AI agents

The article argues that SRE teams will judge AI agents by the conditions under which they trust them, not by whether they use them. It says trust is earned through observability, constraints, accountability and repeated production evidence, and that teams should move up a trust ladder with progressive autonomy.

A sales operations team builds an AI agent to manage renewal requests. The agent reads inbound customer emails, checks CRM account records and contract terms, drafts responses, updates opportunity stages and creates follow-up tasks. The source text is cut off before it reaches its main argument about securing such agents.

Google DeepMind, Schmidt Sciences, the Cooperative AI Foundation, ARIA and Google.org are announcing a research funding call of up to $10M for researchers worldwide. The call targets safety risks that emerge when large numbers of independently built AI agents interact, including sandboxes and testbeds, agent network science, agent infrastructure, and oversight and control.

JPMorgan Chase plans to deploy AI agents later this year that can work autonomously for much longer than current versions, according to chief analytics officer Derek Waldron. He said agents are moving from single-task tools to digital workers that manage multi-step workflows across software programs, and that they could soon run for an hour or two, then for multiple hours, days and weeks. He also said long-running agents are not yet ready for corporate use because of security concerns.

Adoption of AI agents is expected to surge by as much as 300% in two years, prompting leaders to weigh a hybrid human-AI workforce. Wipro's custom agentic AI assistant, co-created with Ema Unlimited, now handles 50 HR tasks and cut average query response time from 48 hours to five seconds. Wipro's chief culture officer, Ateet Jayaswal, argues that humans must stay in the loop and that governance, including data privacy rules and an AI council, should be in place.

A security startup, depthfirst, reported 21 zero-day vulnerabilities in FFmpeg found by its autonomous AI security agent, each with a reproducible proof-of-concept input, at a cost of around $1,000. The same week, Google shipped Chrome 149 with fixes for 429 security bugs, a record for a single release, though Google did not tie that count to AI.

Microsoft has identified seven new failure modes in agentic AI systems, extending the first Taxonomy of Failure Modes in Agentic AI Systems it published last year. The new modes include Goal Hijacking, Inter-Agent Trust Escalation, Computer Use Agent (CUA) Visual Attack, and MCP / Plugin Abuse. Microsoft attributes the expanding list to rapid mainstream adoption, the maturing Model Context Protocol (MCP) ecosystem, the rise of computer-use agents, and more empirical findings from real-world research.

Researchers say AI worms, described as "viruses with wings and brains," can adapt to new environments and seek out vulnerabilities. They are likely to strike within a year.

CrowdStrike and NVIDIA's collaboration on securing autonomous agents is cited as part of industry efforts to define secure agentic AI at scale. The article argues that organizations should treat AI agents as privileged identities, secure the full AI lifecycle from build to runtime, and use AI to defend against AI-driven threats.

Microsoft's AI Red Team has published v2.0 of its Taxonomy of Failure Modes in Agentic AI Systems, updating the April 2025 v1.0. The update adds seven new failure mode categories, expands the mitigations section, and draws on 12 months of red team engagements against deployed agentic systems. It cites open-source frameworks such as OpenClaw, where CVE-2026-25253 was a one-click RCE via WebSocket hijacking, and 99 CVEs published in 2025 for MCP-related software.

Dave Wajsgras, CEO of Everfox, argues in a contributed piece that agentic AI in defense networks needs secure infrastructure to deliver its benefits. He cites a reported but unconfirmed claim that an unauthorized group gained access to Anthropic's Claude Mythos model within hours of its limited technical preview. He names three areas to secure: what enters the model, who and what can access it, and where AI agents reach back out.

Willow, formerly Webrix, emerged from stealth with an identity and access platform for enterprise AI agents and $7 million in seed funding from Hetz Ventures and executives at Wix. The platform acts as a centralized gateway for tools such as Claude, Gemini, and ChatGPT, assigns a verifiable identity to each AI agent through identity providers such as Okta and Entra, and enforces least-privilege access controls at runtime.

Endava, a global technology services company, has made OpenAI its enterprise AI platform, giving employees ChatGPT Enterprise and Codex access. The company has embedded OpenAI technology across its DavaFlow lifecycle, from meeting preparation and planning to software engineering and deployment, and has extended AI agents into legal, finance and operations work.

Morgan Stanley will soon let clients' autonomous AI agents pull data and insights directly from its ShareWorks and Equity Edge stock administration platforms, bypassing interfaces built for human users, according to Mark Mitchell, the firm's chief product officer for Morgan Stanley at Work. The bank has granted early agentic access to a handful of clients and plans to open it to its 3,400 administration clients by next year. The firm relies on the Model Context Protocol to make this connection.

Meta announced Meta Business Agent, a feature that lets businesses use AI agents across WhatsApp, Messenger and Instagram to answer customer questions, recommend products and book appointments. It will be part of a business-focused subscription tier within Meta One, and businesses on WhatsApp Business Platform will be charged on a consumption basis. The move aims to diversify Meta's revenue, which still relies on ads for about 98% of income.

Adversa AI tested and ranked 100 AI agents across ten categories, placing them on a new AI Risk Quadrant. Only 11 were rated 'capable well-defended', and 98% of the agents have what Adversa calls the 'lethal trifecta': private data access, exposure to untrusted content, and the ability for outbound actions. The analysis describes a 'power-protection inversion', where the most capable agents also carry the widest attack surface, with computer agents and coding agents showing the greatest inversion.