Today’s AI News: Agents Are Gaining Access Faster Than Businesses Can Govern Them

What Happened

Several of today’s announcements move AI agents closer to business accounts and workflows. 1Password introduced a way for agents to log in without seeing a customer’s password, while Anthropic previewed Claude Duet, an agent that can continue tasks in the background and request approval for sensitive actions [1][23][34]. Major U.S. banks are taking the opposite approach to credential-based access: Morgan Stanley has blocked some agents, and banks generally plan to restrict agent access to read-only use [5].

The supporting infrastructure is changing too. Google introduced an agent runtime that places each Gemini agent in a hardware-isolated micro virtual machine. Action State launched tools for tamper-evident records of agent activity [9][26]. These controls arrive alongside a warning: in a pilot test, METR found a potential exploit that could have allowed agents to hide hundreds of recent actions from OpenAI’s monitoring system [15].

Other notable developments span products and research. Microsoft reported strong results for an AI diagnostic system on difficult cases, although a study suggests much of the improvement came from the underlying models rather than its orchestration system [3][4]. Canva released its first image-generation model to all users, and OpenAI plans to offer its latest models through Google Cloud [2][36].

Why It Matters to Businesses

Agent capability is no longer the only adoption constraint. An agent may be able to complete a task, but the organization still needs an acceptable way to grant access, limit actions and verify what happened. Banks’ restrictions show that customer authorization does not necessarily translate into permission from the system being accessed [5].

Returns also remain uncertain. A Gartner survey of 2,002 CIOs found that 13% of companies report real business value from AI investments, while 51% expect AI to increase operating costs [16]. Separately, a study of 718 firms found that AI coding tools increased code volume without a matching increase in completed work, in part because review became a downstream bottleneck [21].

Kimbodo Engineering Perspective

We would treat an agent as a distributed application with a limited mandate, not as a trusted user with broad credentials. Isolation helps contain execution; delegated permissions constrain what the agent can do; independent records help establish what it did. None substitutes for the others, particularly when monitoring itself may fail [9][15][26][28].

We would also separate model output from authoritative computation. For analytics, an agent can formulate a constrained query and explain the result, while a query engine produces reproducible figures. That boundary is more dependable than asking the model to invent both the calculation and its interpretation [32].

How We Would Implement It

• Start with one measurable workflow. Define the permitted decisions, baseline completion time, review effort, error rate and cost before adding autonomy [16][21][30].
• Use scoped, revocable access rather than sharing user passwords. Default to read-only permissions; require human approval for payments, account changes and other consequential actions [1][5][34].
• Run tasks in isolated environments with explicit state, timeouts and recovery paths. Record tool calls and approvals in tamper-evident logs stored separately from the agent’s own account of its work [9][15][26][28].
• Keep calculations and system-of-record updates behind validated APIs or constrained queries. Test the complete workflow, including review and rollback, rather than measuring only model response quality [21][32].

Risks, Costs and Security

Agent access creates new paths for account misuse, data exposure and hard-to-audit actions. Reports that attackers used AI agents to accelerate a ConnectWise-related campaign, together with findings of an autonomous agent exploiting exposed language models, reinforce the need to secure both the tools agents use and the models they can reach [11][27].

Budget for isolation, logging, human review and retained data alongside model inference. Faster generation or cheaper model calls will not produce a return if approvals, code review or incident response become the bottleneck [2][16][21].

Sources

1. [1] 1Password launches a way for AI agents to log in on your behalf without seeing your password
2. [2] Canva releases its first image generation model
3. [3] Microsoft’s Mustafa Suleyman says its AI outperforms doctors on hard cases as he chases ‘medical superintelligence’
4. [4] Microsoft says its GPT-5-powered Diagnostic Orchestrator uses agents that mimic panels of experts to diagnose conditions up to 4x more accurately than doctors (Robert Hart/The Verge)
5. [5] Major US banks are locking out AI agents that log in with customer credentials
6. [9] Google's Agent Compute Engine gives every Gemini agent its own hardware-isolated micro virtual machine
7. [11] Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
8. [15] METR says a pilot test of OpenAI's monitoring system found vulnerabilities, including an exploit that could have let AI agents hide hundreds of recent actions (Anzar Mehraj/Reuters)
9. [16] Only 13 percent of companies see real returns from AI, Gartner survey finds
10. [21] Study Finds AI-generated Code Fails to Boost Productivity Due to Downstream Bottlenecks
11. [23] Anthropic introduces Claude Duet, a proactive AI agent for professionals
12. [26] Startup Action State launches tools for verifying interactions between AI agents 
13. [27] An AI agent in "Skynet mode" hijacks unprotected language models to launch self-sustaining cyberattacks
14. [28] Presentation: Actors for Agents: Patterns for Production AI
15. [30] Making the case for context-aware AI
16. [32] Article: AI Changes the Data Interface, Not the Query Engine
17. [34] Anthropic takes on Grok Bot, Meta's Muse, and OpenAI's Dots with its always-on agent "Claude Duet"
18. [36] OpenAI to make its most advanced AI models available in Google Cloud