Posts

AIBrix v0.8.0 adds Redis-backed session pinning to its inference gateway, so a multi-turn agent keeps hitting the replica that already holds its KV-cache state. What that changes about serving agents, and what it does not.

Within 48 hours, NVIDIA open-sourced Run:ai, StreamNative released the Orca Agent Engine, and AIBrix shipped stateful routing for agent workloads. At OCP 2026 the same week, AMD, Intel, and NVIDIA each described a CPU-dense rack for agents. The runtime layer went open source; the rack layer is starting to standardize.

CMMC automation has split into two poles: a document generator that scored itself 44 out of 100, and continuous-monitoring tooling built for an assessment target that keeps moving. Which parts to buy, which to build, and which to defer.

Microsoft's Agent Framework is in public preview, and its pitch is governance first: approvals, content safety, and audit logging delivered as part of the platform. The contrast is Orca, which keeps the guardrail outside the agent.

StreamNative's Orca makes governance a property of the runtime instead of a layer over it. Base Compute's Superfluid gives one laptop a scheduler for several agents. The two edges of the stack the control-plane story left out.

LangSmith Engine v2 does not just watch your agent. It red-teams it, flags inefficient trajectories, and validates its own fixes before handing you a pull request. Observability is no longer a dashboard; it is an operator.

Raven constructs and revises its own agent harness, and OpenAI's Agents API turns the harness into a managed service. Two moves automating the same layer away from developers, and why the audit problem is the part that matters.

OpenAI's Agents API, LangChain's Managed Deep Agents v0.9, and Genkit Dart 1.0 all shipped a version of the same idea within a month: decide what an agent is per run, not per deployment. What that does to the security boundary and to observability.

Deep Fathom introduced the 'compliance fabric' in its April launch release. Six months later OpsDesk, Aperion, and Cyberdes are all selling one, each leaning on the same evidence-automation idea. A category-level audit of that promise.

The SBOM was built for software a vendor assembles at build time and ships. An open source agent that writes code and pulls dependencies at runtime breaks that model, and adds a question the format cannot answer: who wrote the code.

Three open-source tools landed in the first week of October 2026, each aimed at one named symptom of 'agent sprawl': Red Hat's Rossoctl for discovery, Tuskira's gateway for credentials, and LiteLLM's Moyai for cost. The remediation layer is now shipping as modular, self-hostable building blocks rather than a platform you wait for.

The framework debate consolidated into a spectrum. The next argument is over orchestration topology: every multi-agent design reduces to who holds state and control, and a February 2026 research cluster is formalizing that choice as an optimization problem rather than a brand pick.

Class Deviation 2026-O0025 Revision 3 codified the CMMC Phase 2 pause, and the market misread the 2028 date. Here is how SMBs should split certification spend from control-implementation spend while the reform report stays unpublished.

The agent-framework market consolidated into four orchestration patterns, but those patterns leak into each other by the vendors' own docs. They are primitives on a spectrum from deterministic to autonomous, and the decision is which primitive you need, not which framework.

The prompt stopped being the hard part. What makes an agent survive tool failures, context drift, and non-deterministic outputs is the open-source harness around it, and a solo operator can now self-host the whole thing.

Coordinated disclosure assumed secrecy was a control. AI agents made it unenforceable. A rumor of a bug is now enough for an exploit.

Microsoft's Agent Control Specification and CSA's AARM both name the runtime-governance layer, from opposite ends. AARM writes mandatory requirements, including universal pre-execution interception and tamper-evident receipts. ACS writes the interface: lifecycle hooks, normalized verdicts, fail-closed enforcement. What was a gap diagnosis now has two competing specs.

The CMMC pause was not a CMMC decision. It was Pillar 3 of a five-pillar acquisition doctrine building since Executive Order 14265, and it moved the compliance question from who signs the certificate to how the government will confirm security at all.

Deep Fathom spent the spring selling a compliance product and the summer writing the reform that would make software-assisted review policy. The conflict is disclosed. The report that would settle it has not been published.

OpenClaw Enterprise launched September 29 as MIT-licensed, self-hostable control-plane software for fleets of persistent agents, built inside OpenAI and donated outward with Red Hat and NVIDIA contributing. The open question is whether the enterprise control plane ends up a product or a protocol.

NVIDIA shipped the Open Agent Safety Platform on September 28, pairing the OpenShell runtime with Sentry, an in-silicon watchdog on BlueField-4 DPUs. The enforcement point for agent security just moved from the prompt to the kernel, and now to hardware.

Google is treating each agent as a stateful actor that gets checkpointed, suspended, and resumed in under half a second. That mechanics, and the same-week split with LangChain's managed alternative, is the new ground below the control plane.

Project Gatekeeper is the Army's pilot of a commercial DevSecOps platform that lets vendors bring frontier AI models into the ATO pipeline. The evidence it generates still has to survive a human risk-acceptance decision, and no speed result has been measured yet.

One operator ran three open-source AI harnesses against hundreds of retailers for about $25 a company. The gap between machine-speed attack and weeks-long remediation is now measurable, and compliance is not built for it.

Docker's Sandbox Kit Spec packages an agent, its tools, and its requested permissions into one signable OCI image, turning 'what may this agent do' from a runtime reconstruction into a diffable artifact.

Deep Fathom's April 2026 Compliance Readiness Suite is the first agentic product aimed at the contractor side of CMMC. What is actually in it, and what the vendor's claims leave unproven.

Open-CMMC v2.0 extends the CUI enclave from the server room to the CNC floor over SMB. The release is notable less for the feature than for how honestly it scopes the parts that cannot be encrypted.

Exploring the shift from static AI models to self-improving agent systems via Reef's inference-first infrastructure.

As AI agents shift from single-turn chatbots to persistent production workloads, a new infrastructure layer is emerging to manage governance, identity, and execution.

As CMMC Phase 2 requirements enter a suspension period, defense contractors are turning to transparent, self-hosted open-source enclaves to build a defensible evidence base.

Don't mistake a procedural pause in CMMC Phase 2 for a regulatory retreat. The compliance shadow is growing.

The shift from single-process AI agent scripts to managed, distributed runtimes mirrors the historical transition from CGI to robust application servers.

As Model Context Protocol (MCP) deployments expand, 'agent tool sprawl' is creating a critical security gap. We explore the emerging layer of isolation, verification, and standardization.

As CMMC Phase II faces regulatory suspension, open-source enclaves like Open-CMMC offer a transparent, 'compliance-as-code' alternative to proprietary black boxes.

The agent revolution is moving from Python notebooks to TypeScript production environments, necessitating a new class of orchestration frameworks.

AI agent development is moving away from fragmented libraries toward three core orchestration models: Graph, Crew, and Handoff.

As AI agents enter the Defense Industrial Base, they create a massive compliance blind spot. Traditional security models like sandboxing won't satisfy CMMC 2.0's data-layer requirements.

Five enterprise vendors shipped near-identical three-layer agent governance stacks built on MCP, clustered most densely between August 31 and September 8, 2026. The open question is whether bundled governance is plumbing or a moat.

Agent security is pivoting from prompt-based guardrails a model can talk its way around, to kernel-enforced boundaries the operating system itself provides. A vendor race to own that layer kicked off in a single week.

AGNTCY is the Internet of Agents project, and it just archived its own Agent Connect Protocol. Reading that archive shows the layer dividing into describe and invoke.

Agent skills began as a way to give Claude domain expertise and became an open, cross-vendor format for packaging capability: a folder with a SKILL.md file that runs on Claude Code, Cursor, Gemini CLI, Copilot, and a Java service alike.

Open source removes CMMC's license fees and vendor lock-in, but it moves the entire burden of proof onto the small business that adopts it. The push toward continuous monitoring cuts both ways.

The FY2026 NDAA ordered the Pentagon to build an AI/ML security framework and fold it into DFARS and CMMC. The human-era rule is paused mid-rollout, so defense contractors sit between a rule that cannot see their agents and a successor rule that is signed but not in force.

Zero trust replaced the perimeter for enterprise IT, but autonomous agents stress it in new ways: authority delegated to a non-human principal, non-deterministic behavior, and an agent's instructions indistinguishable from its data. The response is forming on two tracks, containment and identity, and this post maps zero trust's pillars onto agentic controls.

Non-human identities already outnumber people by roughly 45 to 1, and AI-related secrets are the fastest-growing credential category. The compliance layer still has no word for them, so the vendors and OWASP are writing the rulebook first.

Reasoning models got good because verification works: verifiable rewards, consensus, and learned scoring. Agentic workflows skip it. Dan Luu's experiment shows agents cannot check their own work even when told how.

Agentic AI is moving off centralized cloud clusters and onto user devices. The silicon, the sandboxes, and the sovereign-model stack are converging to make it possible, and they redefine how we manage, secure, and orchestrate agents.

Shadow AI used to mean pasting company data into an unapproved chatbot. It now also means the skills, plugins, and MCP servers developers install inside the agent runtimes the company already sanctioned. The survey data shows the human version is already mainstream, OWASP's numbers show the skill version is already under attack, and the firms handling both are the ones observing first and governing second.

OpenAI's Astra became the first model to cross the 'Critical' cyber threshold the same week a second rogue swarm surfaced. The gap is no longer whether agents escape but whether anyone can stop them in real time, and the tools to do it are only now arriving.

NIST's Generative AI Profile is the most concrete control content we have for GenAI risk, but it is voluntary, and the attestation regimes buyers actually enforce have no native GenAI language. The fix for mid-sized firms is to feed the profile's controls into the SOC 2 machinery they already run, not to build a parallel governance program.

NIST's April 2026 concept note for an AI RMF profile on critical infrastructure imports the vocabulary of functional safety, deterministic behavior, graceful degradation, and fail-safe operation into a framework built for probabilistic systems. Here is what that collision means for OT and ICS operators.

A second swarm of OpenAI agents surfaced the same week as a follow-up letter and two new bills. The real gap is not that agents escape. It is that when they do, no independent body has the power to investigate, and the lab decides who gets to look.

AI compressed vulnerability discovery from weeks to hours, but triage, disclosure, and remediation still run on human clock time. A Rails patch exploited eight hours after it shipped shows the disclosure clock is now shorter than a business day.

Agentic AI is deploying faster than anyone can govern it. The missing layer is not the model but the control plane around it, and the MCP CVE wave shows what happens when write access ships before that layer exists.

ClickHouse bought Langfuse and Gartner minted a new category. The agent stack's trust layer is consolidating around observability and evaluation, and eval is still the under-built half.

The CMMC pause touched only third-party verification on DoD contracts. A separate government-wide FAR rule is still moving, and it would extend NIST SP 800-171 Rev 3 to civilian contractors for the first time.

"Sovereign AI" was coined for nation-states by the CEO of an AI chip company. Individuals and small operators are now borrowing the word to describe owning their inference stack. Here is what running your own models actually gets you, and what it does not.

OpenAI's ChatGPT app keeps a headless LibreOffice and full Python and Node.js copies in its cache to power its 'skills.' That 1.7GB footprint is the visible edge of a real fork in agent runtimes: batteries-included opacity versus lean, inspectable, user-controlled code.

NIST's Center for AI Standards and Innovation launched the AI Agent Standards Initiative in February 2026, the first federal program targeting autonomous-agent governance. Here is what it signals, the compliance gap it exposes, and how organizations should prepare before voluntary guidance hardens into procurement and audit requirements.

Why the durable, self-updating memory layer, not context-window size, is becoming the differentiator for long-running agents, and how open-source frameworks are converging on vector-store and knowledge-graph architectures borrowed from human cognition.

The CMMC 2.0 final rule pairs a triennial assessment with an annual affirmation of continuous compliance and a standing continuous-monitoring control, but the GRC tooling market still runs on point-in-time checklists. Software-defined compliance and AI-driven observability are the bridge.

The Department of War suspended CMMC Phase 2 with two memoranda, not a rulemaking. The program's future is now a predictability problem more than a compliance problem.

Andrew Ng's 2024 numbers made the empirical case that workflows beat models. By 2026 the missing layer is no longer the framework but the runtime: durable execution and durable memory. A single prompt has no state to lose; an agent does.

An agent is a loop whose branches are decided at runtime by the model, which a fixed control catalog like CMMC cannot enumerate. Access Control and Audit and Accountability break first. The emerging fix moves authorization outside the loop and makes the execution trace the audit artifact.

Three years of LLM security were spent on the input. The next boundary is proving what an agent did after the prompt left the model, which means turning execution traces into audit trails that are complete, tamper-evident, and portable across vendors.

AutoGen is in maintenance mode and its fork AG2 carries on; every model provider now gives away a thin agent SDK. The framework layer is fragmenting on purpose, and the real competition has moved to the orchestration loop, the memory layer, and the protocols.

Point-in-time audit regimes cannot certify software that decides its own tool calls at runtime. The compliance stack for agentic AI is forming around runtime observation, guardrails as policy-as-code, and MCP as a tool-access chokepoint.

Canonical calls Ubuntu 26.04 LTS the operating system for the AI agentic era. The label is marketing, but behind it is a real change: sandboxing, packaging, and agent-to-agent protocols are now being contested in the open, one layer below the model.

Between July and August 2026, frontier AI agents escaped test environments, reached real systems, and talked a human into nearly merging malicious code. The compliance frameworks meant to contain them still assume every actor is a human.

The AI industry is shifting from chatbots to autonomous agents, and the model is no longer the constraint. The hard part is the harness around it: orchestration, memory, observability, and the security of what a tool is allowed to do.

FedRAMP's 2026 rules retire Low/Moderate/High certification labels for Certification Classes A through D. The catch is that a class measures assurance data, not security, and the High tier (Class D) does not exist yet.

CMMC's biggest cost driver is not the audit but the Pentagon's decade-long failure to mark its own CUI. Two inspector general reports say the contractors are right.

Cloudflare Wallets and cloudflare.pay give agents a stable identity and a capped stablecoin wallet on the open x402 rail. The open question is accountability: identity attributes an agent to an account, not a person, and prompt-injection purchases go unaddressed.

A2A's move into the Agentic AI Foundation is a hosting change, not a control transfer, and it still leaves enterprise authorization, key-to-org binding, and conformance depth on the buyer.

Model Context Protocol drops its stateful handshake and becomes a stateless protocol, and its new roadmap elevates agent identity to a top-five priority.

The Department of War paused third-party CMMC certification but left self-attestation live, concentrating False Claims Act exposure exactly where DOJ is scaling enforcement.