AWS publishes GuardDuty agent updates on a regular basis. For Amazon ECS on Amazon EC2, you can update to the latest agent version by updating to the latest ECS optimized AMI or ECS agent. For Amazon ECS on Fargate, the Fargate agent pulls the latest GuardDuty agent version automatically.
If you choose to manually deploy the agent per cluster, then you will be responsible to also update the agent when GuardDuty publicizes the release of a new version. New agent versions are carefully tested and monitored before, during, and after release. GuardDuty maintains a subset of previous agent versions so that you can roll back an update in the case where your application has a unique conflict with the agent; you can find detailed agent release history in the GuardDuty User Guide. For CVE patches and other urgent updates, follow AWS update guidelines included in your PHD notices.