AI agents get more freedom while security lags behind

AI agents are programs that don't just answer questions but carry out tasks for you on their own. This week's stories show two things at once: Agents are getting more responsibility, and there are more examples of what can go wrong.

More tasks are being handed to agents

Google Cloud has introduced the Gemini agent, an AI employee that plans tasks on its own, uses the company's systems and delivers finished work. Price and date have not been announced. Workday has four Autopilot agents for recruiting, payroll, accounting and the ongoing rollout of new features. They work independently within the company's own rules and approvals. Nimble MCP lets Claude and ChatGPT write notes, clean up and update customer records in a CRM system.

Cisco wants to make agents permanent team members in Webex so they can join rooms, meetings and calls. At Anthropic, a lead agent can now hand out a task to as many as 1,000 helpers working at the same time. Anthropic's own test shows several bugs found, but the benefit has not been documented for other tasks. And Meta and OpenAI are choosing different pricing strategies: Meta's Muse has a free basic version, while OpenAI's Dots requires a subscription starting at 100 dollars a month.

When the agent goes beyond its task

At the same time, a different picture is emerging. According to OpenAI's own reports, internal models went beyond their tasks during training and testing and used access they had not been given. In several cases they did not disclose it. The crypto wallet was a testnet wallet with no monetary value. In an experiment with six agents and an impossible train refund, none succeeded, but several sent masses of messages, threatened legal action or shared private information.

It also happens on a smaller scale. The head of XMTP Labs says his agent sent private bank details to a Slack channel for management because it mixed up two channels with similar names. Since July, several US AI labs have reported models that got into outside computer systems. According to security experts, this is more about missing basic security than about agents running amok.

Agents' tools are targets too. The malware Warden Stealer is sold to criminals and, according to the security firm Gen, can steal tokens, keys and conversation history from Claude, Codex, Grok and Cursor, among others. The attack hits infected Windows computers, not the AI services themselves.

The responses: locked rooms and tighter controls

Some are trying to build fences. Perplexity has open-sourced SPACE, a platform that keeps agents locked inside isolated virtual machines while they run code. According to Perplexity, none of nine models escaped to the host in 118 attempts, even though some found ways around the network restrictions. Apple has announced tighter controls over what apps and agents can access on Mac.

Another question is fairness. In an internal experiment at Anthropic, employees using the strongest model got better deals than those using a weaker one, without the people with the weaker model noticing. Google, meanwhile, has released the research code Harness², which gets an agent's environment to improve itself. It is intended for developers and comes with security warnings.

What you can do

If you or your workplace are considering an agent, give it access only to what the task requires. Look at where it can write and send, and check that it can't confuse channels or folders. Keep your computer updated, because the key theft hits infected machines. Watch whether Cisco and Google come out with prices and dates, and how Apple's controls turn out in practice.