TL;DR
Broadcom used VMware Explore 2026 to ship the first major “deny-by-default” runtime for enterprise AI agents, plus an agent traffic controller it says already handles ~43 million API calls a day internally. The VMware AI Factory compresses bare-metal-to-first-model from weeks to hours and serves 150+ governed models, but the strategic signal is the security layer: Tanzu Platform Agent Foundations forces every model, tool, and dataset an agent touches to be explicitly bound, and AgentMinder authorizes each action against the agent’s declared mission, intent, context, and risk. The subtext is uncomfortable — Gartner finds 76% of IT leaders now hold a negative view of Broadcom’s VMware ownership — even as the company leans on its hypervisor position to become the control plane for autonomous software.
Why this matters now
For two years, the enterprise conversation about AI agents was “can they do the work?” The survey data says that question is now closed — in our coverage of Temporal’s 2026 report, 80.8% of engineers already use agents daily. The question that replaced it is harder: how do you control software that has agency? (Source : Temporal — The State of Development Report 2026)
Broadcom’s answer, unveiled August 31 at VMware Explore in Las Vegas, is to stop treating agent security as a toolkit and start treating it as a runtime — a sandbox where every model, tool, and dataset must be explicitly bound before an agent can touch it. It’s the clearest signal yet that agent governance is becoming its own product category, not a checkbox on an existing platform. (Source : SiliconANGLE — Private AI agents get a deny-by-default runtime from Broadcom)
Deny-by-default is the philosophical break
The default posture of most agent frameworks today is permissive: an agent is handed credentials and a tool list, then trusted to behave. Broadcom is inverting that. Tanzu Platform Agent Foundations — now bundled into VMware Private AI Cloud — runs agents in a sandbox where “every model, tool and dataset must be explicitly bound,” as Purnima Padmanabhan, GM of the Tanzu Division, put it to theCUBE. (Source : SiliconANGLE — Private AI agents get a deny-by-default runtime from Broadcom)
Her framing is blunt: “The right way to secure an agent is to put it in a black box and give it nothing, but then you won’t get any intelligence.” The compromise is curated access — identity, role-based access control, and credential management wrapped around “curated data products” that handle chunking and vectorization so agents never touch raw sources directly.
The enforcement layer is a separate product, AgentMinder, which Broadcom describes as a traffic controller for agents. It verifies an agent’s identity and authorizes every action against the agent’s declared mission, intent, context, and risk — in real time, not after the fact. Broadcom already runs it internally at “massive global scale,” peaking near 43 million API calls per day with zero downtime. (Source : Network World — Private AI cloud, agentic infrastructure dominate VMware Explore)
The infrastructure play: weeks to hours
Underneath the security story is a classic enterprise-infrastructure pitch. The VMware AI Factory is not a separate product and costs nothing extra; it’s what customers assemble using VMware Cloud Foundation’s automation to go “from bare-metal server deployment to serving the first AI model from weeks to a matter of hours,” per CMO Prashanth Shenoy. (Source : Network World — Private AI cloud, agentic infrastructure dominate VMware Explore)
The numbers stack up. It certifies AI ReadyNodes from Cisco, Dell, Lenovo, Supermicro, and AMD (Instinct MI350 GPUs with ROCm), and exposes more than 150 open and commercial models — Nemotron 3, Gemma 4, Qwen 3.7-Max, GLM 5.2 among them — as governed models-as-a-service. Secure AI Sandboxes wrap agent-generated code in virtualized containers with a control layer defining how agents are invoked, which tools they can access, and how outputs are validated before action. (Source : Cybersecurity News — Broadcom Launches VMware AI Factory to Secure Enterprise AI Agents)
The open-source angle is TrueSource, which folds Broadcom’s Spring stewardship into clean-room builds for Java, Python, and Node.js. Broadcom claims its engineers burned through more than 12 billion tokens scanning Spring’s dependency tree with frontier models over the past five months, finding and hand-verifying vulnerabilities before attackers do. (Source : Network World — Private AI cloud, agentic infrastructure dominate VMware Explore)
The uncomfortable backdrop
The strategic tension is real. Omdia’s survey of 1,201 IT leaders found 96% already run a mix of cloud, on-prem, and edge for AI, with 41% of inference on-prem today — and 60% have repatriated workloads from cloud to on-prem. Broadcom is betting that owning the hypervisor means owning the enforcement point for private AI. (Source : Network World — Private AI cloud, agentic infrastructure dominate VMware Explore)
But the same report carries Gartner’s warning: 76% of IT leaders hold a negative view of Broadcom’s VMware ownership (up from 64% in 2025 and 33% in 2024), 67% are looking for alternatives, and by 2029, 55% of enterprises are expected to migrate 100% of their VMware workloads. Broadcom is simultaneously the most entrenched player in enterprise infrastructure and the one most customers say they want to leave. If the deny-by-default agent runtime works, it becomes a lock-in story; if it doesn’t, it’s one more reason to churn.
The deeper read connects to what we flagged in our agentic AI ROI coverage: enterprises are done piloting, and the vendors that win the next phase are the ones who solve trust and control, not just capability. Broadcom just made its bid to own that layer from the hypervisor up.
FAQ
What does “deny-by-default” actually mean for agents? Instead of handing an agent credentials and a tool list and trusting it to behave, every model, tool, and dataset must be explicitly bound to the agent in a sandbox before it can access anything. Nothing is available by default; access is granted per-resource, per-agent, with identity and role-based controls attached.
How does AgentMinder differ from a normal API gateway? AgentMinder verifies agent identity and authorizes each action against the agent’s declared mission, intent, context, and risk in real time — not just rate-limiting or routing. Broadcom reports it peaks near 43 million API calls a day internally, which is the scale signal that matters for enterprise fleets.
Is the VMware AI Factory a separate product I have to buy? No. Broadcom says it’s not a separate product and doesn’t cost extra — it’s assembled from VMware Cloud Foundation’s existing automation capabilities, aimed at cutting the bare-metal-to-first-model timeline from weeks to hours.
Why is Broadcom’s own customer churn the elephant in the room? Because the security pitch only works if customers stay. Gartner finds 76% of IT leaders now view Broadcom’s VMware ownership negatively, and 67% are hunting alternatives. A great agent runtime is also a powerful lock-in mechanism, and Broadcom needs that lock-in more than most.
Further Reading
- SiliconANGLE — Private AI agents get a deny-by-default runtime from Broadcom
- Cybersecurity News — Broadcom Launches VMware AI Factory to Secure Enterprise AI Agents
- Network World — Private AI cloud, agentic infrastructure dominate VMware Explore
- Temporal’s State of Development 2026: 80% of Engineers Use AI Agents Daily
- Agentic AI ROI: 96% of Enterprises Report Returns