AI security pipelines and real-time agent investigation

The week's heaviest story is a single product: Datadog's Runtime Prioritization Engine reaching general availability. The engine automatically infers ownership of security findings and identifies critical resources from live observability data, removing the manual tagging burden that often stalls triage. The same day, Datadog published a detailed look at how it built a two-stage AI security pipeline using Mambark, a 96.9M-parameter state-space model that scores every security event and forwards only the most suspicious candidates to an AI agent for investigation. The result is a cost reduction from tens of millions to tens of dollars per day — a concrete architectural pattern for any team facing the same compute-vs-coverage tradeoff.

Agent investigation comes to Dash0

Dash0 matched the AI-investigation theme with a meaningful update to its MCP server: it can now delegate open-ended tasks to Agent0, the platform's autonomous investigation agent. Connected assistants like Claude or your editor can query metrics, logs, traces, services, and dashboards, with Agent0 returning results in seconds for short questions and providing background processing links for longer investigations. Separately, teams-as-code support arrived via the Dash0 CLI, Terraform Provider, and Kubernetes Operator, modelling each team as a CRD that lives in the same review pipeline as everything else.

FedRAMP High and the new Agent architecture

The Datadog Agent earned FedRAMP High certification, a milestone that required a fundamental redesign: cryptographic enforcement now lives inside the Agent itself rather than relying on the external FIPS Proxy used for Moderate compliance. The new architecture bakes in fail-closed startup checks and deterministic cryptographic boundaries across Go and Python runtimes. Elsewhere in the Agent ecosystem, v7.81.3 fixed a Windows Fleet Automation upgrade issue where the DDAGENTUSER_KEEP_RIGHTS opt-out wasn't preserved during MSI reinstall sequences.

SDKs: JS AI support, browser WebSocket tracking, and uwsgi crash fixes

The JavaScript SDKs had a busy week for AI instrumentation. The Sentry JavaScript SDK added instrumentAgentWithSentry for Cloudflare Agents, auto-instrumenting Agent classes and creating spans for @callable RPC methods — plus SvelteKit 3 support and a Node default switch to Sentry's minimal OpenTelemetry tracer provider. The Datadog dd-trace-js v6.7.0 and v5.118.0 both added OpenAI Agents support for LLM Observability through a new trace processor, while v6.8.0 contributed OTLP export status reporting and Vitest Browser Mode support in Test Optimization.

On the Python side, dd-trace-py v4.13.0rc1 is the headline — it deprecates the ml_app argument in favor of agent_service/DD_SERVICE, adds OpenAI Realtime API auto-instrumentation, and moves the AI Guard public SDK to ddtrace.aiguard. The v4.12.0 release brought AI Guard support for LangChain 1.0+ agents, Ray Serve tracing, and audio capture for LLM Observability. Multiple patch releases (v4.12.2, v4.12.1, v4.11.4, v4.11.3, v4.11.2, v4.10.11, v4.10.10) fixed uwsgi worker crashes on SIGTERM, IAST taint-map races under concurrent requests, uvloop crashes, and ITR correlation ID bugs — all worth noting if you're running any of those configurations.

The Datadog RUM Browser SDK v7.7.0 now supports WebSocket resource tracking behind a beta option, and ships dedicated bundles for Shopify, React Router, and Vue Router integrations. Sentry updated its weekly report with per-project customization and span trends, revamped its issue activity feed with real-time PR status and resolution details, moved error search to Developer plans, and made Autofix PRs open as drafts that only go ready when CI passes. Dash0 added signal export to CSV, TXT, JSON, and YAML from every explorer view.