Mandiant bails out Salesforce; MongoDB's Voyage continues

Welcome to Runtime! Today on Product Saturday: Google releases a tool to prevent Salesforce leaks, MongoDB's Voyage AI acquisition bears fruit, and the quote of the week.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime each week, and if you value independent enterprise tech journalism, click the button below and become a Runtime supporter today.

Ship it

Aura farming: There's a downside to collaboration tools like Salesforce's Experience Cloud: They're designed to connect across a wide variety of trusted partners, customers, and others, but configuration mistakes can leave those tools open to less friendly folks. Google's Mandiant security team released an open-source tool this week that could help Salesforce admins find misconfigurations before the bad guys do.

AuraInspector is "a command-line tool that automates the detection of these exposures and provides actionable insights for remediation." Mandiant said in a blog post. Aura is Salesforce's framework for creating reusable parts of apps built on top of services like Experience Cloud, and it "is one of the most commonly targeted endpoints in Salesforce Experience Cloud applications," Mandiant said.

Obey your thirst: Software developers right now are really excited about agentic coding tools, but they are also worried about the prospect that those agents will go off the rails and wreck their production systems. The safest way to prevent that from happening is to run the agentic tools in what developers call a "sandbox," and Fly.io has come up with a new way for developers to use sandboxes without having to start from scratch with each new project.

A Sprite is a "hardware-isolated execution environment for arbitrary code: a persistent Linux computer," Fly.io said on the launch page for the new service. "With an actual computer, Claude doesn’t have to rebuild my entire development environment every time I pick up a PR," CEO Kurt Mackey said in a blog post.

The search continues: MongoDB acquired Voyage AI last February to bring its embedding models — which translate text in unstructured corporate documents into machine-friendly data — into its database platform. This week it announced that integration is now ready for prime time, and introduced a new family of models for developers working on internal search applications.

The new models were designed for "existing customers seeking more accurate retrieval, and developers building context-engineered agents that require high retrieval accuracy with low latency and cost for high-volume reads (e.g., from shared memory)," Voyage AI said in a blog post. The company also released the Embedding and Reranking API on its MongoDB Atlas managed database, which "gives developers direct access to Voyage AI’s state-of-the-art retrieval models within the Atlas ecosystem," MongoDB said in a blog post.

Lock and key: Companies working in regulated environments face unique storage challenges that require specialized tools, but sometimes the convenience of AWS's S3 storage service wins out. This week Commvault launched a new service that works with the S3 protocol to make it easier to keep sensitive data under wraps.

The Cloud Unified Data Vault is a "a cloud-native service that extends Commvault's trusted, air-gapped protection and resilience capabilities to data written using the S3 protocol, bringing S3-based application and AI data under a unified, policy-driven protection framework for enterprise-grade resilience," Commvault said in a press release. The company noted that while S3 is a popular destination for backups, this is another situation in which managing security configurations across dozens or hundreds of storage buckets can lead to mistakes.

Agents need managers: Agentic AI, if successful, will overturn decades of conventional wisdom about the best ways to manage applications across enterprises. Tines thinks the best way to think about managing agents is to funnel them through deterministic workflows, and this week it released a new service designed to do just that.

AI in Tines was designed to allow "organizations to standardize how they interact with AI, whether through chat, agents, workflows or Model Context Protocol (MCP) capabilities, while maintaining full visibility, governance and control," the company said in a press release. It allows users to build MCP servers directly in Tines to understand how data will flow between those servers and audits all that activity for compliance or security needs.

Stat of the week

Pretty much the whole entire pitch for enterprise AI is that it will increase the productivity of your existing workforce or replace some jobs entirely, the gateway to that eternal quest to "do more with less." But a new report from Workday concluded that "for every 10 hours of efficiency gained through AI, nearly four hours are lost to fixing its output," so adjust your expectations accordingly.

Quote of the week

"The builders who win will treat every user interaction as raw material — captured in ontologies, decision traces, and learning loops — and compound it into a lasting advantage before the market is even fully formed." — Menlo Ventures' Derek Xiao, describing how AI upstarts are still scrambling to find traction but have a key advantage over incumbent enterprise software companies.

The Runtime roundup

Cloudflare acquired its second company of the week, snapping up The Astro Technology Company for an undisclosed amount to add the team behind its super-fast open-source JavaScript framework to its arsenal of development tools.

Salesforce will air a Super Bowl ad featuring Mr. Beast, which is either peak Mr. Beast or peak Salesforce.

Thanks for reading — see you Tuesday!