What happened
At its Cloud Security Summit (Nov 5), Google added OS-level sandbox or isolated-VM exploit simulation and human approval gates to CodeMender (still preview), plus a new Model Armor custom topic detector (preview), VPC Service Controls IAM-role ingress/egress rules (GA), Workload Identity Federation for GKE (preview), and Cloud Armor managed rules (preview).
Why it matters
Gives teams precise scoping and safer containment for agentic vulnerability research, and extends identity/perimeter enforcement to the environments where AI agents run (Gemini, GKE, Cloud Run, Agent Compute Engine).
Applicability
AppSec teams using CodeMender should enable sandbox isolation for exploit validation; Google Cloud platform teams should evaluate Model Armor topic detectors and the new agent identity controls.