AWS introduces frontier agents built to ship real work, end-to-end
Amazon Web Services announced a new class of long-running AI agents-frontier agents-that can operate for hours or even days without hand-holding. The first three are aimed squarely at software teams: Kiro autonomous agent, AWS Security Agent, and AWS DevOps Agent. All three are in preview.
The shift is simple but meaningful: move from assistants that tackle isolated tasks to agents that own outcomes like a dependable team member. These agents maintain context, pursue goals, and keep going until the job is done or constraints are hit.
The three agents at a glance
- Kiro autonomous agent (virtual developer): Works independently, keeps context across tasks, and learns over time so the team can focus on higher-impact work.
- AWS Security Agent (virtual security engineer): Acts as a security consultant across design reviews, code reviews, and penetration testing for AWS, multi-cloud, and hybrid environments.
- AWS DevOps Agent (virtual operations teammate): Responds to incidents, finds root causes using system knowledge, and helps prevent repeat failures while improving reliability and performance.
How Kiro fits into your stack
Kiro works as a shared resource across the team. It connects to repos, pipelines, and tools like Jira and GitHub to maintain a persistent understanding of your codebase, products, and standards as work progresses. Kiro was previously positioned as an agentic AI-driven IDE; now it operates at team scope, not just editor scope.
Security and operations coverage
The AWS Security Agent helps teams build secure software from the start-across AWS, multi-cloud, and hybrid setups. It brings security thinking into design, code review, and testing workflows instead of treating them as afterthoughts.
The AWS DevOps Agent behaves like an on-call engineer that never sleeps. It responds instantly, uses awareness of component relationships to identify root cause, and feeds learnings back into your system to reduce future incidents.
Why AWS built frontier agents
- Goal-first over task babysitting: Teams saw better results when they directed agents toward broad outcomes instead of micromanaging every step.
- Parallelism drives throughput: Velocity correlated with how many agentic tasks could run at once.
- Longer autonomy performs better: The more agents could operate on their own, the more value they produced-provided the same capabilities existed across security, ops, and development to avoid new bottlenecks.
What this means for engineering leaders
- Think in goals, not prompts: Define desired outcomes (e.g., "reduce P1 incident MTTR by 30%," "ship a PCI-ready auth module") and let agents plan and execute.
- Wire in the context: Connect repos, issue trackers, CI/CD, observability, and knowledge bases so agents can work with the full picture.
- Guardrails first: Set policy boundaries, access scopes, change controls, and approval workflows. Log everything.
- Measure impact: Track lead time, deployment frequency, change failure rate, MTTR, and security findings closed. Keep a simple before/after baseline.
- Start where toil is high: Incident triage, flaky tests, dependency updates, security reviews, and routine migrations are high-ROI entry points.
Getting started checklist
- Pick one non-critical service and define a clear, measurable goal.
- Integrate with GitHub/Jira/CI, your observability stack, and a read-limited knowledge base.
- Set IAM roles with least privilege, approval gates for writes, and mandatory change reviews.
- Enable audit logs and dashboards for agent actions, outcomes, and time-on-task.
- Establish safe sandboxes and progressive access to production.
- Define time limits and budget caps for long-running work.
- Run weekly post-ops: what the agent did, what it missed, and what context to add next.
Where this could move the needle
- Dev productivity: Spec-to-PR cycles, bug fixes, branch hygiene, doc updates.
- Security posture: Early threat modeling, secure defaults, consistent code review checklists, automated retests.
- Reliability: Faster incident response, better change risk analysis, proactive failure detection.
If you want a refresher on modern DevOps fundamentals to pair with agent adoption, see AWS' guidance on DevOps on AWS. For team upskilling aligned to vendor ecosystems, browse AI courses by leading companies.
Bottom line: these agents aren't just auto-complete for code. They're goal-chasing teammates that persist, keep context, and work across development, security, and operations-so your people can ship the work that truly moves the business.
Your membership also unlocks:
