AWS Announces General Availability Of AI Agents, Investment In FDEs

Amazon Web Services has opened up its WorkSpaces desktop streaming platform to AI agents and committed US$1 billion to a new engineering organisation that will embed AI specialists inside customer teams.

The two moves target the same problem from different angles: many enterprises still run core business processes on desktop applications that lack modern APIs, and bridging the gap between available AI technology and production deployment remains a challenge for most organisations.

Agents Can Now Operate Desktop Applications

AWS has made generally available the ability for AI agents to access and operate desktop applications through managed Amazon WorkSpaces environments.

Agents connect to streaming sessions and interact with applications through a managed Model Context Protocol (MCP) service endpoint. They authenticate through AWS Identity and Access Management and their activity is logged through AWS CloudTrail and Amazon CloudWatch.

Because agents connect to existing WorkSpaces environments, organisations do not need to build new APIs, migrate applications or add infrastructure.

Andrew Morgan, Developer Advocate for Agentic WorkSpaces at AWS, explained that the feature addresses a “last-mile challenge” in enterprise automation – the workflows most worth automating are often the ones agents cannot reach because they rely on legacy desktop software without programmatic interfaces.

During public preview, customers tested agentic workflows against legacy desktop software, internal tools and Windows applications. Their feedback shaped three capabilities arriving with general availability: MCP tool forwarding, real-time user control of agent sessions and support for domain-joined fleets.

Hybrid Execution With MCP Tool Forwarding

Not every step of a workflow needs pixel-level interaction. A computer-use agent operates the desktop with a screenshot, reason and act loop. While that loop works against any application that renders pixels, it is costly in terms of price, latency and reliability.

MCP tool forwarding lets organisations install MCP servers inside a WorkSpaces session and expose their tools directly to the connected agent. The result is a hybrid execution model: the agent calls MCP tools for subtasks that have a programmatic interface and falls back to visual interaction only where no API exists.

AWS argues this pattern is faster, cheaper and more reliable than pure screen-based automation. It also reduces the scope of what the agent does through pixels – instead of completing an entire multi-step process through the GUI, a visual subtask becomes something as narrow as clicking a refresh button in a legacy CRM that does not expose a refresh endpoint.

When tool forwarding is enabled on a stack, configured MCP servers running inside the WorkSpaces session expose their tools to the connected agent. The forwarded tools appear automatically when the agent lists its available tools.

Real-Time Human Oversight

The general availability release introduces user control mode, which lets a person watch an agent work in real time and intervene when needed. It is configured per stack with three levels.

VIEW_ONLY allows users to observe agent actions as they happen. VIEW_STOP allows users to observe and click a stop button to immediately remove the agent’s session access. DISABLED runs agents without user visibility, intended for fully automated production workflows.

AWS positions VIEW_STOP as the natural starting point, giving teams direct intervention during development and testing. As confidence builds, organisations choose the level of oversight that fits each workflow.

Enterprise Identity Through Domain-Joined Fleets

In most enterprises, access control and audit depend on Active Directory identities. Domain-joined fleets allow agents to take on a known identity within Active Directory, meaning organisations can apply the same fine-grained access control policies to agents that they already use for human users.

Audit logs attribute actions to a directory identity rather than a generic agent account.

The authentication flow differs from non-domain-joined fleets. For non-domain-joined environments, organisations obtain a streaming URL and use it within their MCP client connection. For domain-joined fleets, streaming URLs cannot be used. Instead, a signed SAML assertion from a SAML-integrated identity provider is required.

Monitoring And Audit

AWS has built monitoring into the agent access feature. Screenshot storage in Amazon S3 captures what the agent saw during each session, which can assist when debugging unexpected behaviour.

CloudWatch metrics report invocations, latency, client errors, server errors and session start and end times for every session. CloudTrail logs each agent connection, the tools the agent used and when sessions ended. Tool calls are recorded as data events.

US$1 Billion For Forward Deployed Engineering

Separately, AWS has announced a US$1 billion investment in a new Forward Deployed Engineering (FDE) organisation.

Francessca Vasquez, Vice President of Frontier AI Engineering and Services at AWS, wrote that customers have moved past exploring what AI can do and want to make it core to how they operate.

“I have also heard loud and clear that many customers need expert AI engineers working directly with their teams to help them build and become AI-native organisations,” Vasquez stated.

The FDE model embeds AWS engineers – many of whom build AWS AI services – directly inside customer teams. They work alongside a customer’s business, engineering and security teams to build and deploy production AI systems using the customer’s own data, governance and processes.

AWS describes the model as different from traditional consulting in three ways: it is agentic-first, it compresses timelines from months to days and it is designed so customers are self-sufficient when a deployment ends.

Agentic Deployment Technology

The FDE organisation uses what AWS calls the AI-Driven Development Lifecycle, an approach to software development that emphasises AI-powered execution with human oversight. Agents accelerate every phase of the lifecycle while human engineers verify and guide.

AWS Partners will contribute model expertise, industry knowledge and complementary skills to FDE engagements. AWS is investing in partner training, tools and resources to support the programme.

Designed For Self-Sufficiency

Customer self-sufficiency is built into the FDE engagement model. As projects advance, customer engineers move from observers to co-builders to autonomous operators.

Customers receive deployed systems, knowledge graphs, runbooks, architectural documentation and trained internal champions. Every engagement produces codified expertise intended to grow after the engagement ends.

At the core is a semantic layer that FDE teams deploy into the customer’s own AWS account. It connects to enterprise data sources, enriches metadata and uses AI to publish a governed, versioned knowledge graph. Agents reason over that knowledge graph, so domain expertise lives in the customer’s code rather than in institutional knowledge that could leave with personnel.

Security measures include hardware-based isolation, end-to-end encryption and customer data that does not leave the customer’s governance framework.

Customers Already Working With FDE Teams

AWS FDE teams are already embedded with organisations including the Allen Institute, Cox Automotive, the NBA, the NFL, Ricoh and Southwest Airlines.

Gary Brantley, Chief Information Officer of the National Football League, pointed to measurable results from the partnership.

“The NFL has millions of fans who want to consume football content throughout the year, including the offseason. We innovate at the pace and scale needed to meet the high expectations of our fans,” Brantley commented. “To create new digital experiences for our fans, the NFL partnered with AWS FDE and got engineers building alongside our team to launch into production in just weeks.”

Brantley added that the collaboration produced fan-facing products including NFL Fantasy AI and NFL IQ, which allow fans to interact with NFL data in new ways. “The engagement from fans and broadcasters was measurable from day one and was made possible by AWS’s delivery model,” he remarked.

AWS has previous form in this area. The company’s Generative AI Innovation Centre has worked on thousands of customer solutions over the past three years, including work with BMW to reduce service disruptions across 23 million connected vehicles, with Jabil on a manufacturing assistant for the factory floor and with Lyft to resolve driver support issues 87 per cent faster.

The FDE programme is aimed at organisations that have moved past experimentation and need production AI systems running real business processes, particularly in regulated industries, financial services and government.

Last Updated on July 1, 2026 by Nick Ross