Claude takes on security; Tailscale tackles agents

Welcome to Runtime! Today on Product Saturday: Anthropic freaks out the enterprise security market with a new Claude feature, Tailscale extends its networking security tech to agents, and the quote of the week.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime each week, and if you value independent enterprise tech journalism, click the button below and become a Runtime supporter today.

Ship it

Red Team wedding: Enterprise cybersecurity companies got a taste of the SaaSpocalypse Friday after Anthropic introduced Claude Code Security, which is only available as a research preview but was enough to trigger a sell-off. The new service "scans codebases for security vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix security issues that traditional methods often miss," Anthropic said in a blog post.

Those traditional methods include scanning for known vulnerabilities, but Anthropic claimed Claude Code Security takes a step beyond that by identifying unknown vulnerabilities and validating its suspicions before sending an alert to the security team. Shares of companies like CrowdStrike and Okta fell sharply, and a benchmark for cybersecurity stocks fell almost 5%, according to Bloomberg.

Take Command: The importance of observability grows by the week as companies add AI applications to their stacks while the behavior of traditional applications remains just as complex. Neoclouds like Crusoe know that if they want customers to stick around for the long haul, they'll need to create software services around their rental GPUs, and this week it launched a new AI observability service.

Command Center "provides deep-observability features to move AI teams from infrastructure maintenance to development momentum by surfacing the issues that stall velocity," Crusoe said in a press release. GPUs can be quite flaky, and the new service allows customers to understand how their Kubernetes clusters are performing and create custom metrics to track other issues.

Lens, crafted: Now that companies are actually starting to make progress deploying AI agents, we're probably just months away from the first real big agentic AI security disaster caused by a product team that built a system they didn't fully understand as fast as they could. Security lessons are usually learned the hard way, but Tailscale introduced a new service this week called Aperture that it thinks will help its customers manage the complexity of this new world.

Aperture is a gateway that helps network administrators and security teams understand how developers are using AI models without forcing them to request API keys. "Our goal is to make it so easy and secure to use AI that teams will never again have to choose between moving fast and staying safe," the company said in a blog post.

Cache and carry: Most companies that want to get in on the whole AI thing have realized they need to clean up their data first, and ThoughtSpot's Analyst Studio was designed to help data analysts with that task. The company released several new features this week that also help those data analysts stay within their budgets.

SpotCache is a new cost-control feature in Analyst Studio that allows users to "create optimized data snapshots that can be queried an unlimited number of times within ThoughtSpot, without touching your cloud data warehouse," it said in a blog post. The new version of Analyst Studio also introduces new ways to pull data from different sources and a spreadsheet UI for analysts who prefer using that tool over writing SQL queries.

The human touch: How do you talk to an agent? It's a question that might be asked in a really weird enterprise-software reboot of Beverly Hills 90210, and Twilio has a possible answer with a new proposal for an open-source protocol called A2H, or "agent to human."

A2H "provides a single, channel-agnostic, auditable surface for agents to communicate with their human principals," the company said in a blog post. The idea is to provide a standardized way for agents to keep humans in the loop, because "what we want to solve for is take away the liability — the liability around thinking about, 'hey, I should have thought about an escalation path,'" Twilio's Rikki Singh told The New Stack.

While AI makes coding faster, the greatest opportunity to accelerate innovation lies in enhancing quality, security, and speed throughout the entire software lifecycle. Check out this post from Manav Khurana, sponsored by GitLab, for a blueprint that can jump-start your AI coding journey.

Stat of the week

It's no secret that a sizable amount of the intense interest in AI agents stems from the desire to reduce labor costs, but nobody has any idea right now how much of an impact agents will actually have on payrolls. A new survey of IT leaders conducted by Udacity asked respondents to define their "ideal mix" of workers, and they settled on 64.96% internal employees, 19.52% AI agents, and 15.52% contractors.

Quote of the week

"Agents are introduced gradually with clear permissions, visible decision paths, and defined handoff points to humans. If they can’t be observed, audited, or rolled back, they don’t ship."  — SAP's Michael Ameling, offering some practical advice on managing agents in the latest edition of the Runtime Roundtable.

The Runtime roundup

OpenAI cut its projected spending on AI infrastructure  from over $1.4 trillion to just $600 billion by 2030, according to CNBC, which was easily predictable and an utterly hilarious Friday news dump.

AWS engineers allowed its Kiro AI development tool to make changes to a public-facing service without reviewing them first, which caused a 13-hour outage to one of its minor services, according to The Financial Times.

Cloudflare struggled to recover from several issues affecting multiple services Friday, a day in which routine maintenance had been scheduled for its Portland data center, according to its status page.

Thanks for reading — see you Tuesday!