{"resourceId":"rh-openshift-5-acs-5-security-agent-sandbox-kev-20261109","versions":[{"version":"external-4a6a1ee1bffb497b34af983e6cf03fe94b36baa0e391dc4cf4f485b5ecd889bb","resource":{"id":"rh-openshift-5-acs-5-security-agent-sandbox-kev-20261109","title":"Red Hat blog: OpenShift 5 and Advanced Cluster Security 5 add CISA KEV prioritization, a read-only ACS MCP server (Technology Preview), Agent Sandbox (Technology Preview), GA confidential GPUs and AI model signing","organization":"Red Hat","sector":"Cross-sector hybrid cloud / AI platform vendor","geography":"Global product","publishedAt":"2026-11-09","publicationDate":"2026-11-09","eventDate":"2026-11-09","sourceName":"Red Hat blog","sourceLabel":"Vendor product blog (product marketing)","sourceUrl":"https://www.redhat.com/en/blog/red-hat-openshift-5-bring-stronger-security-applications-and-ai","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","infrastructure","developers-agents","governance-procurement"],"finding":"Red Hat's OpenShift 5 security blog gives support tiers that the launch release omitted. Generally available: confidential GPU support on supported bare-metal systems (encrypts model weights in use and shields them from cluster admins) and ACS 5 vulnerability management for supported RHEL VMs. The blog also describes install-time network policies for control-plane namespaces, without a support label. Technology Preview: Red Hat build of Agent Sandbox (VM isolation for untrusted agent code) and an ACS MCP server that is read-only and scoped to the ACS API token. ACS 5 uses the CISA KEV catalog to prioritize vulnerabilities, adds a CVE Origin indicator (Red Hat vs OSV.dev assessments) and schedules compliance profiles for OpenShift Virtualization. Trusted Artifact Signer 1.5 adds AI model signing and verification, Trusted Profile Analyzer 3.1 flags ML and cryptographic components in SBOMs, and an NVIDIA-blueprint 'exploit intelligence' feature assesses CVE reachability. The blog cites Red Hat's own survey: 74% of organizations slowed or delayed deployments over security concerns.","sledRelevance":"State CISOs already work from CISA KEV under federal and state directives, so KEV-driven prioritization in ACS maps to existing public-sector practice. Model signing, confidential GPUs and SBOM flagging of ML components bear on AI supply-chain and data-protection requirements for agencies hosting models for HHS, justice or research data. No SLED deployment is cited.","evidence":"Opened the full blog post dated 9 Nov 2026 (author Dan Bettinger, product marketing). It is a feature description with no benchmarks. The 74% statistic is from a Red Hat-commissioned survey whose method is not given in the post. As cross-checks, I read upstreambeat's rewrite (which adds no new facts and advises checking per-component support status) and Tech Times.","architectureImplications":"Security controls span cluster network policy, confidential computing on bare metal, VM isolation for agent code, an MCP gateway with NeMo Guardrails, and supply-chain signing. Confidential GPU requires supported bare-metal hardware, which limits cloud or virtualized deployments.","governanceImplications":"KEV-based policies can gate builds and deployments. Agencies should map them to their existing KEV remediation timelines. Model signing allows a provenance check before a model runs.","securityPrivacyImplications":"Read-only, token-scoped ACS MCP access limits what assistants can do, but query results (CVE inventories) still flow to whichever AI client is used. Confidential containers protect data in use from administrators only on supported hardware.","caveats":"Vendor marketing. Agent Sandbox and ACS MCP are Technology Preview with limited support. The survey figure lacks a method, and the exploit-intelligence accuracy is unmeasured.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: lead with CISA KEV prioritization and AI supply-chain controls, which state and university security offices already understand. ACS 5 ties exploitation evidence to build and deploy gates, and model signing adds provenance for hosted models. Be clear that Agent Sandbox and the ACS MCP server are Technology Preview, and that confidential GPUs require supported bare metal. Avoid using the 74% survey figure as customer evidence (interpretation).","engineering":"Engineering framing: separate the GA controls from the preview ones. Pilot KEV-based ACS policies against current vulnerability findings, test Trusted Artifact Signer verification in the model deployment pipeline, and confirm hardware support before planning confidential GPUs. Test the read-only ACS MCP server only with a narrowly scoped token, and track which AI client receives CVE inventory data. Record which features are GA in the deployed version (interpretation).","delivery":"Delivery framing: deliver in stages. First, KEV-informed ACS policies aligned with the agency's remediation timelines. Second, model signing and verification in the deployment path. Third, optional preview pilots of Agent Sandbox and ACS MCP in non-production. Acceptance should cover enforced policies, verified signed models and documented token scopes. Preview pilots need their own exit review before any production use (interpretation)."},"roleDetails":{"sales":{"customerProblem":"SLED security teams need to prioritize exploited vulnerabilities and establish provenance for AI models running on shared platforms.","stakeholders":["State or campus CISO","Vulnerability management lead","Platform engineering lead","AI/ML platform owner"],"discoveryQuestions":["How do you track CISA KEV remediation deadlines today?","Do you verify model provenance before deployment?","Do you have supported bare-metal GPU hosts for confidential computing?","Would a read-only AI CVE assistant be permitted?"],"valueHypothesis":"Bounded: KEV-driven policies and model signing may focus remediation effort and reduce supply-chain risk.","potentialEngagement":"An ACS 5 KEV policy and model-signing integration workshop, with an optional preview pilot.","unsupportedClaims":["Measured reduction in vulnerability backlog","Production support for Agent Sandbox or ACS MCP","Confidential GPU on any hardware"]},"engineering":{"fit":"Strong for existing OpenShift and ACS customers; incremental for others.","architectureIntegration":"ACS 5 policies in CI/CD and admission; Trusted Artifact Signer in model pipelines; confidential containers on supported bare metal.","prerequisites":["ACS 5 deployment","Pipeline integration points","Supported confidential-computing hardware"],"constraints":["Agent Sandbox and ACS MCP are Technology Preview","Confidential GPU limited to supported bare metal"],"security":"Scope ACS MCP tokens narrowly; verify model signatures; protect CVE inventory data shared with AI clients.","proofOfValue":["KEV policy blocks a test image carrying a KEV-listed CVE","Unsigned model rejected at deploy time","ACS MCP returns only token-scoped data"]},"delivery":{"work":"Implement KEV-based policies and model signing; optional preview pilots.","dependencies":["ACS 5 upgrade","Pipeline access","Hardware inventory"],"ownership":"Security office for policy, platform team for enforcement.","skillsAdoption":"Train analysts on KEV policies and pipeline owners on signing.","governanceCheckpoints":["Policy design review","Pilot exit review for preview features"],"acceptanceCriteria":["Proposed: KEV-listed test image blocked in staging","Proposed: 100% of deployed models in pilot namespace carry verified signatures"],"risks":["Preview features adopted prematurely","Policy blocks disrupting delivery","Hardware gaps for confidential computing"]}},"retrievedAt":"2026-11-10T22:13:05-06:00","enrichedAt":"2026-11-10T22:35:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Natural-language CVE lookup may help small security teams, but it is preview and read-only. Analysts still own prioritization decisions.","procurementImplications":"Confirm which of these features are included in existing OpenShift Platform Plus or ACS subscriptions and which need separate SKUs or supported hardware.","operatingModelImplications":"Security and platform teams need a shared policy for KEV-based deployment gates and for model-signing verification before deployment.","sourceVerification":{"openedUrl":"https://www.redhat.com/en/blog/red-hat-openshift-5-bring-stronger-security-applications-and-ai","referenceExcerpt":"Confidential GPU support is generally available on supported bare-metal systems.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}