Loading story…
Google released AX, an Apache 2.0-licensed open-source orchestrator and declarative runtime for deploying, executing, and scaling autonomous AI-agent workloads on Kubernetes. Built on Agent Substrate, AX represents agent sessions as isolated, stateful actor sandboxes that can be checkpointed while idle and resumed in sub-second time, avoiding cold-start delays.
AX's ax.io/v1alpha1 control plane provides Task, Workspace, Gateway, and Model primitives for workload lifecycle management, environment creation, credential injection, egress controls, and LLM configuration and secret handling. The platform targets enterprise and research deployments, using gVisor-isolated sandboxes and restrictive outbound-network policies, although early discussion identified Kubernetes operational overhead, immature secrets management, and egress-proxy connection issues as implementation concerns.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Google introduced AX, an Apache 2.0-licensed declarative orchestrator and runtime for executing and scaling autonomous AI-agent workloads on Kubernetes. The project was made available through agentexecutor.io and the google/ax GitHub repository.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI announced **GPT-5.3-Codex**, positioning it as more than a code-generation model and expanding its availability across a new macOS desktop app plus CLI, IDE extension, and web interface, with API access described as forthcoming. OpenAI and third-party coverage said the model is intended to support broader software-lifecycle work (e.g., debugging, deployments, monitoring, tests, and documentation) and highlighted benchmark gains over prior Codex versions; reporting also pushed back on claims that “Codex built itself,” characterizing OpenAI’s statement as the model being *instrumental* in its own development rather than fully autonomous. In parallel, OpenAI unveiled **Frontier**, an enterprise framework aimed at building, deploying, and managing AI agents, including promised agent security features and an approach modeled on Palantir-style **forward-deployed engineers** working alongside customer teams. Separately, *MintMCP* launched an enterprise governance platform focused on deploying, monitoring, and securing AI agents and MCP servers, emphasizing audit trails, policy enforcement, observability/guardrails, and centralized access controls to reduce risks from privileged agents (e.g., credential exposure and data exfiltration). Other items in the set were not tied to these launches, including a general CIO column on SMB IT “quick fixes” creating long-term risk and a corporate internal AI learning program announcement from Hancom.
Jun 29, 2026
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026
Cloudflare has open sourced **Cloudflare OS**, an internal platform built to control, isolate, and audit how AI agents access sensitive data and external tools. The system uses capability-based access controls and **Gatekeeper** services that hold credentials on an agent’s behalf, allowing policies to be enforced without exposing secrets directly to agent code. Cloudflare said the platform was designed to address security gaps in agent frameworks by limiting what agents can reach and by making their actions attributable and reviewable. A central feature is an observation log that records every resource an agent reads and uses that history to re-check whether downstream actions should still be allowed, extending beyond tool-permission models such as **Model Context Protocol**. Cloudflare said agent execution is isolated through **Dynamic Workers**, sandboxed browser frames, **Durable Object Facets**, and SQLite-backed application state, while model traffic is routed through **Cloudflare AI Gateway** for attribution, rate limiting, and budget controls. The company said Cloudflare OS is being released as open source before a broader managed product launch, with dashboard, development container, and Slack-integrated workspace features still in development.
Aug 23, 2026