The Cloud Pod | Weekly AI & Cloud News on AWS, Azure & GCP

Welcome to episode 349 of The Cloud Pod, where the weather is always cloudy! Justin and Jonathan managed to make it into the studio this week, and they brought a guest! Dave Garaway jas joined us, and brought some on-the-ground knowledge from GTC, plus a slew of supply chain attacks, Gmail username changes and Claude’s code debacle. We’ve got all this and more – so let’s get started! Titles we almost went with this week AWS Console Gets a Makeover Nobody Asked For From Eight Hours to 22 Seconds, Hackers Got Fast AWS Spring Cleaning Hits Nine Services Hard Trivy Pursuit Turns Into a 500K Credential Heist Skip the Consultant, AWS Security Now Hacks Itself AWS Pen Testing Agent Pokes Your Cloud Around the Clock Your Cringey Gmail Address Gets a Second Chance Stop Babysitting Servers, Let Google Handle MCP AI Agent Untangles Your Kubernetes Networking Spaghetti One Bad Actor Poisons a Hundred Million Downloads Lambda Finally Hits the Gym with 32 GB From GPU Hype to Production Inference Without the Hyperscaler Headache Follow Up 01:28 Hegseth, Trump had no authority to order Anthropic to be blacklisted, judge says A US District Judge granted Anthropic a preliminary injunction blocking the Department of War’s blacklisting, ruling the designation was First Amendment retaliation rather than a legitimate national security action. The court found officials lacked authority to blacklist Anthropic without considering less restrictive alternatives or providing evidence of an urgent security risk, noting the designation was triggered by Anthropic’s “hostile manner through the press.” The practical business impact was already substantial before the ruling, with three trade deals cancelled and other potential partners delaying negotiations, representing potentially billions in lost contracts over five years. Anthropic continues to balance the legal fight with maintaining its government relationships, publicly emphasizing alignment with the Department of War’s mission around safe AI deployment even while litigating against it. For cloud and AI vendors, this case establishes a notable precedent around government procurement decisions and First Amendment protections, with implications for how companies publicly challenge federal contracting positions. 02:35 Jonathan – “I’m guessing Anthropic is super busy with all the people coming to them for deals right now, because it seems to me that Anthropic is getting all the business customers and OpenAI are getting the personal customers.” 04:08 Delve Announces Changes and New Customer Support Measures Delve has responded to allegations from an anonymous Substack post by denying claims of faked evidence, clarifying that independent AICPA-accredited auditors, not Delve, issue SOC 2 reports and ISO 27001 certifications. The company published a formal rebuttal and is now rolling out operational changes to address customer concerns. To support customers facing questions from their own clients and procurement teams, Delve is offering complimentary re-audits through independent auditors, complimentary grey-box penetration tests, and formal engagement letters from auditors, all at no cost. On the transparency side, Delve is moving auditor communications directly into customer Slack channels or shared email threads, so customers have full visibility into the audit process rather than relying on Delve as an intermediary. The platform is also adding clearer disclosures to templates and forms to explicitly identify them as guidance tools aligned to industry standards, addressing a core point of confusion raised in the controversy. For cloud practitioners, this situation highlights the importance of understanding the distinction between compliance automation platforms and the independent auditors who issue attestations, a boundary that procurement teams are increasingly scrutinizing when evaluating vendor security posture. 06:12 Justin – “I think the reality is that, and we talked about this last week, is that SOC 2 audits are very heavily templatized. That’s how these companies make them, and they work them. They do need to be edited, reviewed, and approved, and the right things need to be done, but they can’t always start as a template. A template’s not the problem. It’s what appears to be the automation and then the rubber-stamping by these auditors.” 06:39 Delve – Fake Compliance as a Service – Part II – Day 1 of 5 This article covers allegations against Delve, a compliance automation startup, and represents a follow-up to earlier reporting. It does not directly relate to cloud platform news typically covered on The Cloud Pod, but here are the relevant talking points for context. A whistleblower from Delve provided internal screenshots and recordings after the initial article, including conversations suggesting the company’s auditing partner, Accorp, may not conduct thorough evidence reviews befor