Anthropic updated Claude Managed Agents with public-beta self-hosted sandboxes and a research-preview "MCP tunnels" feature on May 19, 2026. These features let enterprises keep sensitive data and tool execution inside their security perimeter while using a managed agent orchestration layer.

Source: aiagentstore.ai

At CamundaCon, Camunda announced ProcessOS, an AI-powered intelligence layer that discovers, re-engineers, and continuously optimizes business processes as agentic workflows, available in closed beta starting May 20, 2026. The platform converts described outcomes into repeatable, governed agentic processes with built-in human review and integrations.

Source: aiagentstore.ai

NVIDIA published a developer blog describing "NVIDIA-verified agent skills": a pipeline that catalogs, scans, signs, and documents portable skill packages on May 19, 2026. This provides verifiable skills with cryptographic signatures to help security teams assess and approve agent capabilities before deployment.

Source: aiagentstore.ai

Microsoft announced a new multi-model agentic scanning harness codenamed MDASH for AI-powered cyber defense. The system achieved 96% recall on 28 MSRC cases in clfs.sys and 100% recall on 7 MSRC cases in tcpip.sys spanning five years.

Source: Microsoft Security Blog

LangGraph v1.2 (May 2026) adds per-node timeouts / error recovery / graceful shutdown, a new DeltaChannel to cut checkpoint overhead on long threads, and a content-block-centric streaming API v3.

Source: GitHub / LangChain

OpenAI launched GPT-5.5 on April 23, 2026, with an 82.7% Terminal-Bench score. The model became available to ChatGPT Plus, Pro, Business, and Enterprise subscribers immediately, with API access following on April 24.

Source: Tech Insider

GPT-5.5 introduces native agent capabilities for autonomous multi-step task completion, including web browsing, code execution, and file management. Tool-use primitives are now integrated into the model architecture.

Source: Sudoflare

OpenAI is reportedly in deep internal testing for GPT-5.6, with potential launch as early as June 2026, only weeks after the GPT-5.5 release in April.

Source: WinCentral

CVE-2026-31431, a high-severity local privilege escalation vulnerability in the Linux kernel's cryptographic subsystem, enables unprivileged users to escalate to root. The exploit works across all major Linux distributions using only 732 bytes of Python code with no races or forensic residue, affecting systems running vulnerable kernels with the algif_aead module enabled.

Source: Microsoft Security Blog

Microsoft released patches for 139 CVEs in May 2026, including 10 critical vulnerabilities. Notable critical flaws include CVE-2026-41089 (Windows Netlogon RCE via stack buffer overflow), CVE-2026-41096 (Windows DNS Client heap buffer overflow), and multiple Azure service vulnerabilities affecting Azure DevOps, Azure Logic Apps, and Azure AI Foundry.

Source: Feedly/Microsoft Security

CVE-2026-48172, a CVSS 10.0 critical vulnerability in LiteSpeed User-End cPanel Plugin (versions 2.3-2.4.4), allows any cPanel user to execute arbitrary scripts with root privileges. The flaw has been actively exploited in the wild and was patched in version 2.4.5.

Source: The Hacker News

CVE-2026-27771 (CVSS 8.2) affects Gitea versions prior to 1.26.2, allowing unauthenticated attackers to pull private container images without credentials. The vulnerability went undetected for nearly four years and impacts over 30,000 deployments across 30+ countries affecting healthcare, aerospace, retail, and ISP sectors.

Source: The Hacker News

CVE-2026-6973 affecting Ivanti Endpoint Manager Mobile (EPMM) was added to CISA's Known Exploited Vulnerabilities Catalog on May 7, 2026, due to evidence of active exploitation. The improper input validation vulnerability poses significant risks to federal enterprise systems.

Source: CISA

GitHub confirmed on May 19, 2026 that 3,800 internal repositories were breached via a poisoned Nx Console VS Code extension. The malicious version was live on Visual Studio Marketplace for only 18 minutes (May 18, 12:30-12:48 UTC), but already compromised developer credentials and exposed significant supply chain risk.

Source: Infosecurity Magazine / The Hacker News

VS Code 1.122 was released on May 28, 2026, featuring air-gapped bring-your-own-key (BYOK) support for offline language model usage, browser device emulation for responsive web testing, and rich issue reporting with screenshots and video recordings.

Source: code.visualstudio.com

VS Code 1.120 (May 13, 2026) moved the Agents window from preview to stable, improved bring-your-own-key model visibility, added Markdown quality-of-life improvements, and implemented agent safety features with command risk assessment.

Source: Releasebot

On May 27, 2026, CISA added two critical supply chain vulnerabilities (CVE-2026-45321, CVSS 9.6 and CVE-2026-48027, CVSS 9.3) to its Known Exploited Vulnerabilities catalog, requiring Federal agencies to patch by June 10, 2026. The Nx Console exploit was the direct cause of the GitHub breach.

Source: The Hacker News / CISA

AWS announces ExtendDB, an open-source DynamoDB-compatible adapter for local development and testing. Introduces Kiro Web, a browser-based interface for AWS's AI-powered development environment. AWS SAM CLI now supports CloudFormation Language Extensions for local serverless development.

Source: AWS News Blog

AWS launches Amazon Quick with a desktop app, Free and Plus pricing plans, and expanded integrations. OpenAI models (GPT-5.5, GPT-5.4) now available on Amazon Bedrock in limited preview. AWS expands Amazon Connect with four agentic AI solutions for supply chain, hiring, customer experience, and healthcare.

Source: Amazon Web Services

Amazon EC2 M8in and M8ib instances now generally available with up to 43% higher performance over M6in/M6ib. Amazon EC2 R8in and R8ib memory-optimized instances launched with 600 Gbps network and 300 Gbps EBS bandwidth. Amazon Q Developer reaching end-of-support on April 30, 2027; new signups blocked May 15, 2026.

Source: AWS News Blog

Amazon Bedrock AgentCore previews first managed payment capabilities enabling AI agents to autonomously access and pay for APIs and services. Agent Toolkit for AWS released as production-ready suite for AI coding agents. AWS MCP Server now generally available with managed Model Context Protocol server.

Source: AWS News Blog

AWS announces four new community leaders as AWS Heroes recognized for their contributions to the AWS community through education, mentorship, and knowledge sharing across AI, serverless, and cloud architecture.

Source: AWS News Blog

Anthropic announced on May 27, 2026 the opening of its Milan office, expanding its European presence to support Italian enterprise clients, researchers, and developers.

Source: Anthropic

On May 26, 2026, Anthropic appointed KiYoung Choi as Representative Director of Korea ahead of the company's Seoul office opening.

Source: Anthropic

Anthropic launched Claude Opus 4.8, its most capable generally available model with a 1M token context window by default on the Claude API, 128k max output tokens, and support for mid-conversation system messages and enhanced features.

Source: Releasebot

Anthropic expanded Project Glasswing by releasing Claude Security in public beta with new cyber verification tools for security teams to scan codebases, triage vulnerabilities, and generate fixes.

Source: Releasebot

Anthropic announced that Claude Managed Agents can now operate in self-hosted sandboxes and connect to private Model Context Protocol servers, with tool execution moving to customer-controlled infrastructure.

Source: Releasebot