Amazon adds GuardDuty AI Protection and Security Hub AI inventory for Bedrock/SageMaker

As AI workloads become core infrastructure, AWS is extending its security stack to cover them. GuardDuty AI Protection brings threat detection to AWS AI services, watching for anomalous model invocations, 'cost harvesting' attacks (adversaries running up a victim's inference bill), and prompt-injection attempts — a recognition that AI endpoints are now an attack surface with their own threat model.

Security Hub gains a continuously updated, organization-wide AI inventory that maps every model, agent and pipeline along with its security posture — addressing the 'shadow AI' problem where teams spin up models faster than security can track them. Notably, Security Hub also added multicloud support for Microsoft Azure resources, positioning AWS as a cross-cloud security control plane rather than an AWS-only tool.

The announcements fit AWS's broader July cadence of agent- and AI-tooling launches (Lambda one-click coding-agent setup, Flink AI Agent Skills, the Agent Toolkit with 15,000+ API actions). Strategically it's a defensive moat: enterprises worried about agent privilege-escalation — the exact governance gap flagged for OpenAI's ChatGPT Work — are the target buyer. The reach into Azure is the aggressive bit, letting AWS claim visibility over a competitor's cloud.