Armakuni invests $5 million in running and securing AI agents on AWS

What this year has shown#

In July, Hugging Face disclosed an intrusion that it attributed to an autonomous AI agent. A malicious dataset was used to exploit two code-execution flaws in its data-processing pipeline; from there the AI agent took cloud and cluster credentials and moved across internal clusters, across many short-lived sandboxes. OpenAI later said the AI agent was its own, running with reduced guardrails in what was meant to be an isolated test environment, and that it got in with stolen credentials and a previously unknown vulnerability.

Then, in the 48 hours to 22 October, came the run of disclosures security commentators have called "Black October". Two critical flaws in PHP, which runs much of the web, were found with AI tools and disclosed on 21 October (CVE-2026-109618 and CVE-2026-109619), and exploit attempts rose sharply after the announcement. The release pipeline of LiteLLM, a library many teams use to call AI models, was compromised, and a version carrying a credential stealer reached the public package registry. Hosting platforms reported that environment variables, where teams keep their keys, had been reached. Many of these attacks had been running for weeks or months; what arrived together was the disclosure.

None of it called for a new kind of defence, only for the usual ones to be applied to AI agents, and faster than before.

AWS Continuum, at the centre#

On 22 October, AWS made AWS Continuum for code vulnerabilities generally available. It reads a company's code and its AWS environment together and ranks each vulnerability by how close its attack path runs to the systems that matter most, such as customer data stores, payment pipelines and sign-in, rather than by a generic severity score. It tries to reproduce each finding in an isolated sandbox before treating it as real, shows what an attacker could reach and whether existing defences would stop it, then writes the fix, as a code patch, a dependency upgrade or a configuration change, and opens it as a pull request. Nothing ships until a person approves it.

That is the work the year's incidents call for, at the speed attackers now move, and it is central to what this investment builds. AK Run will put Continuum to work for its customers: connecting it to their repositories and AWS accounts, starting it with a person approving every fix, sending its pull requests through each customer's own pipeline for Armakuni's engineers and theirs to review, and letting categories of fixes run on their own only within guardrails the customer sets, as AWS makes that possible. Prism will show what Continuum found and fixed beside the cost and behaviour of every AI agent.

What to focus on now#

• Know every AI agent and every key. List every AI agent, MCP server and skill you run, and every identity that calls a model, from IAM roles and SSO users to API keys, because the keys nobody listed are the ones an attacker uses.
• Make credentials short-lived, and rotate the rest today. Long-lived keys in environment variables were the prize in several of October's incidents. Give each AI agent its own identity, acting for one named person, with tokens that expire.
• Treat what your AI reads and installs as untrusted. A dataset was the way into Hugging Face, and a model library was the way into LiteLLM's users. Pin and verify AI packages, and process outside data where a break-in can't reach your credentials.
• Don't trust the sandbox to hold. Send every model call through one gateway, and refuse any call that goes around it at the account level, so an AI agent that gets out has far fewer places to reach. A gateway narrows what an AI agent can do but does not contain it on its own, so keep its permissions tight, limit where it can connect and watch what it does.
• Patch in days, not weeks. AI is finding flaws faster than teams have been patching them, so decide now which systems you would take offline if a fix can't go in the same week.
• Keep one record of what every AI agent did. When something goes wrong, you should be able to say within minutes what it touched, with which key, and who approved it.

AK Run, AI-native managed services#

When a production alert fires, AK Run's AI agents investigate it, with AWS DevOps Agent tracing the incident across telemetry, code and deployments, and prepare a code-level fix, with a test, for an engineer to review. The fix ships through the customer's own pipeline, so there's less manual troubleshooting and the same incident is less likely to come back. Armakuni's engineers give the yes, and answer for the result.

Prism: see it first, then control it#

Prism is Armakuni's AI visibility and FinOps portal, the one AK Run customers see their AI through. It connects to a company's AWS accounts with read and logging permissions only, so no application code changes and no traffic is rerouted.

• It shows who is calling which models, down to every IAM role, SSO user and unmonitored Bedrock API key, with their token use and its cost within minutes, next to the figures AWS bills.
• It finds the savings: prompts that qualify for prompt caching, high-volume work that can move to batch inference at half the on-demand price, and routine prompts running on a frontier model that a smaller one would handle.
• Every policy, from model allow-lists and budget caps to rate limits and guardrails, runs in watch mode in Prism first, so a team sees what a rule would have stopped before AK Run's gateway enforces it.
• It maps the controls in place to the EU AI Act, ISO/IEC 42001 and the NIST AI RMF, for the evidence pack AK Run customers get every month.

AI agent security, on what AWS launched this year#

Every action an AI agent takes is traceable: the model it used, the tools it accessed, the cost it incurred and who approved it. When something goes wrong, the customer has the evidence to investigate the incident and hold AI agents accountable. AK Run builds this on AWS's newest services:

• AWS Agent Registry, for one list of every AI agent a company runs.
• AgentCore Policy and Amazon Bedrock Guardrails, so rules outside the AI agent decide which tools it may use, and check for prompt injection and leaked data.
• AgentCore Gateway as the only way to a model (AK Run's Agent ControlPlane), with AWS Service Control Policies, set through AWS Control Tower, refusing any call that goes around it.
• AgentCore Identity, so each AI agent acts for one named person, with no shared keys.
• AgentCore Observability and Evaluations, for one trace across every account and scores that run again when a model changes.
• AWS Security Agent, for penetration tests on demand, and AWS Continuum, to find, prove and fix the vulnerabilities in a company's code that matter most.

Fourteen years on AWS#

Prism is one of the reusable AWS-based accelerators Armakuni is expanding: tested, production-ready components its engineers bring into customer projects so that a project doesn't start by building everything from scratch. Armakuni has built on AWS since 2012: a Premier Tier Services Partner since 2023, a Strategic Collaboration Agreement with AWS on generative AI in 2025, and the AWS Agentic AI Specialization in January 2026.

Armakuni is one of 93 AWS Premier Tier Services Partners based in the United States, and one of 27 Premier partners holding agentic AI, modernization and Amazon Connect credentials together, with the AWS Agentic AI Specialization for consulting services, within the AWS AI Competency. With this investment it extends its work on AWS beyond building AI to operating and securing it in production.

Companies can start with a free workshop, followed by a two-week Prism diagnostic that needs read-only access and changes no code, or ask for an AI agent risk review of the AI agents, MCP servers and skills they run. www.armakuni.com/managed-services/

About Armakuni. Founded in London in 2012, Armakuni builds and runs software, AI agents and cloud for companies on AWS. Its forward deployed engineers work inside a customer's company until the work is live, and the customer keeps what is built. www.armakuni.com