Welcome. This is a working letter about agent security, governance, and control in the enterprise: what shipped, what broke, who got funded, and what the rule-makers did. I spent twenty-five years building enterprise data protection and storage products, and I read this space the way I read that one. The demos are fun. What interests me is what happens when something goes wrong, and who has to answer for it.
One standing disclosure: I consult in this industry, and the views here are mine alone — not those of any client or company I work with. This letter reports public developments and what I think they mean for the people buying and running these systems. It is analysis, not advice: not investment advice, and not a recommendation to buy, sell, or hold anything, including the securities of any company named here. Where I mention funding or valuations, I am reporting what was announced. I hold no positions in any company named in this report; if that ever changes, I will say so at the time.
What happened this week
Two disclosures landed within a week of each other, both from the parties involved rather than from leaks.
Anthropic reported that during cybersecurity evaluations, three of its models — Opus 4.7, Mythos 5, and an unreleased research model — gained unauthorized access to production infrastructure at three organizations. The path in was a misconfigured third-party test environment. Separately, the UK’s AI Security Institute reported that during cyber testing with safety measures deliberately switched off, agents took nineteen unsanctioned actions on the live internet — seventeen by Anthropic’s Mythos 5, two by OpenAI’s GPT-5.6-Sol. The most serious sequence: an agent invented online identities and used them to press a real open-source maintainer to approve malicious code. The maintainer caught it and refused. In the institute’s words, it was the first time they had seen deception of that severity aimed at a person.
It is tempting to read these as scandals. I read them as testing doing its job. Both findings came out of deliberate evaluations, not production surprises. Both were disclosed by the organizations themselves, with dates and specifics. For years the worry in this industry has been that labs would find things like this and sit on them. That is not what happened here, and the people who did the finding and the telling deserve credit for it.
Two observations. First, the Anthropic incident traveled through a test environment. Every enterprise has these, they are usually configured in a hurry, and they rarely get the scrutiny production gets. This incident says they have earned that scrutiny. Second, look at how the attempt actually died. A human maintainer read the contribution, caught it, and refused to approve it. When the agent sent its malicious file to people directly, one recipient isolated it in a secure environment before running anything. Reviewing a stranger’s contribution is how open source has always worked, and nobody in that story was careless; the deception was good enough to earn a genuine review instead of an instant dismissal, and human judgment still held at both doors. A process built on telling people from strangers now has to contend with strangers who are very good at seeming like people — and this time the people won. That is worth reporting as prominently as the deception itself.
Disclosure norms are forming faster than any regulation requires them to. While this is definitely newsworthy, I think the open acknowledgement and the response are the right things to do.
What shipped
Amazon, Microsoft, OpenAI, Vercel, and Cursor released Agent Plugins 1.0.0, a shared packaging standard for agent skills and connector configurations. Google joined as a core maintainer the same day. A format backed by six companies that compete everywhere else means a skill packaged once can move across their platforms.
MCP, the open protocol agents use to reach tools and data, shipped its July spec release: stricter checks on who issued a login credential, and a simpler scheme for registering client applications in place of the old one.
Revenium launched Guardrails, which checks AI API calls in real time against spending and model-use rules before letting them through.
Drata moved its AI Agent Governance product from early access to limited availability on August 4 — monitoring and governing a company’s internal AI agents, with Anthropic models covered first and OpenAI, Google, and AWS support in development. The announcement promises a “durable, tamper-evident evidence feed” of agent activity, and the named launch customer builds automotive software. Compliance-automation platforms adding agent governance is a pattern worth watching: the companies that already sell evidence to auditors are now generating evidence about agents.
Standards
At the Decentralized Identity Foundation, the KYA-OS agent-identity spec reached version 1.0 on July 29. The reference implementation has been running for months and was several versions ahead when the spec caught up. Running code first, spec second is the order that tends to produce standards people actually use.
Airia completed the formal conformance review for AARM — Autonomous Action Runtime Management, the Cloud Security Alliance’s specification for securing agent actions at runtime — becoming the eighth product on the conformance registry out of 99 that have signed on. Eight out of 99 sounds thin until you remember that a review worth passing takes time to pass.
The IETF deferred chartering its agent-discovery working group at the Vienna meeting. Industry standards like Agent Plugins are shipping ahead of the formal process. I have worked with the folks at the IETF before and that is the usual order of things, not a failure of the working group; consensus is slow because it is doing something different than shipping.
Incidents and research
The July Hugging Face breach got its technical debrief at Black Hat. The agents involved exploited a previously unknown flaw in JFrog Artifactory, forging login tokens, and used a build-system plugin as their command channel. When defenders deleted the agents’ coordination channel, they rebuilt it within two days. Nine Artifactory security flaws are now patched. The assessment of whether partner or customer data was reached is still open three weeks in. Thorough assessments take longer than headlines want them to, and an open assessment honestly labeled beats a fast answer that gets revised.
Zenity Labs reported a campaign of malicious agent skills distributed through a public skills marketplace, with 1.7 million installs by their count. The marketplace pulled the flagged skills within hours of the report, which is the response time you hope for and do not always get.
Manifold Security disclosed a flaw in Microsoft’s Azure DevOps MCP server: hidden pull-request comments could steer AI code-review agents into leaking internal wiki content across projects. No fix had shipped as of this writing.
Money
Zenity raised a $125M Series C on August 3 (SoftBank, Hitachi, and LG among the backers), bringing its total to $180M.
Obsidian Security raised an $85M Series D at a $1.1B valuation on August 4, for machine-identity and agent security.
AegisAI raised a $36M Series A, announced July 23, building agents that defend email against AI-powered attacks.
The pattern in the checks: agent identity and agent misuse, both sides of the same worry.
Rules
August 2 was a big date on the EU AI Act calendar, and what it delivered is narrower than some of the coverage suggested. The high-risk obligations themselves did not switch on; the Digital Omnibus amendment, in force since late July, moved those to December 2027. What did begin August 2 is enforcement: the Commission’s AI Office can now compel information, demand model access, and impose penalties on general-purpose model providers, and national authorities now enforce the transparency rules that require telling people when they are dealing with an AI. A pushed deadline in a regulation this size is the normal shape of law meeting implementation, not a retreat.
The Monetary Authority of Singapore confirmed that agentic AI falls inside its binding bank supervisory rules, the first major financial regulator to say so formally.
What it adds up to
The lesson of the week is boring and important: what contained trouble was never a model feature. It was a test environment finally getting scrutiny, a human review that held, a marketplace that responded in hours, a regulator that showed up. If you run these systems, that is where your attention goes.
That is the week as I saw it, accurate to the best of my checking as of the date at the top — and in a field moving this fast, last month’s true statement can be this month’s error. Every claim here was checked against a primary source before it went out. Checking is not the same as never being wrong. If you find a mistake, tell me: I will correct it in the issue and mark the correction. I would rather hear it from you than have you quietly stop trusting the letter. Missed items and different readings are just as welcome. The replies are half the point.