Loading story…
Amazon Web Services (AWS) has introduced a suite of autonomous AI-powered agents designed to automate and streamline DevOps and code modernization tasks. Announced at AWS re:Invent, these "frontier agents" are capable of operating for extended periods without human intervention, handling tasks such as code repository management, application failure monitoring, and code vulnerability analysis. The agents aim to reduce the manual burden on developers by automating the coordination and execution of complex workflows, allowing teams to focus on higher-level objectives rather than routine oversight.
In addition to the new DevOps agents, AWS has expanded its AWS Transform service with enhanced agentic capabilities for modernizing legacy code, applications, and infrastructure. The updated service now includes mainframe modernization agents that can analyze legacy code, generate automated test plans, and assist in migration planning by extracting business context from unstructured data. AWS is also enabling integration with third-party migration tools through its new composability initiative, further supporting enterprises in reducing technical debt and improving security by modernizing custom and legacy systems.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
AWS said Kiro was immediately available to developers, while the AWS Security Agent and AWS DevOps Agent were accessible through the AWS Management Console. The launch marked AWS's entry into a competitive market for AI-driven software, operations, and security automation.
At its re:Invent conference, AWS introduced three AI-powered frontier agents: Kiro for code management, AWS Security Agent, and AWS DevOps Agent. AWS said the agents can autonomously handle tasks such as repository updates, compliance checks, penetration testing, and root cause analysis across existing workflows.
AWS added new capabilities to AWS Transform, including mainframe modernization agents, enhanced VMware migration tools, and AWS Transform custom for applying learned code modernization patterns at scale. The update was positioned as a way to reduce technical debt in legacy code, applications, and infrastructure, while still requiring developer oversight.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
cio.com
Open sourceciodive.com
Open sourcezdnet.com
Open sourcecio.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon described two internal AWS disruptions tied to engineers using AI coding tools with operator-level permissions, emphasizing the incidents were **user error** rather than autonomous AI behavior. One event in December was described as an “extremely limited” impact affecting a single service in parts of mainland China, while a second incident reportedly did not affect a customer-facing AWS service. Amazon attributed the December issue to an access-control problem (“broader permissions than expected”) and said it implemented additional safeguards afterward, including **mandatory peer review** and staff training; employees also noted that normal two-person approval processes were bypassed in these cases. Separately, AWS expanded the ecosystem around coding agents by releasing **Agent Plugins for AWS**, an open-source plugin library that lets third-party coding agents perform AWS-specific actions (e.g., “deploy to AWS”) and generate architecture recommendations, cost estimates, and infrastructure-as-code for review before deployment. The initial *deploy-on-aws* plugin is designed to work in supported agent environments such as **Claude Code** and **Cursor**, increasing the ways AI agents can interact with AWS services—an expansion that heightens the importance of strong permissioning, review gates, and change-management controls highlighted by the earlier disruption reports.
Jun 29, 2026
AWS introduced **AWS DevOps Agent**, an AI-powered operations assistant designed to help DevOps and SRE teams investigate **AWS Network Firewall** connectivity incidents by analyzing telemetry and configuration data across AWS environments. The agent uses AWS APIs to review firewall logs, **VPC Flow Logs**, route tables, firewall policies, and recent **AWS CloudTrail** activity to identify likely root causes and recommend mitigations, aiming to speed diagnosis of outages and misconfigurations. AWS highlighted several troubleshooting scenarios, including blocked traffic caused by a domain deny list, packet drops tied to stateless rule priority conflicts, and asymmetric routing across Availability Zones. The service can also correlate incidents with recent infrastructure or application changes by integrating with repositories and CI/CD platforms such as **GitHub**, **GitLab Self-Managed**, **AWS CloudFormation**, **AWS CDK**, **Amazon ECR**, and **Terraform**, while alerting workflows can be tied into **Amazon CloudWatch**, **Amazon SNS**, **AWS Lambda**, and **AWS Secrets Manager** to support automated investigation and stronger deployment guardrails.
Jul 27, 2026
Amazon has introduced the **Amazon GuardDuty investigation agent** in public preview, adding an AI-powered capability that automates the first stages of investigating GuardDuty findings across AWS environments. The service correlates evidence and returns structured assessments with **risk levels**, **confidence scores**, **MITRE ATT&CK mappings**, affected resource details, and recommended remediation actions, aiming to cut investigation time from hours to minutes. It can scope investigations to a single finding, an AWS account, or an entire organization. The new capability is available through the **AWS Management Console**, **AWS CLI**, APIs, SDKs, and the official AWS MCP server, and it supports asynchronous investigations, natural-language prompts in the CLI, and integration with **Amazon EventBridge** and MCP-compatible AI assistants. AWS said the preview is offered at no additional cost in 10 Regions, with limits of 10 investigations per account per day and 100 total per account during the preview period. The company also introduced new IAM permissions for creating and retrieving investigations, and said processing uses cross-Region inference within the same geographic area while keeping stored data in the originating Region and encrypting data in transit.
Jul 21, 2026