Weekly AI Roundup: Sovereign AI, Agent Security and Foundry Changes

by TechHub

Welcome to this week's AI roundup, covering Azure Local's sovereign AI announcements, the LiteLLM supply chain compromise, and Microsoft's controls for agent identity and permissions. Foundry's browser automation tool reaches general availability, while upcoming Foundry workflow and Fabric integration retirements give teams migration deadlines to plan around. We also examine agent development, retrieval, and evaluation examples, alongside research that pairs AI assistance with human oversight and explicit verification, distinguishing available capabilities from previews and planned releases.

This Week's Overview

Azure Local expands infrastructure assistance and sovereign AI options

Azure Local announcements covered guided operations, confidential computing, local inference, and customer-controlled development environments. Availability varies across these capabilities, with some generally available now and others planned for Ignite or early 2027.

Copilot-guided infrastructure troubleshooting

Azure Copilot for Azure Local will translate natural-language questions into guided troubleshooting workflows for infrastructure health, connectivity, network configuration, failed deployments, update readiness, and diagnostic collection. Investigations gather context, run diagnostics, analyze findings, and recommend next steps while operators remain in control.

Public preview is planned for early 2027, so this is an upcoming operational workflow rather than a capability teams can adopt today. Its scope covers the investigation leading to a recommendation, without removing the operator's role in deciding what happens next.

Confidential computing and disconnected operations

Confidential virtual machines on Azure Local are generally available, providing hardware-encrypted memory, isolation, attestation, and guest operating system integrity protection. Azure Local also introduces public-preview rehoming from Azure-connected infrastructure to disconnected environments, using phased execution, user approvals, and secure backups.

For teams choosing hardware and deployment boundaries, the Intel-focused guidance describes Azure Local on Intel Xeon 6 and supported confidential VM configurations using Intel TDX to isolate workloads while in use. Hardware-backed attestation supplies evidence for checking environment security properties against workload requirements, while Intel AMX and OpenVINO support CPU acceleration and model optimization.

Local inference and retrieval

Foundry Local runs supported models on Azure Local through Azure Arc-enabled Kubernetes, with CPU- and GPU-backed deployments and OpenAI-compatible APIs. Azure Local disconnected operations provides a local control plane for supported infrastructure and services without continuous public-cloud connectivity.

The announcements describe different availability milestones: the model catalog and Agentic Retrieval are described as generally available, while the broader Foundry Local on Azure Local offering is expected to become generally available at Ignite. Retrieval supports local ingestion, indexing, multi-step retrieval, and citations; agents, enterprise connectors using Model Context Protocol (MCP), and configurable AI guardrails are described as preview capabilities. Teams should check the status of each required component rather than treating the entire stack as having one release status.

Development workflows on customer-controlled infrastructure

GitHub Enterprise Local keeps repositories and core development workflows on customer-controlled Azure Local infrastructure. Workload Orchestration provides a guided Azure deployment experience that prepares the infrastructure and GitHub Enterprise Server appliance, with deployment secrets stored in Azure Key Vault.

Local repository hosting does not make connected GitHub Copilot use independent of GitHub.com: that path still requires a GitHub.com identity and a Copilot license. Foundry Local offers a separate way to run approved models locally, with administrators responsible for models, security, certificates, and access controls.

AI supply chain incidents and agent access controls

The security reports describe both a compromised AI dependency and an AI-driven campaign against application identities. Alongside those incidents, Microsoft outlined controls for discovering agents, limiting their permissions, and containing risky actions.

LiteLLM compromise requires clean-environment recovery

Compromised LiteLLM 1.107.0 was published to PyPI and distributed through official container images on October 21, 2026. Malicious Python startup files could execute a credential collector without an application importing LiteLLM, making interpreter initialization itself a risk in affected environments.

Investigators should avoid starting Python or pip inside suspect environments because doing so could activate the payload. Recovery requires rebuilding affected environments, addressing surviving processes, and rotating reachable credentials from a known-clean machine. Microsoft provides Defender detections and Kusto Query Language (KQL) hunting queries, while Defender Vulnerability Management identifies exposure as TVM-2026-0003.

ARTEX campaign targets application identities

Microsoft assesses that Storm-0940 used ARTEX in the ConnectWise supply chain compromise and reached more than 2,250 tenants through compromised application identities. Some ARTEX-driven attacks achieved privileged cloud access less than three hours after initial targeting, and Microsoft observed reconnaissance, application credential modifications, and identity or privilege changes through Microsoft Graph in some affected environments.

A separate password-spraying observation produced more than 151,000 failed logons against 327 accounts across eight organizations, with no successful authentication observed. Customers should keep affected ConnectWise connections disabled, preserve evidence, and investigate service-principal sign-ins alongside unauthorized credential and permission changes.

Discovery, sandboxing, and task-scoped permissions

Microsoft is expanding local-agent discovery by 35 types to cover 60 supported local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Microsoft Entra Agent ID is being extended with identity types for local agents and previously unknown agents discovered by security sensors. Microsoft Execution Container provides a sandbox with policy-controlled resource access and security controls outside the agent's reach.

Dynamic Permissions supports task-scoped, time-bound access and verified human approval for higher-impact actions. Project Perception combines identity, data, endpoint, cloud, network, runtime, and activity signals to assess risk, while Dynamic Conditional Access supports graduated containment. The accompanying Guardian Agents description emphasizes supervising actions before they happen and responding as risk increases, rather than relying on model transparency alone.

Foundry agent workflows face a retirement deadline and gain browser tools

Foundry teams have a workflow retirement to plan for alongside a generally available browser automation tool. Supporting walkthroughs cover deployment, evaluation, and the cost of completing agent tasks.

Move orchestration out of retiring Foundry workflows

Microsoft Foundry workflows retire on December 1, 2026, ending support for the visual workflow designer and for running workflows in the Foundry portal. Azure Logic Apps can orchestrate Foundry agents through API calls, schedules, or events from more than 1,400 connectors, with branching, retries, timeouts, parallel execution, and run history around agent calls.

Prompt Agents use configured instructions, models, and tools, while Hosted Agents run custom containerized code with Foundry-managed hosting and scaling. Teams planning a replacement should distinguish the available orchestration capabilities from a planned convenience feature: selecting an existing Hosted Agent from a Foundry project for workflow invocation is not currently supported.

Browser automation reaches general availability

The Browser Automation Tool in Microsoft Foundry is generally available, using Playwright Workspaces to provision isolated cloud browser sessions. Agents can access public websites and private applications behind an Azure virtual network, provided private connectivity is configured during workspace provisioning. Foundry toolboxes expose MCP-compatible endpoints for sharing browser tools across Prompt Agents and Hosted Agents.

Live View lets people observe browser activity, and Take control allows temporary human interaction before returning the session to the agent. Security controls include sensitive-action approvals, tool allow lists, managed identities, and Azure role-based access control. Sensitive trace protection remains a preview capability, so teams should not assume every protection shares the tool's general-availability status.

Build and deploy grounded agents from development tools

Julia Muiruri demonstrates a game-recommendation agent built in Visual Studio Code with GitHub Copilot and the Foundry Toolkit extension. The workflow grounds recommendations in a real product catalog and covers model selection, testing, deployment to Azure AI Foundry, and connection to a website through a secure proxy.

A complementary walkthrough starts from a GitHub issue prompt and builds a Tailspin Toys backer concierge inside the GitHub Copilot app. Foundry Skill and Foundry Canvas support resource provisioning, model deployment, and hosted-agent development, while an Azure Functions-based proxy protects credentials for the website chat widget. Both workflows include grounding and testing rather than stopping at a working chat interface.

Optimize for completed tasks, not token counts alone

Agent Optimizer improves instructions and configuration without retraining the underlying model. Its workflow establishes a baseline with representative evaluation data and success criteria, generates instruction variants, and scores candidates using evaluator models. Production traces inform the evaluation, estimated costs can be reviewed before execution, and candidates are checked for quality, latency, and sensitive-information disclosure before validation on held-out cases.

The cost discussion pairs that process with Model Router, which selects a model for each request. Reducing tokens per request can leave an agent short of context or precision and cause additional model or tool calls, so cost assessment needs to include the full task. Measuring effectiveness and setting controls for usage spikes is more useful than optimizing a single request in isolation.

Copilot Studio prepares agent lifecycle and quality controls

Six capabilities for Copilot Chat declarative agents are scheduled to reach general availability on October 26, 2026, immediately after this roundup's reporting week. Monitoring guidance adds practical advice for connecting user-facing failures to the components behind them.

Conversation flows, delegation, and release management

The scheduled Copilot Studio release includes Topics for deterministic conversational flows and connected agents for delegating work to other agents. Evaluations assess agent quality, while monitoring provides visibility into usage after deployment.

The native Copilot Chat preview experience includes an Activity Map for testing user-facing interactions. Agent lifecycle management supports separate versions across development, test, and production environments, giving teams a way to validate changes before promoting them.

Monitor outcomes and protect diagnostic data

Copilot Studio provides analytics and conversation-level troubleshooting, with available metrics depending on agent type and platform experience. Azure Application Insights and Azure Monitor add telemetry and alerts for instrumented custom components and supported resources.

The guide recommends tracking task completion, tool-call errors, 95th-percentile latency, authentication failures, and cost per successfully completed task. Consistent correlation identifiers connect conversation failures to API requests, workflow executions, and dependency errors, while redaction, retention policies, and restricted access protect confidential content in diagnostic logs.

Fabric updates data agents, notebook execution, and dashboard authoring

Fabric's announcements combine upcoming data-agent runtime improvements with a near-term integration deadline. Preview tooling extends coding agents into live notebooks and lets dashboard authors generate custom visualizations.

Data-agent query improvements roll out in November

Standard-runtime improvements for Fabric data agents begin rolling out November 2, with completion expected November 10, including a move to GPT-5.6 Terra. Advanced natural-language-to-SQL generation explores schemas, tests joins, and looks up actual filter values before generating queries. Schema descriptions and topics remain available only for SQL sources on the preview runtime.

Internal SQL-generation testing increased accuracy from 78.8% to 90.9% and reduced 95th-percentile latency from 46.8 to 32.9 seconds. Internal Data Analysis Expressions (DAX) testing increased accuracy from 89.15% to 91.86% and reduced the same latency measure from 97.5 to 34.7 seconds. These are internal results, so teams should validate their own schemas and questions rather than treating the figures as guaranteed workload outcomes.

Foundry custom-tool integrations must move to Fabric IQ

Support for Fabric data agents connected as custom tools in Microsoft Foundry ends November 6, 2026. Affected agents must migrate to the preview Fabric IQ (OneLake Catalog) tool before that deadline.

The replacement supports multiple Fabric data agents per Foundry agent, compared with one in the earlier integration. OneLake Catalog lets users choose accessible published agents by name without entering workspace or artifact IDs, while SDK and REST migrations connect MCP endpoints using the signed-in user's Microsoft Entra token.

Coding agents can work against live notebook sessions

Fabric Notebook Toolkit (FNTK) is a preview command-line tool that connects coding agents to live Fabric notebook execution. Agents can discover notebooks and lakehouses, edit cells, execute code, and reuse an active notebook session.

Structured JSON responses report results, errors, and suggested next actions. Cell outputs, Spark job state, and driver, executor, and Livy logs give agents debugging evidence rather than only the notebook source.

Copilot generates custom dashboard tiles

Custom visuals with Copilot is in preview for Fabric Real-Time Dashboards. Copilot generates a supporting KQL query and an HTML-based visualization, adding the result as a dashboard tile that authors can refine through follow-up prompts.

Authors need editing access and data sources configured for custom visuals. Generated queries and visuals still require validation against operational requirements, including aggregation, labels, and presentation.

Database agents connect detection to investigation

A database-agent demonstration follows a blocking issue from Fabric Database Hub into SQL Server Management Studio, with GitHub Copilot assisting deeper investigation. The agent observes SQL Server databases and surfaces performance signals and investigative context.

Estate-wide analysis in VS Code is presented through prototype skills. Outcome verification, memory, greater autonomy, human approval, and auditable controls are roadmap themes, not a list of capabilities to assume are already available.

Flint gives agents a language for interactive charts

Flint-interactive lets agents specify chart behavior through semantic events and high-level update operators, rather than producing only static visualizations. Flint-MCP and MCP Apps allow interactive charts to render within chat or canvas environments, while Flint Canvas manages user interactions and rendering state as a state machine.

Applications can handle those events to update tables, other charts, widgets, or application state. Custom interactions combine triggers and handler functions with operators such as set style, set annotation, and set viewport, giving developers a structured way to connect generated charts to application behavior.

Cosmos DB examples connect retrieval, shared memory, and production evaluation

The Cosmos DB travel-planner demonstrations follow an agent application from data retrieval through coordination and production operations. Together, they show why search quality, durable state, and end-to-end evaluation need to be designed together.

Keep recommendations aligned with operational data

The travel planner stores operational application data and vector embeddings together in Azure Cosmos DB. Full-text search handles precise queries, vector search finds semantically similar results, and hybrid search balances semantic relevance with exact-match constraints.

Transactional workflows keep recommendations aligned with live inventory and booking data. That connection matters when a relevant recommendation must also reflect what a user can actually book.

Coordinate specialized agents through durable memory

Specialized research, hotel, and restaurant agents share user preferences and context stored durably in Azure Cosmos DB. Agents read and write that memory to coordinate tasks, preserve context across sessions, and continue after handoffs.

The demonstration references the Azure Cosmos DB Agent Memory Toolkit as an implementation resource. Durable shared state makes the handoff explicit instead of depending on each agent's isolated conversation history.

Evaluate the full execution path

The production framework uses observation, evaluation, and optimization to improve agent behavior. Traces reveal quality and performance issues across execution, while evaluation suites provide consistent assessments instead of ad-hoc manual testing.

Optimization targets include retrieval quality, latency, token usage, memory efficiency, and Cosmos DB request-unit consumption. Debugging therefore spans the data, retrieval, memory, and language-model layers rather than treating every failure as a prompting problem.

Coding-agent routing and evaluation depend on execution context

Two developer-focused reports examine decisions surrounding the model: how to select it for a turn, and how the test environment can influence its behavior. Both make environment and policy part of the design rather than incidental configuration.

Route once per turn and filter candidates before scoring

A decision-routing architecture for GitHub Copilot selects a model once per new user turn and pins that selection across the resulting tool continuations. Microsoft-Decision-1 returns typed decisions and probabilities through binary, choice, and ordered-score questions, while VS Code discovers available Copilot models through its public Language Model API.

Before scoring, the architecture filters candidates by entitlement, pricing, context capacity, API compatibility, and administrator policy. GitHub credentials remain in memory and must not be logged or sent to the Decision API, separating authentication material from the routing request.

A local Git remote can change measured behavior

Across 340 GPT-5.6 Sol runs, agents pushed without being asked in 65% of GitHub-remote runs and 54% of local-remote runs. The reported 11-percentage-point difference had a p-value of 0.033, although every agent pushed on both remote types when explicitly instructed.

All rebases were correct, every push used --force-with-lease, and no run used a destructive Git command. The experiment covered one model, one repository, a conflict-free rebase, and agents operating without confirmation, so its result supports checking remote choice in evaluations rather than generalizing to all coding-agent behavior.

SQL demonstrations bring retrieval and agent-assisted development closer to data

The SQL sessions cover AI application patterns across local, cloud, and Fabric deployments. The practical connection is keeping retrieval and operational data close while choosing models and tooling that fit deployment constraints.

Native vectors and retrieval in SQL applications

SQL Server 2025 supports native vector capabilities, embedding generation, and retrieval-augmented generation (RAG), which grounds model responses in retrieved data, using T-SQL. The session covers local and cloud-hosted models, Fabric mirroring, and SQL Server on Azure Local for sovereign environments, with security and disaster recovery considerations in the application examples.

A Fabric walkthrough generates embeddings, runs vector similarity searches, and implements a T-SQL RAG pattern for product search. Automatic mirroring makes operational data available in OneLake without a separate replication pipeline, while Git-based development and deployment span Fabric and VS Code. The broader Microsoft SQL session adds demonstrations of automatic index compaction, AI-assisted performance troubleshooting, and scalable vector search.

Agent-assisted application development

An Azure SQL demonstration moves from an Azure SQL DB container to Azure SQL Database's free tier. It covers Microsoft SQL agent skills and plugin concepts, with the Azure SQL Developer Hub and Microsoft SQL Agent Skills repository supplied as implementation resources.

Research reports pair AI assistance with explicit verification

Research applications this week covered mathematical proof, sequential medical diagnosis, and biological monitoring. Each report includes a way to inspect results, from formal proof checking to diagnostic benchmarks and classifier testing.

Human-directed agents assist a proof of the KLS conjecture

Researchers including Microsoft Research's Xinzhi Zhang proved the KLS conjecture, establishing a universal bound independent of dimension. Human-directed AI agents explored more than 100 candidate approaches and assisted with derivations, manuscript preparation, and internal proof checks. The October 1, 2026 paper version achieved iterated logarithmic dimension dependence, and the October 4 version removed dimension dependence.

Repeated unguided runs with leading models and roughly the same total token budget did not solve the problem. Independent proofs appeared, a Lean 4 formalization was released, and the authors verified a streamlined argument in Lean, making human direction and formal verification central to the reported result.

Diagnostic benchmarks compare accuracy and cost

SDBench evaluates sequential diagnostic reasoning using 304 complex NEJM cases and more typical emergency-department presentations from MIMIC-IV-ED. Microsoft AI Diagnostic Orchestrator achieved 83% accuracy on the NEJM cases, compared with physicians' 22% without external references and 36% with references. On MIMIC-IV-ED cases, it achieved 80%, compared with physicians' 47%.

A cost-optimized configuration achieved 81% accuracy on NEJM cases at less than half the cost of comparative systems. Microsoft is open-sourcing SDBench components for select NEJM cases, including the benchmark, Gatekeeper, Judge, and cost-estimation code. These results describe benchmark performance under the reported conditions, not a substitute for evidence about clinical deployment.

Discovery agents support biological monitoring experiments

Discovery agents interpreted more than 120 software projects and reference documents through read-only access, helping compress literature review, experimental design, permitting review, and preliminary classifier development from several weeks into a few days. Synthetic Asian citrus psyllid biometric data supported an initial edge classifier before permits allowed live-specimen testing.

The team selected a replicated Latin square design to balance sampling locations and periods in field experiments. Preliminary false-positive assessment used simulated wingbeats and labeled laboratory recordings from other insect species, keeping classifier validation separate from the initial synthetic-data development.

Manufacturing agents gather evidence for root-cause investigations

Manufacturing root-cause analysis can take days while engineers correlate information across systems and locate subject-matter experts. The demonstrations describe agents gathering relevant data, correlating signals, and ranking likely causes with confidence levels and supporting evidence.

The intended role is faster investigation and triage, not replacing the people who resolve incidents. Giving engineers better initial context can help them assess candidate causes before committing to corrective action.

Other Artificial Intelligence News

Co-op Translator uses temporary line and chunk markers, bounded recovery, and deterministic repository checks to catch structural translation failures without relying entirely on language-model calls. Those checks cannot detect every omission or meaning change, so human review remains necessary, while incremental translation can preserve edits when a baseline and aligned structures exist.

Bruno Capuano and Luis Quintanilla cover Microsoft.Extensions.AI, Microsoft.Extensions.DataIngestion, and Microsoft.Extensions.VectorData as .NET building blocks for ingestion and vector-based retrieval. The session connects embeddings and vector search to grounding responses in internal documents and business data.

The Azure weekly update includes Project Perception, Entra CYOT, the OpenAI Decisions API, and Copilot Studio agent ID alongside infrastructure coverage. Its monitoring topics include workspace usage insights and advanced platform metrics.

Microsoft Developer contrasts applications that only respond to user input with adaptive applications that can respond to changing context, reason, and take actions. The short clip points viewers to a fuller discussion.

Also relevant this week

Dates to know

Deadlines

Coming up