Silmaril CTO Weekly

Good morning, Eduardo. It is Monday, June 22. The most useful artifact from last week was a score returned in the middle of an agent loop. AWS introduced a Bedrock Guardrails API that lets a developer call one safety check at a chosen point in the workflow and receive numeric scores rather than a single yes-or-no verdict (company post). Two days later, Tenet published a disclosure showing how a fake monitoring event could steer coding agents through trusted error-triage workflows and into dangerous actions (research disclosure). Those two items belong together. One shows where the control wants to live. The other shows where attackers expect the control to be missing. In the bulletin: Google described customer-driven changes to Model Armor and a separate push to make remote MCP servers easier to deploy on GKE. 42Crunch put API-security checks directly inside GitHub Copilot. Research papers pulled agent state, probability, and authority out of the prompt and into inspectable structures. Robotics papers made the same argument with physical memory and navigation uncertainty. And two AI-agent security startups, NeuralTrust and Tenet, raised fresh capital by naming the same operational gap from different sides. A Check At The Moment Of Action AWS's June 16 Bedrock Guardrails release is worth treating as a product signal rather than another guardrail announcement. The InvokeGuardrailChecks API (company post) lets teams run individual safeguards inside a multi-turn agent loop, in detect-only mode, and use returned scores to block, retry, log, or continue in their own application logic. The important detail is placement. The check can sit after a tool result, before a tool call, or at another point where the agent is about to turn language into action. Google's Model Armor post from the same day (company post) used different language and arrived through a customer-collaboration story, but the contour was similar. Google framed Model Armor as runtime security for generative and agentic AI, shaped by work with a telecom customer trying to productionize a GenAI support platform on Agent Development Kit and Agent Platform. The companion GKE post on June 17 (product documentation) showed how remote MCP servers can be deployed into a managed Kubernetes environment. Put those together and the cloud-platform read is practical: the platform vendors are standardizing both the tool connection and the inspection layer around it. 42Crunch's June 16 GitHub Copilot plugin announcement (company post) pulls the same theme into developer workflow. The company is selling deterministic API security guardrails for Copilot-generated code, with audit, testing, remediation, and validation embedded where the code is produced. That matters for Silmaril because the enterprise buyer will increasingly expect agent security to show up in the path of work, not as a detached scanner. The best place to earn trust is the last normal checkpoint before an agent acts. State Is Leaving The Prompt Several research papers last week were quiet but useful because they took state management seriously. LedgerAgent (preprint) argues that tool-calling agents fail when task state is left implicit in the prompt. Customer-service agents have to remember facts, identifiers, constraints, policy conditions, and tool results across turns. LedgerAgent separates that state into a structured ledger so the agent can decide from a current representation instead of reconstructing everything from a long conversation. Sovereign Execution Brokers (preprint) makes the authority problem more explicit. The paper argues that production mutation authority should sit behind a runtime enforcement boundary, where a broker verifies certificate-bound permission at the moment an agent tries to change cloud, deployment, or data-control state. Efficient and Sound Probabilistic Verification for AI Agents (preprint) approaches the same wall from formal methods. It asks how a monitor can enforce Datalog-style policies when a predicate, such as a PII detector, has uncertainty rather than perfect truth values. The research implication is close to Silmaril's product surface. A prompt transcript alone is a weak record of why an agent acted. A structured state record, an authority certificate, and a probabilistic policy check give a customer something they can replay, audit, and tune. That is the difference between telling a buyer an agent was safe and showing which state, policy, score, and permission produced the decision. Model-transparency research widened the frame. How Transparent is DiffusionGemma? (preprint) studied whether a diffusion language model's intermediate denoising steps can be mapped through an interpretable token bottleneck without losing downstream performance. Optimal Deterministic Multicalibration and Omniprediction (preprint) resolved a technical calibration question by giving deterministic predictors minimax-optimal sample complexity for multicalibration. Both papers are upstream from product work, but they push in the same direction: useful assurance comes from intermediate objects that can be interpreted, calibrated, and checked. The Error Log Became An Instruction Channel Tenet's Agentjacking disclosure was the week's sharpest public attack story (research disclosure). The company said a crafted monitoring event could be ingested by normal error-reporting infrastructure, then shown to an AI coding agent as trusted diagnostic context. Tenet reported 2,388 exposed organizations in its scan and said more than 100 agents acted on injected errors during controlled testing. The public write-up names affected agent classes including Cursor, Claude Code, and Codex, and says Tenet also released hardening configs for Cursor and Claude Code. The responsible read is the class, not the payload. As coding agents connect to monitoring, ticketing, and incident systems, untrusted operational data can become an instruction channel. A dashboard, stack trace, alert, or bug report may look like evidence to a developer and command text to an agent. This is exactly where Silmaril's story should be concrete: which external fields were read, which trust boundary they crossed, which tool call was requested, and what stopped the action. The paper stream reinforced that attack surface. From Efficiency to Leakage (preprint) described a privacy backdoor in federated language-model fine-tuning, where a malicious parameter server can corrupt parameter-efficient adapters so training samples can be reconstructed later. Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems (preprint) modeled prompt-injection and jailbreak probing as an automated attacker-defense game. Calibration Without Comprehension (preprint) tested LLM vulnerability detection on Linux kernel samples and found that fine-tuned models can look calibrated while still missing the causal structure of vulnerable code. Regular security advisories kept the old substrate in view. CISA added exploited vulnerabilities in LiteSpeed's cPanel plugin, Cisco Catalyst SD-WAN Manager, Joomla Content Editor, and Splunk Enterprise during the window (security advisories). Chrome's June 16 stable update listed 33 security fixes, including multiple critical flaws in browser surfaces that agents can touch indirectly through developer machines and web workflows (security advisory). Agent security does not replace patch discipline. It inherits its failures and then adds memory, tools, and autonomy on top. The Physical Papers Are Saying Boundaries Matter Deep-tech work last week made the same argument without using security language. MemoryWAM (preprint) introduced a world action model for robotic manipulation with persistent memory. The authors combine recent frames, event-boundary anchor frames, and compact gist tokens so a robot can use long-range history without paying the full inference cost of every prior observation. GroundControl (preprint) looked at vision-language navigation agents and tried to predict failures such as oscillation, stagnation, or inefficient detours from trajectory-consistent uncertainty estimates. Those papers are useful because physical agents make abstraction expensive. A robot arm, a mobile navigator, or a wearable camera system cannot hide a bad state model behind fluent language. Generating Robot Hands from Human Demonstrations (preprint) used more than four million frames of human fingertip motion to derive hand designs that can reproduce target motions with a simple control policy. UNIEGO (preprint) trained an egocentric video encoder through proxy-mediated distillation from nine teacher sources across views and modalities. For you, the deep-tech read is a check on product language. As AI moves into action, the winning systems are becoming more explicit about memory, uncertainty, embodiment, and state transfer. The security version of that is straightforward. If an agent's memory is compressed, inherited, or summarized, the control plane needs to know what was retained. If an agent's confidence changes along a trajectory, the log should show when the risk rose. If an agent takes action through a tool, the record should preserve enough structure to reconstruct the decision without trusting the model's narration after the fact. Capital Is Following The Control Plane The startup news was unusually aligned with the technical evidence. NeuralTrust announced a $20 million seed round on June 17 (company announcement), positioning itself around Agent Runtime Security, an agent gateway called TrustGate, and posture management through TrustLens. Its announcement claims that large enterprises will run sprawling agent estates across providers, vendor software, databases, and tools, with security teams unable to say how many agents are active or what each can do. Tenet emerged from stealth the same day with $6 million in seed funding (company announcement). Its founders point back to Cisco AI Defense research and describe a platform sensor that watches operating-system behavior, network and API activity, and LLM reasoning without requiring gateways, proxies, or SDKs. The claimed differentiator is Agent-Side Simulation, where the product simulates likely next moves before suspicious agent actions execute against real infrastructure. These are company claims, and they need to be treated with that weight. Still, the funding pattern is useful. Startups are not raising around generic "AI safety" language here. They are raising around inventory, runtime detection, tool-call brokerage, and pre-action containment. Google also pushed the platform side of this story with new data agents across its Agentic Data Cloud (company post), emphasizing grounded enterprise data and governance. The commercial vocabulary is narrowing around control planes for systems that can act. That creates a practical GTM test for Silmaril this week. A prospect should be able to understand the product as an answer to a concrete operational question: when an agent reads untrusted data, calls a tool, inherits state, or touches credentials, what can be seen, scored, stopped, and replayed? If that answer is crisp, the category feels necessary. If it turns into broad assurance language, competitors with registries, gateways, or Copilot plugins will sound closer to the buyer's daily workflow. Monday Operating Read I would carry three priorities into this week. First, keep product language pinned to the action boundary. The strongest sources this week all converge on that point: a Bedrock score before a decision, a Copilot security check during coding, a Model Armor inspection layer around agentic apps, and a Tenet disclosure where monitoring data became agent input. Second, make structured state a first-class artifact. LedgerAgent, Sovereign Execution Brokers, and the probabilistic verification paper give you vocabulary for a stronger claim: Silmaril should not merely observe a prompt and response. It should preserve the state, authority, policy, and uncertainty that shaped an agent's action. Third, treat telemetry ingestion as a near-term demo path. The Tenet disclosure will make buyers more receptive to a concrete story around Sentry, logs, tickets, alerts, and MCP-connected operational systems. A small, legible example that shows untrusted telemetry entering an agent workflow, receiving a risk score, and being stopped before a tool call would fit the week better than a broad category deck. Sources https://aws.amazon.com/blogs/machine-learning/safeguard-your-agentic-ai-applications-with-the-amazon-bedrock-guardrails-invokeguardrailchecks-api/ https://cloud.google.com/blog/topics/developers-practitioners/how-customer-collaboration-is-shaping-the-future-of-genai-security-with-model-armor https://cloud.google.com/blog/topics/developers-practitioners/build-and-deploy-a-remote-mcp-server-to-gke-in-30-minutes https://42crunch.com/42crunch-and-github-copilot-bring-deterministic-api-security-guardrails-to-agentic-devsecops/ https://arxiv.org/abs/2606.20529 https://arxiv.org/abs/2606.20520 https://arxiv.org/abs/2606.20510 https://arxiv.org/abs/2606.20560 https://arxiv.org/abs/2606.20557 https://tenetsecurity.ai/blog/agentjacking-coding-agents-with-fake-sentry-errors/ https://arxiv.org/abs/2606.20553 https://arxiv.org/abs/2606.20470 https://arxiv.org/abs/2606.20502 https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalog https://www.cisa.gov/news-events/alerts/2026/06/16/cisa-adds-one-known-exploited-vulnerability-catalog https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-adds-one-known-exploited-vulnerability-catalog https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html https://arxiv.org/abs/2606.20562 https://arxiv.org/abs/2606.20479 https://arxiv.org/abs/2606.20549 https://arxiv.org/abs/2606.20559 https://neuraltrust.ai/news/neuraltrust-raises-20m https://tenetsecurity.ai/blog/tenet-emerges-from-stealth-with-6m-to-secure-enterprise-ai-agents/ https://cloud.google.com/blog/products/data-analytics/new-data-agents-across-the-agentic-data-cloud