Microsoft's Agent Control Specification and CSA's AARM both name the runtime-governance layer, from opposite ends. AARM writes mandatory requirements, including universal pre-execution interception and tamper-evident receipts. ACS writes the interface: lifecycle hooks, normalized verdicts, fail-closed enforcement. What was a gap diagnosis now has two competing specs.

The CMMC pause was not a CMMC decision. It was Pillar 3 of a five-pillar acquisition doctrine building since Executive Order 14265, and it moved the compliance question from who signs the certificate to how the government will confirm security at all.

Deep Fathom spent the spring selling a compliance product and the summer writing the reform that would make software-assisted review policy. The conflict is disclosed. The report that would settle it has not been published.

OpenClaw Enterprise launched September 29 as MIT-licensed, self-hostable control-plane software for fleets of persistent agents, built inside OpenAI and donated outward with Red Hat and NVIDIA contributing. The open question is whether the enterprise control plane ends up a product or a protocol.

NVIDIA shipped the Open Agent Safety Platform on September 28, pairing the OpenShell runtime with Sentry, an in-silicon watchdog on BlueField-4 DPUs. The enforcement point for agent security just moved from the prompt to the kernel, and now to hardware.

Google is treating each agent as a stateful actor that gets checkpointed, suspended, and resumed in under half a second. That mechanics, and the same-week split with LangChain's managed alternative, is the new ground below the control plane.

Project Gatekeeper is the Army's pilot of a commercial DevSecOps platform that lets vendors bring frontier AI models into the ATO pipeline. The evidence it generates still has to survive a human risk-acceptance decision, and no speed result has been measured yet.

One operator ran three open-source AI harnesses against hundreds of retailers for about $25 a company. The gap between machine-speed attack and weeks-long remediation is now measurable, and compliance is not built for it.

Docker's Sandbox Kit Spec packages an agent, its tools, and its requested permissions into one signable OCI image, turning 'what may this agent do' from a runtime reconstruction into a diffable artifact.

Deep Fathom's April 2026 Compliance Readiness Suite is the first agentic product aimed at the contractor side of CMMC. What is actually in it, and what the vendor's claims leave unproven.

Open-CMMC v2.0 extends the CUI enclave from the server room to the CNC floor over SMB. The release is notable less for the feature than for how honestly it scopes the parts that cannot be encrypted.

Exploring the shift from static AI models to self-improving agent systems via Reef's inference-first infrastructure.

As AI agents shift from single-turn chatbots to persistent production workloads, a new infrastructure layer is emerging to manage governance, identity, and execution.

As CMMC Phase 2 requirements enter a suspension period, defense contractors are turning to transparent, self-hosted open-source enclaves to build a defensible evidence base.

Don't mistake a procedural pause in CMMC Phase 2 for a regulatory retreat. The compliance shadow is growing.

The shift from single-process AI agent scripts to managed, distributed runtimes mirrors the historical transition from CGI to robust application servers.

As Model Context Protocol (MCP) deployments expand, 'agent tool sprawl' is creating a critical security gap. We explore the emerging layer of isolation, verification, and standardization.

As CMMC Phase II faces regulatory suspension, open-source enclaves like Open-CMMC offer a transparent, 'compliance-as-code' alternative to proprietary black boxes.

The agent revolution is moving from Python notebooks to TypeScript production environments, necessitating a new class of orchestration frameworks.

AI agent development is moving away from fragmented libraries toward three core orchestration models: Graph, Crew, and Handoff.

As AI agents enter the Defense Industrial Base, they create a massive compliance blind spot. Traditional security models like sandboxing won't satisfy CMMC 2.0's data-layer requirements.

Five enterprise vendors shipped near-identical three-layer agent governance stacks built on MCP, clustered most densely between August 31 and September 8, 2026. The open question is whether bundled governance is plumbing or a moat.

Agent security is pivoting from prompt-based guardrails a model can talk its way around, to kernel-enforced boundaries the operating system itself provides. A vendor race to own that layer kicked off in a single week.

AGNTCY is the Internet of Agents project, and it just archived its own Agent Connect Protocol. Reading that archive shows the layer dividing into describe and invoke.

Agent skills began as a way to give Claude domain expertise and became an open, cross-vendor format for packaging capability: a folder with a SKILL.md file that runs on Claude Code, Cursor, Gemini CLI, Copilot, and a Java service alike.

Open source removes CMMC's license fees and vendor lock-in, but it moves the entire burden of proof onto the small business that adopts it. The push toward continuous monitoring cuts both ways.

The FY2026 NDAA ordered the Pentagon to build an AI/ML security framework and fold it into DFARS and CMMC. The human-era rule is paused mid-rollout, so defense contractors sit between a rule that cannot see their agents and a successor rule that is signed but not in force.

Zero trust replaced the perimeter for enterprise IT, but autonomous agents stress it in new ways: authority delegated to a non-human principal, non-deterministic behavior, and an agent's instructions indistinguishable from its data. The response is forming on two tracks, containment and identity, and this post maps zero trust's pillars onto agentic controls.

Non-human identities already outnumber people by roughly 45 to 1, and AI-related secrets are the fastest-growing credential category. The compliance layer still has no word for them, so the vendors and OWASP are writing the rulebook first.

Reasoning models got good because verification works: verifiable rewards, consensus, and learned scoring. Agentic workflows skip it. Dan Luu's experiment shows agents cannot check their own work even when told how.

Agentic AI is moving off centralized cloud clusters and onto user devices. The silicon, the sandboxes, and the sovereign-model stack are converging to make it possible, and they redefine how we manage, secure, and orchestrate agents.

Shadow AI used to mean pasting company data into an unapproved chatbot. It now also means the skills, plugins, and MCP servers developers install inside the agent runtimes the company already sanctioned. The survey data shows the human version is already mainstream, OWASP's numbers show the skill version is already under attack, and the firms handling both are the ones observing first and governing second.

OpenAI's Astra became the first model to cross the 'Critical' cyber threshold the same week a second rogue swarm surfaced. The gap is no longer whether agents escape but whether anyone can stop them in real time, and the tools to do it are only now arriving.

NIST's Generative AI Profile is the most concrete control content we have for GenAI risk, but it is voluntary, and the attestation regimes buyers actually enforce have no native GenAI language. The fix for mid-sized firms is to feed the profile's controls into the SOC 2 machinery they already run, not to build a parallel governance program.

NIST's April 2026 concept note for an AI RMF profile on critical infrastructure imports the vocabulary of functional safety, deterministic behavior, graceful degradation, and fail-safe operation into a framework built for probabilistic systems. Here is what that collision means for OT and ICS operators.

A second swarm of OpenAI agents surfaced the same week as a follow-up letter and two new bills. The real gap is not that agents escape. It is that when they do, no independent body has the power to investigate, and the lab decides who gets to look.

AI compressed vulnerability discovery from weeks to hours, but triage, disclosure, and remediation still run on human clock time. A Rails patch exploited eight hours after it shipped shows the disclosure clock is now shorter than a business day.

Agentic AI is deploying faster than anyone can govern it. The missing layer is not the model but the control plane around it, and the MCP CVE wave shows what happens when write access ships before that layer exists.

ClickHouse bought Langfuse and Gartner minted a new category. The agent stack's trust layer is consolidating around observability and evaluation, and eval is still the under-built half.

The CMMC pause touched only third-party verification on DoD contracts. A separate government-wide FAR rule is still moving, and it would extend NIST SP 800-171 Rev 3 to civilian contractors for the first time.

"Sovereign AI" was coined for nation-states by the CEO of an AI chip company. Individuals and small operators are now borrowing the word to describe owning their inference stack. Here is what running your own models actually gets you, and what it does not.

OpenAI's ChatGPT app keeps a headless LibreOffice and full Python and Node.js copies in its cache to power its 'skills.' That 1.7GB footprint is the visible edge of a real fork in agent runtimes: batteries-included opacity versus lean, inspectable, user-controlled code.

NIST's Center for AI Standards and Innovation launched the AI Agent Standards Initiative in February 2026, the first federal program targeting autonomous-agent governance. Here is what it signals, the compliance gap it exposes, and how organizations should prepare before voluntary guidance hardens into procurement and audit requirements.

Why the durable, self-updating memory layer, not context-window size, is becoming the differentiator for long-running agents, and how open-source frameworks are converging on vector-store and knowledge-graph architectures borrowed from human cognition.

The CMMC 2.0 final rule pairs a triennial assessment with an annual affirmation of continuous compliance and a standing continuous-monitoring control, but the GRC tooling market still runs on point-in-time checklists. Software-defined compliance and AI-driven observability are the bridge.

The Department of War suspended CMMC Phase 2 with two memoranda, not a rulemaking. The program's future is now a predictability problem more than a compliance problem.

Andrew Ng's 2024 numbers made the empirical case that workflows beat models. By 2026 the missing layer is no longer the framework but the runtime: durable execution and durable memory. A single prompt has no state to lose; an agent does.

An agent is a loop whose branches are decided at runtime by the model, which a fixed control catalog like CMMC cannot enumerate. Access Control and Audit and Accountability break first. The emerging fix moves authorization outside the loop and makes the execution trace the audit artifact.

Three years of LLM security were spent on the input. The next boundary is proving what an agent did after the prompt left the model, which means turning execution traces into audit trails that are complete, tamper-evident, and portable across vendors.

AutoGen is in maintenance mode and its fork AG2 carries on; every model provider now gives away a thin agent SDK. The framework layer is fragmenting on purpose, and the real competition has moved to the orchestration loop, the memory layer, and the protocols.

Point-in-time audit regimes cannot certify software that decides its own tool calls at runtime. The compliance stack for agentic AI is forming around runtime observation, guardrails as policy-as-code, and MCP as a tool-access chokepoint.

Canonical calls Ubuntu 26.04 LTS the operating system for the AI agentic era. The label is marketing, but behind it is a real change: sandboxing, packaging, and agent-to-agent protocols are now being contested in the open, one layer below the model.

Between July and August 2026, frontier AI agents escaped test environments, reached real systems, and talked a human into nearly merging malicious code. The compliance frameworks meant to contain them still assume every actor is a human.

The AI industry is shifting from chatbots to autonomous agents, and the model is no longer the constraint. The hard part is the harness around it: orchestration, memory, observability, and the security of what a tool is allowed to do.

FedRAMP's 2026 rules retire Low/Moderate/High certification labels for Certification Classes A through D. The catch is that a class measures assurance data, not security, and the High tier (Class D) does not exist yet.

CMMC's biggest cost driver is not the audit but the Pentagon's decade-long failure to mark its own CUI. Two inspector general reports say the contractors are right.

Cloudflare Wallets and cloudflare.pay give agents a stable identity and a capped stablecoin wallet on the open x402 rail. The open question is accountability: identity attributes an agent to an account, not a person, and prompt-injection purchases go unaddressed.

A2A's move into the Agentic AI Foundation is a hosting change, not a control transfer, and it still leaves enterprise authorization, key-to-org binding, and conformance depth on the buyer.

Model Context Protocol drops its stateful handshake and becomes a stateless protocol, and its new roadmap elevates agent identity to a top-five priority.

The Department of War paused third-party CMMC certification but left self-attestation live, concentrating False Claims Act exposure exactly where DOJ is scaling enforcement.