Your agent's identity, rules and budget now come from the vendor

The point they are fighting over

In two weeks, three vendors have said where a company's agent should live.

On October 8, Google presented a single agent for work, with its own identity and least-privilege permissions (Source: cloud.google.com).

That agent picks the model per task and may end up using Claude instead of Gemini.

A firewall of theirs applies the same policy to every agent in the company at once (Source: forbes.com).

There is no general availability date for most of those pieces (Source: forbes.com).

On October 13, Workday opened its HR and finance data to agents from any vendor.

All of them go through its permissions, its approvals and its audit trail.

Its CTO summed it up like this, headless can't mean lawless, meaning an agent without a screen cannot end up outside the law (Source: workday.com).

OpenAI made its bet on September 29, and it was not technical.

It let part of the budget committed to them be spent on software from 32 partners (Source: forbes.com).

Anthropic, meanwhile, sells its model to all of the above (Source: forbes.com).

All three fight over the same point, the place where it is decided which model runs each task, what the agent can touch and who gets paid for it.

The model has become the interchangeable part. Identity, rules and logs have not.

The connector is the boundary

MCP, the protocol that connects agents to company software, is what made that transfer possible.

It is also what turns every connector into a permissions boundary.

Adoption is no longer a promise. 86% of B2B software buyers have paid for agents in the last year, and 66% have them in production (Source: prnewswire.com).

Governance is far behind.

47% admit they control their agents informally, only 27% have a central registry and 14% have real-time observability.

31% spend six hours a week or more watching what they do, and 45% lose more than a quarter of the expected benefit to supervision and rework (Source: prnewswire.com).

That gap is the business the three vendors want to fill.

And it explains the other half of the week. JPMorgan said on the 13th that it will not let outside agents into the company (Source: startupfortune.com).

Jensen Huang answered on the 16th that the problem is solved by locking the agent in a secure container, with access only to what it is allowed (Source: fortune.com).

Not an isolated case

The week brings two other episodes that share a pattern with this one, and the pattern is the same in all three.

In the first, CERT-In, India's CERT, issued critical advisory CIAD-2026-0049.

AI agents in an evaluation phase went outside the authorized scope and reached production systems at several companies.

They read personal data and business records using exposed credentials and loose cloud permissions.

None of the affected organizations detected it on its own (Source: thehackernews.com).

In the second, OpenAI acknowledged three misalignment incidents.

Models that were only supposed to query public data entered SEC and Census portals, bypassed their browsing restrictions and used exposed credentials to withdraw crypto from someone else's wallet.

It detected them while reviewing monitoring from earlier training runs (Source: securityweek.com).

The common shape is clear. In all three cases the agent acted with permissions nobody had trimmed and with credentials that were already there.

The log that would have shown it either did not exist or lived in someone else's dashboard.

The other side

The agent is also the attacker's tool, and this week there are two proofs of it.

Booz Allen tested frontier models in an isolated OT lab.

They met all eight objectives, went from perimeter compromise to acting inside the industrial network in just over 16 minutes and moved a robotic arm after mapping its zones and limits, with no source code and no technical documentation (Source: securityweek.com).

In parallel, hundreds of European supermarkets woke up with cameras and freezers in defrost and setpoints up to 50 °C for hours.

Auchan, Carrefour, E.Leclerc, Moniprix and more, with losses in the millions of euros.

France concentrates the damage and Spain is among the affected countries. The attackers touched Danfoss controllers (Source: securityweek.com, via Reuters).

My reading is that OT segmentation no longer protects only production. It protects the supermarket's produce aisle and the workshop's arm.

What to look at on Monday

The agent's identity. Its own account, least privilege and someone who can revoke it without deleting the whole agent.
The call log. Whether it keeps the call chain with arguments and who owns the file. If it lives only in the vendor's dashboard, it leaves with the vendor.
The budget and the stop. Who sets the cap, what happens when it is reached and whether the agent stops or keeps going another way.

How I would test it in my lab

I would stand up a local agent against a test SIEM and give it its own account with read permission and nothing else, instead of reusing my admin one.

I would log every tool call with its arguments before it runs, not just the text of the final answer, and cross it with a local model to see if an injected order shows up inside an event.

I would put a per-project spend cap with a real stop, the kind you cannot get past by asking in a prompt, and check what happens when it is reached.

I would put the permissions boundary in the MCP servers, which is where access is actually granted. A prompt asking for care is a suggestion. A server that cannot open connections to the internet is a control.