# Broadcom’s VMware bolsters VCF AI foundation, agentic security > Source: > Published: 2026-08-31 13:00:28+00:00 Broadcom’s VMware division bolstered its Cloud Foundation (VCF) with an increasingly popular AI factory stack that is supported by a set of new security-focused layers tied to application management, orchestration, and agent control. Prashanth Shenoy, chief marketing officer for Broadcom’s VCF division, explained during a press briefing that the VMware AI Factory is a “turnkey, curated” platform providing a foundation layer for enterprises to run their AI-linked workloads. This platform includes “tested and validated” set of hardware and software vendor products that an enterprise can more easily stand up in their on-premises environments. Some of those initial partners include AMD for graphic processing units (GPUs); server vendors like Cisco, Supermicro, and Lenovo to support the AMD GPUs running VCF; and Metalsoft to provide integrated heterogeneous bare metal automation. Shenoy later added that these partners were just the initial set to be validated, but that others were being eyed, “and Nvidia is definitely top of mind for us.” Private AI services and models This AI factory floor will underpin new VCF Private AI services, which follows the general availability launch of that platform last year. The first is multitenant model sharing that as the name describes allows customers to deploy the model once and share it across multiple tenants. This sharing maintains rules set in in the initial deployment. The second is an updated AI gateway that includes a unified single consumption layer for customers to access cloud-based model providers and tools to help manage and build their AI applications. This includes support for intelligent prompt routing, token and usage rate limiting, and application authorization. The third is an upgraded AI secure agent framework that sandboxes agents within isolated, secure containers and regulates which tools and agents they can communicate with. This can also enforce network and resource controls to help prevent prompt injection attacks and unconstrained agent behaviors in production environments. VMware also validated a handful of AI models to run in VCF, with those deployments available to run on-premises through what the vendor terms a “model-as-a-service.” Shenoy noted that more than 150 models have been tested and verified, including Google’s Gemma 4, Nvidia’s Nemotron 3, NEC’s Cotomi, Alibaba’s Qwen 3.7-Max, and Z.ai’s GLM 5.2. ## TrueSource and Tanzu for agents That testing and verification angle continued into Broadcom’s newly launched TrueSource platform that ties together VMware’s open source offerings. Purnima Padmanabhan, GM for Broadcom’s Tanzu division, explained that there were three offerings under the TrueSource umbrella. These were Spring Enterprise, which is the “flagship” offering for the Spring ecosystem; TrueSource Trusted Artifacts, which provides secure “clean room” builds of the broader Java, Python, and Node.js ecosystems, and a secure catalog of hardened container images; and TrueSource Data Services that provides trusted artifacts, support, and deployment help for PostgreSQL, RabbitMQ, MySQL, and Valkey data engines. Padmanabhan later noted that the new Data Services product leveraged “a lot of the technology” from the vendor’s [previously released Tanzu Data Intelligence product](https://www.sdxcentral.com/news/broadcom-boosts-vmwares-cloud-native-cache/) but was now natively integrated into the Tanzu platform. “So the idea would be if I'm building an agent and I've got three sources, I shouldn't have to go and build a whole data lakehouse for that. Can I just go and point to my sources, and in the background the platform deploys the right-sized environments for me under the platform itself,” Padmanabhan explained. “So the agent building process becomes much faster.” Broadcom noted the TrueSource launch builds on its move earlier this year to [bolster the Spring ecosystem supply chain security](https://www.sdxcentral.com/news/broadcom-injects-security-updates-into-spring-java-ecosystems/). This involved what the vendor said was the “largest set” of Spring security updates across the open-source platform’s 23-year history, updates that were targeted at a surge in detected security vulnerabilities. Broadcom had previously noted that the number of monthly security advisories reported by the Spring community increased 1,700% from March to April of this year, and most recently pointed to [new testing from 1Password’s Off-by-1 Labs](https://1password.com/blog/why-ai-generated-patches-still-require-human-review) that found that 26% of 6,000 AI-generated patches fixed vulnerabilities without breaking applications, with that organization concluding “that automated patches are not yet safe enough to trust without significant human oversight.” Broadcom also bolstered its open-source credentials by stating it would contribute fixes back upstream. ## Minding agents Broadcom also launched its aptly named AgentMinder to act as a “traffic controller for autonomous AI agents,” an increasingly important task in light of recent events. The AgentMinder platform includes and identify and intent feature that requires every agent to identify itself and declare what it’s trying to do before it can touch an enterprise system; runtime enforcement through a cloud-native AI gateway designed to secure every “tool call” at runtime; and observability and audit capabilities through a OpenTelemetry-based layer to provide visibility into every agent session and action. Clayton Donley, VP and GM for Broadcom’s Identity Management Security Division, described AgentMinder as an “agentic fabric” that is deployed as “essentially a container” between the agents and a large language model (LLM), model context protocol (MCP) services, APIs, “and other kinds of tooling and things that those agents are going to be calling.” “It's ensuring that every time an agent's making a request from that agent harness or wherever it's running, it's got an identity that defines it to belong to that particular agent, possibly owned by this particular person. It's not just giving it an identity and making sure it's authenticated, but it's also enforcing least privilege policies on those agents as that traffic goes through,” Donley said. The AgentMinder launch comes on the heels of [OpenAI’s eye-opening postmortem](https://openai.com/index/hugging-face-incident-and-the-road-ahead/) on one of its AI systems attack on Hugging Face, which seemed to indicate a lack of human implemented guard rails allowed AI agents to bust out of sandboxed environments. While not commenting specifically on the Hugging Face attack, Padmanabhan did note that the AI gateway component “is critical.” “You can't do without it. You never ever give direct access to agents, and so everything goes through the gateway,” Padmanabhan said, adding this was important for more than just agent-to-agent communication. “It's true for everything: agent-to-model, connection-to-skills, connection-to-tools, connection-to-data products. Everything goes through a binding process, and so in our stack that you're seeing from VMware you'll see multiple levels of gateway … and you get incremental value or incremental security as you go through.”