The Week in Cloud & AI: Moonshot's Kimi K3 Model with 1M Token Window is Now on Bedrock

The Week in Cloud & AI

This week, Moonshot AI's Kimi K3 model landed on Amazon Bedrock, underscoring the platform race for third-party models. AI agents also matured from hype to practice: Google open-sourced an agent for securing infrastructure code, and Microsoft's Foundry agent framework went GA. Meanwhile, data platforms simplified architectures, with Google Spanner and Databricks Lakebase adding native messaging and search.

ReleaseBytes Insights

A clear pattern emerged: platforms are absorbing capabilities to simplify engineering. Google's Spanner Queues and Databricks' Lakebase Search let developers use native messaging and search within their core data platform, avoiding separate services. This integration reduces overhead and simplifies building AI apps.

Simultaneously, AI agents are maturing beyond hype to focus on deployment and governance. Google's open-sourced Mantis offers a security blueprint, Microsoft's Foundry agents bring automation to the enterprise, and GitLab's new tools add guardrails. This signals a shift from experimentation to production readiness, where operations are now key.

If You Only Read One Thing...

Moonshot AI's powerful Kimi K3 model is now GA on Amazon Bedrock. Its one-million-token context window and native vision are impressive, but its availability is more significant. It shows the AI battleground is now a marketplace for best-in-class third-party models, not just proprietary ones. This gives engineers powerful tools for long-context applications without complex workarounds.

In This Edition

• Top Stories
  • Moonshot AI's Kimi K3 Model with 1M Token Window is Now on Amazon Bedrock
  • Google Open-Sources Mantis, an AI Agent System for Securing Infrastructure Code
  • Databricks Lakebase Search Reaches General Availability
  • Google Cloud Spanner Queues for Transactional Messaging Are Now GA
• Breaking Changes
• Security Updates
• Attention Required
• Industry Trends

Top Stories

Moonshot AI's Kimi K3 Model with 1M Token Window is Now on Amazon Bedrock

Moonshot AI's Kimi K3 model is now GA on Bedrock. A 2.8 trillion parameter model, it has a 1M-token context window, native vision, and a new explicit prompt caching feature to reduce latency and cost.

Why it matters This gives engineers a powerful tool for long-context tasks that competes with GPT-4. The large context window unlocks new applications in legal, research, and code analysis without complex chunking and solidifies Bedrock's role as a leading model marketplace.

Key Takeaways

• Kimi K3 is now GA on Amazon Bedrock, available via cross-region inferencing.
• The model features a 1-million-token context window and native vision.
• A new explicit prompt caching feature on Bedrock can lower latency and input costs.
• Kimi K3 is suited for agentic workflows and analysis of extensive documents.

Who should care?

• AI Engineers
• MLOps Engineers
• Software Engineers

Impact

• High

Read the full summary on ReleaseBytes

Google Open-Sources Mantis, an AI Agent System for Securing Infrastructure Code

Google open-sourced Mantis, its multi-agent system for securing infrastructure code. It embeds vulnerability scanning and patching into the SDLC, using agents to scan, triage findings, and propose fixes for human review. Google reports it prevents hundreds of vulnerabilities monthly.

Why it matters Mantis is a blueprint for solving security problems with AI at scale. By open-sourcing it, Google offers a reference architecture for automated security, shifting detection "left" into the development workflow to secure code before it is committed.

Key Takeaways

• Google has open-sourced Mantis, its internal AI agent system for code security.
• The system uses multiple agents for scanning, triage, and suggesting fixes.
• It integrates directly into the development lifecycle for pre-submit checks.
• Mantis is designed to be high-precision, reducing alert fatigue for developers.

Who should care?

• Security Engineers
• Platform Engineers
• DevOps Engineers

Impact

• High

Read the full summary on ReleaseBytes

Databricks Lakebase Search Reaches General Availability

Databricks Lakebase Search is now GA, integrating scalable vector and keyword search directly into projects via new Postgres extensions. This lets teams build search capabilities without managing a separate stack.

Why it matters This removes major architectural complexity for teams building RAG or search apps on Databricks. Instead of managing a separate vector DB, they can use native capabilities on the same platform, simplifying pipelines, reducing overhead, and centralizing governance.

Key Takeaways

• Lakebase Search is now GA, providing native vector and keyword search.
• It uses two new Postgres extensions, removing the need for an external search engine.
• lakebase_vector supports pgvector-compatible ANN search at scale.
• lakebase_text provides advanced BM25 full-text search.

Who should care?

• Data Engineers
• AI Engineers
• Engineering Managers

Impact

• High

Read the full summary on ReleaseBytes

Google Cloud Spanner Queues for Transactional Messaging Are Now GA

Google Cloud Spanner queues are now GA, offering transactional messaging for asynchronous work. The feature enables event-driven apps to combine Spanner's consistency with at-least-once delivery for background jobs triggered by database changes.

Why it matters This adds a critical building block for event-driven apps directly into Spanner, removing the need for an external message queue. It preserves transactional consistency between database state changes and the tasks they trigger, simplifying architecture.

Key Takeaways

• Spanner queues are now generally available.
• They provide transactional, at-least-once messaging for asynchronous tasks.
• This feature eliminates the need for an external message queue for many use cases.
• It helps build reliable, scalable event-driven applications on Spanner.

Who should care?

• Software Engineers
• Data Engineers
• Technical Architects

Impact

• High

Read the full summary on ReleaseBytes

Breaking Changes

• Platform: GitHub Actions

• Breaking change: Between Oct 19 and Nov 19, 2026, the ubuntu-latest runner will migrate from Ubuntu 24.04 to 26.04. Workflows may fail due to changed dependencies.

• Who is affected: All users of GitHub Actions with workflows specifying runs-on: ubuntu-latest.

• Migration recommendation: Test by setting runs-on: ubuntu-26.04. If not ready, pin to runs-on: ubuntu-24.04 to prevent failures.

• Potential risk: High. CI/CD pipelines could break, blocking deployments.

• Platform: GCP

• Breaking change: Cloud Number Registry now requires a designated management project before organizational setup.

• Who is affected: Administrators configuring Cloud Number Registry in GCP.

• Migration recommendation: Establish a managing project before setup.

• Potential risk: Medium. Configuration will fail without this step.

Security Updates

• GitHub Actions Execution Protections Now GA GitHub's workflow execution protections are now GA. Admins can define allowlists for workflow triggers and events, manage them via API, and target specific files. A new secure default, disabling pull_request_target for public repos, will be enforced starting November 2, 2026.

• Pydantic-AI Patches Four Security Vulnerabilities Pydantic-AI v2.44.0 has critical security fixes for its web_fetch_tool and OpenTelemetry instrumentation, addressing data leakage, an IPv6 bypass, and other bugs. Users must upgrade to v2.44.0 (or v1.107.6 for the v1 line) to mitigate these risks.

Attention Required

• GitHub Copilot Deprecating Several AI Models GitHub Copilot will deprecate several AI models (versions of Gemini Flash, GPT, Grok) on October 19, 2026. Users must update integrations to alternative models to avoid disruption. For most, suggested alternatives will be enabled by default.

• OpenAI Retiring Sora Models OpenAI will retire several models, including sora-2 and sora-2-pro, on September 24, 2026 (in 3 days). Applications must migrate to newer versions to ensure continued functionality.

• HashiCorp to Deprecate HCP Vagrant HashiCorp is deprecating its HCP Vagrant service, with a full phase-out expected in 2026. Users should begin planning migrations to alternative solutions.

Industry Trends

• AI Agents Get Practical and Governed AI agents are shifting from hype to practical governance. Google's Mantis provides a security blueprint, Microsoft's Foundry agents enter the enterprise, and GitLab adds governance, all signaling a focus on production readiness.

• Core Data Platforms Absorb Adjacent Capabilities Major data platforms are integrating adjacent services. Google Spanner's queues and Databricks' native search reduce architectural complexity and operational overhead, simplifying the creation of sophisticated applications.

• The Foundation Model Arms Race Continues on Managed Platforms Moonshot AI's Kimi K3 on Bedrock shows the cloud battleground is now access to top-tier, third-party models. Platforms are becoming curated marketplaces, offering engineers flexibility and choice over proprietary models.

By the Numbers

• 343 releases analysed (Sep 14 - Sep 20, 2026)
• 169 general-availability releases
• 53 deprecations / retirements
• 15 security updates
• 6 breaking changes

---

Thanks for reading. For a complete overview of this week's 343 releases, visit the ReleaseBytes website. You can subscribe to get this newsletter delivered to your inbox every week and share it with your colleagues.