Presented by Kasm Technologies

Enterprise infrastructure teams have spent the better part of a decade pushing workloads into Kubernetes. Applications, APIs, batch jobs, data pipelines — if it runs in a container, it belongs in the cluster. The operational benefits are well-established: declarative configuration, horizontal scaling, self-healing, native integration with CI/CD pipelines and observability tooling. Kubernetes has become the default operating model for production workloads.

Except for desktops.

Secure desktop and application delivery — the kind that enterprises depend on for remote work, privileged access, and regulated-industry workflows — has remained stubbornly outside the Kubernetes model. Legacy virtual desktop infrastructure was built in a different era, for a different set of assumptions: pre-allocated VM pools, bespoke management planes, proprietary appliances, and operational tooling that has nothing to do with how modern platform teams work. The result is a split infrastructure reality: a modern, cloud-native application layer on one side, and a manually managed, operationally isolated desktop layer on the other.

That split is expensive. It means different tooling, different scaling behaviors, different observability approaches, and different operational runbooks. Platform engineers who are proficient in Kubernetes still have to context-switch into an entirely different mental model the moment a desktop infrastructure problem arises.

The more fundamental issue is that this split is unnecessary. Secure, containerized workspace delivery is a workload that Kubernetes is architecturally well-suited to run. Sessions are containers. Scaling is demand-driven. Configuration should be declarative. The only thing missing was a platform built to take advantage of that alignment.

Why the timing is right

The appetite for Kubernetes-native workspace delivery has grown significantly as organizations mature their container platform investments. Platform teams that have spent years standardizing on Helm, GitOps workflows, and Kubernetes-native observability are increasingly unwilling to make an exception for desktop infrastructure. The question has shifted from “can we run this on Kubernetes?” to “why isn’t this running on Kubernetes already?”

At the same time, the security case for containerized workspace delivery has become more urgent. Browser-delivered, containerized workspaces provide session isolation that VM-based desktops cannot match — each session is ephemeral, isolated at the container boundary, and terminates cleanly without persistent state. For organizations managing sensitive data, insider risk, or third-party access scenarios, this isolation model is a meaningful security control, not just a deployment convenience.

The convergence of these two trends — Kubernetes-native infrastructure expectations and containerized session security — creates a clear opportunity for platforms that can address both simultaneously.

What Kubernetes-native deployment looks like

A Kubernetes-native deployment uses Kubernetes as the control plane for workspace infrastructure — handling orchestration, scaling, and lifecycle management through the same declarative model used across the rest of the platform. Instead of relying on dedicated management appliances or pre-provisioned desktop pools, infrastructure is managed through the same CI/CD, GitOps, observability, and security workflows the platform team already operates. This gives platform teams a consistent operational model rather than maintaining a separate toolset for desktop infrastructure.

Kasm Workspaces, the browser-delivered workspace platform, is purpose-built to use Kubernetes as the control plane for workspace orchestration and delivery. Its deployment model is designed for real enterprise environments — not simplified demos — with production-grade Helm charts that follow Kubernetes conventions, tested upgrade paths between versions, and a standardized backend architecture validated across production deployments. An RDP Gateway component purpose-built for the Kubernetes topology enables Windows and Linux virtual machine access through the same platform.

Key capabilities include:

• Horizontal session scaling driven by actual demand, orchestrated by Kubernetes — no pre-warmed VM pools required.

• Declarative configuration through Helm values, enabling GitOps and CI/CD integration for workspace infrastructure.

• Namespace-level isolation and compatibility with existing RBAC policies, ingress controllers, and secrets management integrations.

• Metrics export for integration with Prometheus and existing observability stacks.

• Rolling builds by default, reducing maintenance windows and enabling more predictable version management.

Real-world applications

Regulated-industry remote access. A financial services organization running a Kubernetes-based application platform can deploy Kasm into the same cluster, using the same operational tooling, to deliver isolated browser and application sessions to analysts and advisors. Sessions are ephemeral, network egress is controlled, and the entire deployment is managed through the same GitOps pipeline as their application workloads.

Contractor and third-party access. Organizations that regularly onboard contractors or external vendors — with the associated privileged access risk — can provision Kasm sessions on Kubernetes that scale up during engagement periods and scale back during low-demand windows. No persistent access. No VPN extension to external parties. Containerized isolation at every session boundary.

AI/ML development environments. Teams building and running AI models need GPU-enabled development environments with security controls that general-purpose cloud desktops rarely provide. Deploying Kasm on Kubernetes with NVIDIA MiG Multi-Instance GPU support lets platform teams deliver fractional GPU resources into isolated workspace sessions — giving data scientists the compute they need without shared-infrastructure security exposure.

The operational shift

The practical implication of a Kubernetes-native workspace platform is that platform teams can stop treating workspace infrastructure as a special case. The same engineers who deploy applications can deploy the workspace platform. The same pipelines that manage application configuration can manage workspace configuration. The same dashboards that monitor application health can monitor workspace health.

That operational consolidation reduces overhead, improves consistency, and eliminates the context-switching cost that has made desktop infrastructure a persistent pain point for cloud-native organizations.

For organizations still running legacy VDI alongside modern cloud infrastructure, the question is no longer whether a Kubernetes-native alternative exists. It does. The question is when to make the transition.

Organizations interested in evaluating Kubernetes-native workspace delivery can explore the platform at kasm.com and try out community edition for yourself.

Daniel Ben-Chitrit is the Chief Product Officer at Kasm Technologies.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Facepalm: Popular collaboration platform Zimbra was recently updated to patch a potentially dangerous vulnerability in its Classic Web Client component. In theory, malicious actors could abuse the flaw to run script-based malware directly on users’ machines. Needless to say, customers are advised to install the update as soon as possible.

Zimbra owner Synacor has released a new version of its collaboration software, and users should install the update as soon as they can. Zimbra “Daffodil” 10.1.19 includes a fix for a stored cross-site scripting (XSS) vulnerability that could be exploited to compromise customers’ machines through Zimbra’s Classic Web Client.

Cybercriminals could abuse the flaw by sending specially malformed email messages, Zimbra said. A vulnerable client would run the malicious code the moment the message is opened. While the company rates the deployment risk as “low,” the flaw could still prove dangerous for users’ session data, mailbox information, or account settings.

Cross-site scripting vulnerabilities are a common class of security issue routinely abused by resourceful attackers. An XSS flaw lets attackers inject client-side, malicious scripts into web pages viewed by other users. A “stored” XSS bug like Zimbra’s is an especially dangerous variant, since the malicious script is permanently saved on the server rather than triggered on the fly.

Zimbra’s security guidance states that all customers using the Classic Web Client should update the component to the latest available version. Additional advice is given for those using custom SNMP mitigations. So far, the XSS flaw has not been assigned a CVE identifier.

At any rate, malicious actors have been trying to target Zimbra with XSS vulnerabilities for almost five years now.

In October 2025, yet another persistent XSS bug in the Classic Web Client (CVE-2025-27915) was allegedly exploited in zero-day attacks targeting Brazilian military personnel. Other XSS-based attacks targeted Zimbra’s platform in May 2025 and 2023.

Though it has existed in various forms for more than two decades, Zimbra has changed hands several times over the years. The company was purchased by Yahoo! in 2007, sold to VMware three years later, and finally acquired by Buffalo-based service company Synacor in 2015. Zimbra provides collaboration tools, email servers, and web clients in both open source and commercially supported editions. However, the latest open source versions of Zimbra products no longer include official, free binary builds.

Japan’s largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to shut down part of its infrastructure.

The incident occurred over the weekend, early Saturday morning, and impacted operations, including the company’s taxi dispatch system, which remains offline as of today.

Nihon Kotsu is Japan’s largest taxi and chauffeur (hire) operator by group revenue, with annual revenue of roughly $1 billion (¥155 billion).

The company employs 18,228 people and operates a fleet of 8,558 taxis and more than two thousand chauffeur vehicles.

“We have confirmed that our internal systems were subjected to unauthorized external access (malware infection),” reads Nihon Kotsu’s statement (automated translation).

“Immediately after detecting the unauthorized access, we implemented emergency measures, including disconnecting systems to prevent further damage,” added the firm at another point.

As a result of this incident, car hire, web booking, reservation management, the telephone dispatch service, and some internal systems remain unavailable, the company said.

The company suggested that people seeking its car services should use the ‘GO’ taxi app instead, or just visit a nearby taxi stand to book a Nihon Kotsu vehicle.

In a separate announcement, the firm specifies that the “labor taxi” service booked by pregnant women close to giving birth is suspended in the areas of Tokyo, Musashino City, Mitaka City, Tachikawa, Yokohama, and Saitama.

The firm states that it has engaged external cybersecurity experts to help with the investigation and system recovery and is currently looking into the possibility of data having been leaked.

At this point in the investigation, no such data leak has been confirmed, but Nihon Kotsu is considering this possibility and has promised to provide updates through official announcements and personalized notices if new information emerges.

Meanwhile, customers of Nihon Kotsu are advised not to open attachments received via suspicious communications claiming to originate from the company, and to avoid clicking any links in those messages.

At the time of writing, no ransomware groups or extortion gangs have assumed responsibility for the attack.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Prompt injections, the malicious commands attackers embed into content to entice large language models to follow them, have been attackers’ go-to tool for turning AI platforms against their users. A well-phrased command sneaked into an email or calendar invitation is often all it takes to cause the LLM to exfiltrate sensitive data or follow other harmful actions.

Now, defenders are embracing the prompt injection, too.

A strong, sharp effect

Researchers from Tracebit on Monday said they found that placing prompt injections alongside passwords, cryptographic keys, and other secrets stored on Amazon Web Services was often all that was needed to shut down attacks from AI hacking agents. The prompts direct the attacking LLM to perform an action forbidden by its guardrails, the safety barriers AI developers erect to prevent it from taking harmful actions. The LLM responds by shutting down.

Examples are a prompt that orders the LLM to provide steps for developing inhalable Anthrax spores, or, in the case of LLMs from Chinese developers, make references to the iconic Tank Man from the 1989 Tiananmen Square massacre. Once the LLM encounters these forbidden commands, it no longer follows its existing commands. The researchers have named the technique context bombing.

“Ultimately we’re triggering a refusal mechanism in the context,” Andy Smith, co-founder and CEO of Tracebit, said when explaining the name choice. “What we’re trying to capture is the fact that this does have a strong, sharp effect and one that can be difficult for the agents to come back from. Once they get that into their context they are going to keep refusing.”

Tracebit says initial testing suggests context bombing has great potential. They tested Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6 by giving them instructions to perform routine developer tasks that led the models to enumerate resources and stumble onto the planted strings. They ran the models inside a simulated AWS environment.

“Across five leading models and 152 attack runs, planting one of these strings in a decoy secret cut the rate at which agents seized full account admin from 57% to 5%, and complete compromise (where they also left themselves a persistent foothold) from 36% to 1%,” Monday’s post reported. “The most capable agent in our tests, Opus 4.8, went from achieving admin access in 93% of runs to failing every single time when confronted with a context bomb.”

Microsoft’s Satya Nadella says every firm using AI is paying for it twice, once in cash, and once in the secrets it hands over to make the thing useful. He calls it the Reverse Information Paradox. He also runs the company that helped build the trap.

Satya Nadella has a warning for everyone buying AI. You are paying for it twice. And the second payment is your crown jewels.

In a long essay on X that drew 10 million views, the Microsoft chief laid out an idea he calls the Reverse Information Paradox. It is sharp, a little wonky, and more than a little awkward coming from him.

Pay once in cash, once in secrets

The name is a riff on the Nobel economist Kenneth Arrow. Arrow’s original paradox was the seller’s problem. To sell information, you often have to reveal it, and once it is revealed, why would anyone pay?

Nadella flips it. In the AI age, he argues, the risk sits with the buyer. To make a model genuinely useful, you have to feed it your proprietary knowledge. The better you want it to work, the more you feed it.

So you pay in money, then again in something worth more: the know-how that makes your company yours. “The seller learns more and more about you as you use what you purchased”, he wrote, “while you learn very little about what the seller is learning in return.”

The leak you cannot see

The clever part is where he says the knowledge escapes. Not through some obvious breach, but through what he calls “exhaust”: the prompts you write, the tools your agents use, and above all the corrections you make when the model gets something wrong.

Every fix teaches the model. “It’s the kind of knowledge a competitor could never buy”, Nadella wrote, “and the kind that leaks almost imperceptibly: trace by trace, correction by correction, eval by eval.”

His verdict is blunt. If learning only flows one way, the money flows with it, toward whoever owns the AI, not whoever owns the knowledge.

The irony is doing a lot of work

Here is the catch. This is Microsoft talking.

Redmond poured billions into OpenAI and hosted ChatGPT on Azure. Its Copilot assistant is built to reach deep into a company’s email, files and chat. Back in 2024, roughly half of the data chiefs in one survey had paused or curbed Copilot over exactly this fear, as the Register noted.

To his credit, Nadella names his own side’s double standard. AI labs demand fair-use rights to train on the public web, then restrict customers from doing the same with model outputs. He is not wrong. He is also selling the fix.

Nadella’s answer, and his pitch

The solution, he says, is a hard “trust boundary” around a company’s data, evals and memory. Nothing crosses it, “not even the intelligence exhaust, without consent.” He borrows a line from Palantir’s Alex Karp about wanting to own the means of production.

His checklist runs to five points. Own your evals. Build learning environments inside your own tenant boundary. Keep the orchestration layer free of any single model. Then let it all compound. Microsoft, naturally, sells products that do each of these things.

Strip out the pitch and the core point still holds. This is the same executive who turned on the AI giants he helped build. The frontier labs are quietly amassing a fortune in other companies’ know-how. And the firms handing it over are, for now, doing it for free.

Of all the debates raging about the potential downsides of AI, there is one worry causing the most hand-wringing among AI enthusiasts in Silicon Valley. Their fear is that the giant AI labs that sell proprietary models are somehow acting like Trojan horses.

The concern is that, as startups and enterprises use AI models from labs like OpenAI and Anthropic, the labs gain ever-increasing access to those companies’ most sensitive business information. The model makers can then use that knowledge for themselves, potentially becoming competitors to their own customers. Those issuing such warnings range from VCs like Jason Calacanis to Palantir CEO Alex Karp.

Now, in a surprising blog post published on Monday, Microsoft CEO Satya Nadella has joined this crowd. Nadella warns that AI users (the “buyers” as he calls them) are paying twice. They knowingly spend for AI token usage but they also, obliviously, hand over valuable data in the process.

“You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful. The better you want the model to perform, the more of that knowledge you have to feed it!” he writes.

Most dangerously, enterprises are literally teaching the models about the nuances of their businesses, he argues.

“Models learn from ‘exhaust,’ the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong. Every correction is distilled into institutional know-how,” he writes.

This is “the kind of knowledge a competitor could never buy,” and yet enterprises are handing it over.

Nadella argues that if AI companies get to freely scrape the internet to train their models, it’s only fair that enterprises get to study — or “distill” — those models in return. “Distillation” is the practice of using a model’s own outputs to learn how it works and to train a new, often cheaper, model based on those insights. In February Anthropic accused Chinese open source models of sending millions of prompts to Claude as a way to improve their own models, and urged the U.S. government crack down on export controls.

Nadella’s point is that model makers can’t have it both ways. It’s hypocritical for them to freely train on the world’s data while restricting others from doing the same to their models.

“While the great innovation that comes from model providers having fair use rights to train models on public data is needed, I find it ironic that the status quo is to then turn around and impose restrictive terms on distillation,” the Microsoft CEO writes.

Nadella is particularly concerned when model makers “reserve the right to learn from customer usage and interaction data.”

Nadella’s solution is the kind of thing the CEO of a giant cloud provider would suggest. He wants companies to “retain ownership” of their data including prompts, feedback, etc. So he’s urging them to build their own “proprietary learning environments” on the cloud (where their data is likely already stored anyway and, conveniently, which could mean Microsoft’s cloud, Azure). He also wants companies to build in what he calls “orchestration layers” — essentially, a way to easily switch between AI models from different providers rather than being locked into one. Tools like AI “gateways” that let companies do exactly this, have become increasingly popular.

While Nadella never uses the words “open-source” as the method for retaining ownership, this is an obvious subtext. Yet, there’s another subtext.

Large companies, many of which still have some of their own data centers in addition to using the cloud, are already moving to open source models installed on their own premises (“on-prem,” in industry jargon). Idit Levine, founder and CEO of Solo.io — which makes networking and security software that helps enterprises manage AI systems — says she’s seeing exactly this shift play out with her own customers. After experimenting with proprietary model makers, they start asking themselves: “Can I take an open-source model and run it on-prem? It will do almost 90% of what the big one’s doing. It will cost way less,” she tells TechCrunch. “They understand that, and they can control it.”

Solo.io’s technology was selected last year as the tech powering the Linux Foundation’s Agentgateway project. Her company counts enterprises like T-Mobile, ADP and SAP as customers. She sees companies increasingly installing on-premise open source models and sees it as the next big wave in enterprise AI use.

She’s not alone. Vercel — best known as a platform for building and hosting websites, which has recently added AI model-switching tools — and OpenRouter, a company that helps developers route requests across different AI models — are both seeing a surge in traffic to open-source models. In fact, open models accounted for 29% of all traffic routed through Vercel’s gateway last month.

With the CEO of Microsoft, a company that has invested in both OpenAI and Anthropic, now openly urging enterprises to be wary of using proprietary models, we’ll bet this trend continues to grow. “In consuming intelligence, you are creating intelligence. And what you create should belong to you,” Nadella writes.

Tesla is building a wheelchair-accessible autonomous vehicle, a Tesla representative told lawmakers in Washington, DC, on Monday.

“We are in development for a purpose-built, wheelchair-accessible autonomous vehicle,” Tesla senior policy advisor India Herdman told members of the DC City Council on Monday, during a hearing focused on a controversial bill that could allow robotaxi services to operate in the District. “We know that paratransit can be very difficult, and people who are confined to wheelchairs permanently should still be able to move around freely, so that is an active product being built by Tesla in Texas,” she said.

Tesla didn’t respond to a request for comment. Herdman provided no further details about when a wheelchair-accessible product might be available. The electric automaker often takes several years to manufacture its announced products.

Tesla operates a small fleet of autonomous vehicles in the Texas cities of Austin, Dallas, and Houston and, as of this month, in Miami, Florida. (It also operates a service that uses human drivers in the San Francisco Bay Area.) The limited fleet uses Tesla Model Y, a compact SUV that is not wheelchair accessible.

The company has started to manufacture and test a purpose-built Cybercab, meant exclusively for autonomous driving and without steering wheels or pedals. These Cybercabs are not wheelchair accessible, though Tesla highlighted in an X post this month its accessibility features, including braille lettering on controls and wheelchair-height seating to allow for easier transfers.

Tesla and its CEO, Elon Musk, have hinted previously at a wheelchair-accessible autonomous vehicle. The company introduced an accessibility tab in its Robotaxi app last fall, though it directs users to other wheelchair-accessible ride providers in the area, rather than to Tesla’s own service. “We are working on accessible rides,” the app says. In response to an X user’s post last fall about Tesla working on accessible rides, Musk responded, “Absolutely.”

No US robotaxi company currently offers fleetwide driverless, wheelchair-accessible rides, including market leader Waymo. At the DC hearing on Monday, Waymo regional head of state and local policy Matt Walsh said, “To date, it’s my understanding that we haven’t been able to identify a platform that is fully wheelchair-accessible while also meeting the unique specifications to retrofit that vehicle with our technology.” He continued: “Now, I don’t want that to sound like a cop-out. We are trying to find that vehicle.”

Waymo has touted the accessibility features of its newest vehicle, the Zeekr-built Ojai, including its flat floor, low step-in height, and grab bars. But it is not wheelchair accessible. Michigan-based Ann Arbor autonomous-vehicle developer May Mobility offers rides in wheelchair-accessible vehicles in some of its markets, with a human operator on board to help deploy necessary ramps.

The Americans With Disabilities Act prohibits discrimination against people with disabilities in transportation services and requires reasonable modifications to provide equal access. Some but not all US cities require ride-hailing companies to provide wheelchair-accessible services. Many of those companies provide those rides through partnerships with specialized fleets made up of wheelchair-accessible vehicles.

In September 2025, the US Department of Justice sued Uber for “refusing to reasonably modify its policies, practices, or procedures where necessary to avoid discriminating against riders with disabilities.” The case is being litigated.

General Motors’ Cruise introduced a prototype wheelchair-accessible driverless taxi in 2023 and said it intended to roll out the vehicle in its self-driving car service in 2024. But following a collision with a pedestrian, Cruise all but halted national service in 2023. The next year, General Motors stopped funding its self-driving unit entirely.