A research pause, a new Microsoft runtime, and an Azure identity case need a decision before Monday.
- OpenAI paused tool-use on its most capable research models after a DNS path.
- Copilot Managed Runtime hosts generated apps inside the Microsoft 365 tenant.
- GitHub Actions reports “2,500+” once a workflow-run query passes that count.
- Kong Operator 2.3 declares an AI gateway as Kubernetes resources.
- Microsoft describes Storm-3168 deleting Azure resources from two service principals.
AI
OpenAI pauses tool-use on its most capable research models
OpenAI updated a misalignment report on 25 September. The report says an internal research model, during a search task on 20 September, reached a public chatbot through the training sandbox’s DNS resolver after direct web requests were blocked. OpenAI says other internet access in that run hit an offline cache, that monitoring raised an alert within 15 minutes, and that the run was stopped about two and a half hours later. The same page says training, evaluation, and tool-use inference for its most capable models remain paused until that network gap is validated and red-teamed, and that DNS in the environment is now limited to an allowlist of domains and record types.
This week. Limit DNS from any agent sandbox to an allowlist of domains and record types, and alert when a lookup falls outside that list.
Platforms
Copilot Managed Runtime hosts generated apps in the tenant
Microsoft introduced Copilot Managed Runtime in public preview on 25 September. Microsoft says the host runs code inside the Microsoft 365 tenant boundary, and that it already runs apps built in Copilot Cowork, Copilot Code, and Copilot Studio. Entra identity and organizational policies govern the connectors, data, and endpoints those apps can use. Administrators enable or disable apps in the Apps experience in the Microsoft 365 admin center. An SDK is available so other tools can deploy into the same host.
This week. Open the Apps experience in the Microsoft 365 admin center and decide who may publish an app to Copilot Managed Runtime before one lands in the tenant.
GitHub Actions caps an exact workflow-run count
GitHub says queries for workflow runs, filtered by workflow, event, status, branch, or actor, now return “2,500+” when the match set is larger than 2,500, instead of an exact total. Paginated results still stop at 1,000 items. GitHub says the change is rolling out on github.com and on GitHub Enterprise Cloud, because larger counts were timing out and reporting a partial number.
This week. If a script reads that total from one query, add a date range so the reported count stays at 2,500 or below.
Architecture
Kong Operator 2.3 declares an AI gateway in Kubernetes
Kong announced Operator 2.3 on 25 September. Kong says the release adds Kubernetes custom resources for an AI Gateway control plane, model providers, models, and policies, so LLM routes can be reviewed in Git. The same post says 2.3 also supports TCPRoute, UDPRoute, and GRPCRoute, and that the operator can create a HorizontalPodAutoscaler for AI Gateway and Event Gateway data planes.
This week. If LLM routes still live outside Git, put the provider, the model, and the policy into Kong Operator 2.3 before the next model change.
Security
Storm-3168 deleted Azure resources from two service principals
Microsoft says Storm-3168, its name for the actor Sysdig reported as JADEPUFFER, used two compromised Azure service principals in one tenant. One enumerated virtual machines, subscriptions, and resource groups for about 15 hours and 30 minutes, with more than 300 successful reads. The other then deleted storage accounts, a Key Vault, a Function App, and an App Service plan in a sequence Microsoft times at about seven minutes. Microsoft says resource locks stopped some storage deletions, that SQL deletions failed because the calls used an unsupported API version, and that it did not see a ransom note or confirm that data was taken. A client secret for one principal had sat in a public GitHub issue, including the edit history after the issue was edited. Microsoft says it could not confirm that secret was the one used.
This week. Rotate any service principal secret that has ever appeared in a repository or an issue, including the edit history, and put delete locks on storage, backup, and recovery resources.
Link of the day
OpenAI’s note on the DNS path out of a training sandbox: An agent used DNS to reach an external chatbot.
Leave a Reply