Microsoft's new security harness; Notion makes a PaaS

Welcome to Runtime! Today on Product Saturday: Microsoft unveils an AI harness for security teams, Notion expands into developer tools, and the quote of the week.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime each week, and if you value independent enterprise tech journalism, click the button below and become a Runtime supporter today.

Ship it

Supermodels: As the unwashed masses await their turn with Anthropic's Mythos Preview model, Microsoft researchers decided to enter the AI vulnerability research game with a system that uses several different models to uncover software vulnerabilities. The new multi-model agentic scanning harness (MDASH) employed more than 100 models in a recent test that found 16 new vulnerabilities in Windows, which is probably the most scrutinized piece of software ever created.

"The strategic implication is clear: AI vulnerability discovery has crossed from research curiosity into production-grade defense at enterprise scale, and the durable advantage lies in the agentic system around the model rather than any single model itself," Microsoft said in a blog post. While that's definitely the kind of thing that a company lacking its own world-class security model would say, given how quickly those models are advancing, defenders will likely take any model that can help.

The Freshmaker: Freshworks is one of many enterprise software companies scrambling to convince a generation of IT buyers to bet on its strategy for managing AI agents, because once those control points are baked into enterprise workflows they'll be hard to displace. This week it introduced a no-code agent builder as well as support for MCP to link those agents to other sources of data.

With Freddy AI Agent Studio, "teams can create custom AI Agents or start with pre-built, domain-specific AI Agents and further extend capabilities from a new library of agentic workflows," the company said in a press release. IT service management comes off as an ideal target for AI agents given that most tasks in that world are not super complicated, but ServiceNow and Salesforce are also pushing their own agentic AI strategies in every sales call.

Make it work: Headless services are one way SaaS companies are adapting to the AI era, while others are trying to extend their services up the stack. This week Notion introduced the Notion Developer Platform to allow developers to orchestrate agents built on Notion with custom code and access to external data.

Workers are "Notion’s hosted runtime [!] for custom code. Write your logic, deploy to a secure sandbox, and it’s live—no servers to provision, no containers to configure," the company said in a blog post. The platform also introduces a database sync feature that connects Notion with tools like Salesforce, but "the success of the platform will depend less on what it offers and more on how well these capabilities perform in practice," Gartner's Nitish Tyagi told InfoWorld.

Context clues: The enthusiasm around the Cerebras IPO is (in part) a reflection of how much AI workloads rely on fast access to memory chips to provide background details for new tasks. This week MinIO introduced a new context memory store designed for Nvidia's chips that promises to speed up AI inference.

MemKV helps improve the utilization of Nvidia clusters by extending access to a shared memory pool across those clusters, rather than forcing nodes in a cluster to reach out all the way to external storage when they need more information, which increases latency and makes you wait longer for a result. "As AI moves from answering simple questions to performing complex, multi-step tasks, the underlying systems must remember what they have already done," MinIO said in a press release.

Context clues 2.0: Companies that have figured out how to successfully deploy AI in their stacks tend to have invested in data management and refinement before any of this was cool. This week Celonis introduced a new AI model that could help companies still early in that process deliver the business context that agents really need to thrive.

The Celonis Context Model "[provides] a dynamic, real-time digital twin of operations, which translates the business into a language AI understands" based on its knowledge of business processes, the company said in a press release. The company also announced that it has acquired Ikigai Labs, which develops AI technology for planning and forecasting.

Stat of the week

It wasn't much of a stretch to predict that Project Stargate would fall short of its goals, but it's a little surprising how quickly opposition to data-center construction became a bipartisan issue in American politics. More than 70% of U.S. residents do not want to allow companies to build AI data centers in their communities, and 48% are "strongly opposed," according to new data from Gallup.

Quote of the week

"Package management has conflicting goals: security wants lockdown, developer experience wants flexibility, maintainer sustainability wants minimal friction. These tensions aren't solvable, but the threat landscape calls for us to rebalance and make informed trade-offs," — Rami McCarthy, principal security researcher at Google's Wiz, discussing the modern state of software packages amid a sharp increase in software supply chain attacks.

The Runtime roundup

Federal agencies are under the gun to patch a critical vulnerability in Cisco's SD-WAN software by the end of the weekend, according to The Record.

Thanks for reading — see you Tuesday!