Weekly Security Roundup: Governed Agents, Secrets, and PQC Prep

by TechHub

Welcome to this week's Security roundup, where the common thread is turning AI-driven workflows into something you can govern, audit, and operate under real enterprise constraints. Microsoft previewed a cleaner model for agent runtime control by putting MCP tool calls behind Azure API Management, while GitHub expanded enforceable guardrails with Copilot local sandboxing and a new context-aware model for leaked secret detection. On the platform side, teams need to plan for Azure AD Graph retirement, test broker-based sign-in on macOS, and start post-quantum authentication work where it will hurt first (certificates and PKI), alongside a few easy-to-miss deadlines that can still cause outages if they slip.

This Week's Overview

Governed AI agents and API front doors with Azure API Management

Building on last week's theme of splitting agent governance from execution (and adding explicit egress and policy boundaries in Foundry), Microsoft pushed further on “runtime governance” for agentic systems by bringing Microsoft Agent 365 and Azure API Management together in public preview to control access to Model Context Protocol (MCP) servers and tools. The key shift is treating tool calls like any other API: you can apply centralized policies at the gateway (authn/authz, throttling, routing) and enforce them consistently when an agent tries to invoke a tool.

The preview also hooks into Microsoft Defender and Microsoft Purview for optional tool threat protection and data governance controls. For teams experimenting with MCP-based tooling, this makes the governance story less bespoke: put the MCP server behind API Management, then manage it with existing enterprise patterns instead of writing one-off checks in every agent.

A separate reference architecture shows what “production-minded” looks like when you build an AI intake pipeline around that same governed front door. The design uses API Management as an AI gateway, then fans out to Logic Apps, Service Bus (including dead-lettering), Functions, Document Intelligence, Foundry models, and Event Grid using CloudEvents, with a single correlation ID stitched through the flow for traceability and incident response.

GitHub security for AI-assisted development

GitHub's security updates this week clustered around two themes: hardening how AI agents run on developer machines, and scaling detection for secrets and vulnerabilities as AI increases code output. Taken together, the message is to assume more automation (and more risk) in the default dev loop, then make guardrails enforceable by policy.

Local sandboxing and on-device Copilot execution

Following last week's Copilot app sandboxing preview, GitHub Copilot local sandboxing is now generally available across Copilot CLI, the Copilot app, and VS Code Agent Host sessions. The feature uses Microsoft eXecution Container (MXC) to restrict what an agent can touch (files, network access, credentials), which matters when you let an agent execute tools locally rather than only suggest code.

Microsoft also detailed Copilot support for on-device AI coding on new Windows PCs, including automatic routing between local and cloud inference and a local MAI Code 1.1 Flash model build. For security teams, the interesting part is that the tool-execution story stays sandboxed (again via MXC), so you can combine local inference benefits with a clearer containment boundary for agent actions and MCP tool calls.

Copilot's weekly release notes reinforced the direction: local sandboxing is broadly available, Copilot CLI can discover local models via Ollama (copilot /model), and VS Code got agent-session and worktree cleanup improvements. These are small operational touches, but they reduce the “agent residue” that can become a security and privacy footgun (leftover worktrees, logs, or unintended file access) when agents iterate quickly.

Secret protection expands with a purpose-built detection model

GitHub shipped a purpose-built, fine-tuned model for context-aware leaked secret detection across secret scanning alerts, push protection, and Copilot CLI /security-review, picking up on last week's “pipeline hygiene becomes security hygiene” thread by making secret detection more adaptive as code output scales. The practical change is fewer purely pattern-based detectors and more semantic detection where context (surrounding code and usage) helps catch “unstructured” secrets that do not match a simple regex.

Admins should also pay attention to how this ties into GitHub AI Credits: some checks are included, while others consume credits, and the update calls out budgeting and controls so enterprises can enable stronger detection without losing track of spend. GitHub's companion post framed the problem with platform data: as code volume scales, secret exposures scale too, so push protection needs to keep up with fast classification (GitHub mentioned a ModernBERT-based classifier) and consistent coverage across GitHub.com, GHES, and Copilot surfaces (including GitHub Enterprise Server 3.23).

On the incremental side, secret scanning also added detectors for Lovable Labs, Pydantic Services Inc., and Supabase credentials, plus a new partnership provider flow for Lovable Labs so partners can be notified automatically when public leaks occur. This is the kind of update that quietly improves baseline coverage, especially for teams adopting new SaaS tools faster than security can update internal detection rules.

Code scanning and CodeQL updates that affect pipelines

Building on last week's CodeQL 2.27.1 release (and the all-platform bundle deprecation you may need to rework automation around), CodeQL 2.27.2 landed with analysis improvements across C/C++, Go, Rust, and JavaScript/TypeScript, plus updates to C# and GitHub Actions security queries and several CodeQL CLI behavior changes. The release notes also call out two gotchas: traced analysis has a limitation on macOS 27 with Xcode 27, and there's a breaking change to the Go CFG (control-flow graph) library that can impact custom queries or internal tooling built on it.

GitHub also improved the Security Overview coverage view to show AI Scan enablement status for pull requests, including enabled/not-enabled counts, per-repo effective status, filter queries, and a new CSV export column. For security program owners, this closes a common gap: you can now audit whether repos are actually using AI Scan (not just licensed for it), and export the coverage state for reporting or remediation backlogs.

Identity, toolchain authentication, and crypto readiness

Azure AD Graph retirement forces upgrades in CLI and PowerShell

Microsoft published an “action required” reminder that older Azure CLI and Azure PowerShell versions still calling Azure AD Graph (graph.windows.net) will break as phased disablement starts after October 6, 2026, reinforcing last week's identity-first emphasis by showing how legacy auth dependencies can become both an outage trigger and a policy blind spot. The fix is straightforward but can be operationally painful: audit your build agents and developer machines, upgrade Azure CLI / Az modules, and migrate any direct Graph calls to Microsoft Graph (especially around az ad and older Az.Resources behaviors).

This is security-relevant because it intersects with least-privilege and Conditional Access adoption: Microsoft Graph is where current permission models and policies are being enforced, so lingering dependencies on Azure AD Graph create both reliability and governance gaps. Teams that pin tooling versions in CI should treat this like a production dependency update, not a developer convenience upgrade.

Azure CLI on macOS moves toward broker-based sign-in

Azure CLI 2.91.0 on macOS added preview support for native broker-based authentication via MSAL, enabling a native account picker, SSO, and more policy-friendly sign-in flows. In practice, this reduces the temptation to fall back to less controlled auth paths when Conditional Access policies get strict, and it better matches how other Microsoft clients handle identity on macOS.

The post also notes a packaging move to Homebrew Cask and includes commands to enable, verify, and disable broker auth. If you support developers on managed Macs, this preview is worth testing early because it can change login UX and token handling in ways that show up in automation scripts or troubleshooting playbooks.

Post-quantum authentication planning starts with certificates, not algorithms

This continues last week's SSH hardening thread (including the move toward post-quantum hybrid key exchange) by zooming out from transport settings to the broader certificate ecosystem that will have to carry post-quantum authentication. Microsoft Security Research argued that post-quantum readiness needs to cover authentication (certificates and PKI), not just encryption. Their warning is operational: new post-quantum certificate options can bring larger certificate chains and compatibility risks across platforms and TLS stacks, so the right move is to start testing certificate ecosystem behavior now rather than wait for a mandated switch.

Microsoft introduced a PQC TLS Pilot Program and referenced concrete building blocks like ML-DSA-87, plus ecosystem touchpoints such as the Microsoft Trusted Root Program and Schannel. For teams running internal PKI or mTLS at scale, the immediate takeaway is to inventory where certificate size and chain length limits exist (load balancers, proxies, embedded clients) and validate interoperability before you have to react under deadline pressure.

Network and key management changes you need to schedule

Azure API Management service tag deadline for classic tiers

Azure API Management is adding new control-plane IP addresses, and customers running VNet internal/external deployments on classic (v1) tiers need to update NSGs, UDRs, and firewall rules to rely on the ApiManagement service tag by November 30, 2026. If you keep allowlists as raw IP ranges, you risk losing management-plane connectivity when the new addresses roll out.

This is one of those changes that reads like a networking footnote but can cause real outages: losing the ability to manage APIM means you may not be able to update policies, certificates, or routes during an incident. If you're still on classic tiers and have tight egress rules, prioritize the service tag migration and validate it in lower environments first.

BYOK in Azure Key Vault: restoring key material is not restoring key identity

This pairs with last week's “immutability blocks cleanup” lesson in a familiar way: recovery features can still surprise you when the operational identity (here, key version URIs) does not line up with what dependent services actually reference. A practical Key Vault BYOK (bring your own key) lesson: re-importing key material creates a new key version, and it will not restore the original version identifier that dependent services may require. Azure Storage customer-managed keys (CMK) can be sensitive to the exact key version URI, so a “re-import” can turn into a service-impacting event if you assume it reconstructs the original reference.

The guidance is very operational: follow a specific recovery order, think about rotation timing, and use monitoring queries (KQL in Log Analytics) to confirm usage and detect failures. The article also includes Azure CLI backup/restore steps and reinforces enabling soft delete and purge protection so you have a recovery path that preserves what workloads actually reference.

AI-driven vulnerability research goes operational

Microsoft Security shared what they learned from scaling AI-assisted vulnerability research in the FORGE Lab, focusing on three habits that make the work “shippable”: reproducible evidence, managing reasoning-cost trade-offs, and building a continuous validation/remediation loop that turns findings into fixes across Windows and open source. This aligns with a parallel CISO-oriented post arguing that frontier AI models increase both the speed and volume of vulnerability discovery, which in turn changes how leaders should think about triage, patch pipelines, and defense-in-depth.

Two practical ideas surfaced across the posts: using AI “harnesses” (including MDASH) to keep research grounded in verifiable artifacts, and leaning on secure-by-default baselines like Microsoft Baseline Security Mode (BSM) to reduce exposure even when patching cannot keep pace. For engineering orgs, the implication is that vulnerability management will look more like continuous delivery: automated validation, prioritized remediation, and tighter feedback loops from discovery to fix to rollout.

Other Security News

Supply chain controls in npm got tighter in ways CI owners will notice: npm stage publish can now create new packages (with the initial version held in a staged queue until a maintainer promotes it), and unvalidated trusted publishing configurations now expire after 48 hours unless a successful publish validates them. npm also rejects trusted publishing tokens from GitHub Actions issue_comment events (and continues to reject pull_request_target), which reduces risk from untrusted event contexts.

On the reliability side with security implications, Azure Site Recovery for Azure Local reached GA with a one-page portal wizard plus WDAC (Windows Defender Application Control) enforcement-mode support and built-in proxy configuration. Backup also advanced for PostgreSQL with Azure Backup v2 in public preview, moving to snapshot-based physical backups with incremental scheduling and a new “Restore as Server” option, along with vault security controls and a one-way migration path from v1.

Several identity and governance-related platform updates landed around the edges: Microsoft Entra App Gallery added self-service onboarding for new applications in public preview (OIDC/SAML and provisioning validation plus submission tracking), and Azure Arc introduced a multicloud connector onboarding preview to automatically discover and onboard EKS and GKE clusters into Azure Arc-enabled Kubernetes (bringing Azure Policy for Kubernetes and Defender for Cloud closer to multicloud estates). If you operate regulated environments, Sovereign Cloud and Sovereign AI sessions at NVIDIA GTC Berlin point to where Microsoft expects more customers to demand stronger data residency and edge controls.

A couple of “security hygiene” items are worth bookmarking: a guide on auditing old online accounts covers breach checks (including Have I Been Pwned), MFA, recovery settings, and revoking third-party OAuth tokens and API keys, and a Windows Update certificate rotation notice for 2027 lays out hard deadlines (May 17 and June 19) and minimum patch levels needed to avoid losing Windows Update access. Finally, ReviewBench arrived as an open benchmark for AI code review agents, which is useful if you're trying to evaluate code review automation with metrics that distinguish grounded vs augmented scoring.