There is an instructive example in the Bank of England and FCA’s latest financial-services survey. Eighty per cent of respondents reported having agents deployed, but only 2% reported agents with broad autonomy. Most are still using them to support decisions that people make and execute. Financial services is adopting the technology while keeping a fairly firm grip on the consequential bits.
That distinction deserves more attention than it gets. An agent that prepares a recommendation has one set of responsibilities. An agent that changes a customer record, approves an outcome or initiates a payment has acquired a rather different job. Putting a person somewhere in the process is only useful if that person has the information, time and authority to challenge what is happening.
The expanded partnership between ServiceNow and OpenAI takes us directly into that territory. The announced direction joins models and agents with enterprise workflows, cybersecurity and development, including bringing ServiceNow actions into ChatGPT and Codex. There is an obvious attraction in asking for something and having the relevant systems carry it out. There are also several handovers hidden inside that apparently simple interaction. Somebody needs to know which permissions apply at each step and where an approval becomes an actual change.
Oracle’s planned application and data integrations with ChatGPT point in the same direction. Finance, procurement and other operational information could become easier to work with through one interface, governed by organisational permissions and approvals. The useful questions concern the detail: which records can the agent retrieve, what can it amend, and can the organisation reconstruct the transaction afterwards? A convenient interface can still conceal a complicated chain of authority.
IBM’s announcement makes some of that authority more explicit through discovery, identity, least privilege, credential revocation and containment. Discovery and containment are initially technology previews, which matters when assessing what can be deployed today. Still, the combination is useful. Knowing that an agent exists, establishing its identity and withdrawing its access are separate jobs. Organisations will need all three.
Google’s IAM Helper brings another part of this discussion into the workflow itself. Its Agent Skills and Model Context Protocol tools are intended to let agents inspect policies and carry out identity and access tasks through approved interfaces. That could remove considerable administrative friction. It also makes the design of those interfaces consequential. An agent requesting a permission change needs clear limits on what it can request and a reliable record of who approved it.
Security operations provides some of the strongest commercial pressure to expand autonomy. Attackers move quickly, queues grow and skilled analysts are expensive. Arctic Wolf says agents now resolve 60% of investigations in its security operations service, with another 38% involving collaboration between AI and people. Those are substantial figures from the supplier’s own operations. I would want to understand what counts as a resolved investigation, how uncertainty is escalated and how the company discovers something it should have investigated further.
Oracle AI Security Mesh connects frontier cyber models with identity and network controls across cloud and on-premises environments. The service is designed to find vulnerabilities and recommend remediation. Here, the boundary between observing, proposing and changing matters enormously. A security agent can be very capable at finding a problem and still need tightly controlled authority over the system it is examining.
Google’s account of using agents to find, track and fix vulnerabilities adds another practical point. Finding more flaws is useful when the organisation can preserve context, assign ownership, prioritise work and validate the repair. Otherwise, automation risks creating a faster route into an already crowded remediation queue.
Microsoft’s engineering account makes the verification problem particularly clear. As agents help modernise very large codebases, producing changes becomes easier than establishing that they are correct. Testing, specifications and architectural intent carry more of the burden. There is an awkward question here for anyone adopting AI at scale: how much change can your organisation reliably check?
The laboratory incidents deserve careful reading alongside those enterprise announcements.
OpenAI’s tighter containment policy belongs in that discussion. The company says it strengthened its research environments after a model exploited a DNS resolver misconfiguration to gain limited internet access. Frontier training now operates without live internet access, supported by additional isolation, automatic stopping systems and adversarial testing. These are research environments with particular risks, but the questions about network access and enforceable boundaries will be familiar to enterprise security teams.
OpenAI’s separate monitoring disclosure supplies some useful numbers. In a September training run, the company says its monitors detected internet access within 15 minutes and a human responder began reviewing it three minutes later. These are company-reported results, with acknowledged coverage limitations. They nevertheless give buyers something concrete to ask about: detection time, escalation time and the authority to interrupt a workload. “We monitor it” needs considerably more explanation.
Meanwhile, the consequences of convincing synthetic content are already appearing in fraud reports.
City of London Police puts reported losses from AI-assisted investment endorsement schemes at £24.3 million, across more than 1,300 reports between January and August. People aged 60 or over accounted for nearly four in five reports. The journey is depressingly recognisable: a persuasive endorsement, a supposed adviser, a professional-looking platform, apparent profits and increasing pressure to send more money. AI helps manufacture the credibility at the entrance.
INTERPOL’s deepfake-awareness campaign concentrates on practical verification routines. Pause, check through a known channel and use additional confirmation for consequential requests. For employers, banks and payment teams, that raises a useful operational question: can someone interrupt an apparently legitimate request without being hurried past the checks?
F-Secure and QuTwo are pursuing another part of the defence by moving scam detection onto consumer devices. Their model-compression partnership aims to support local, multilingual protection, potentially reducing the sensitive information sent to cloud services. The practical test will be how well that protection holds up across devices, languages and new scams, including how often it warns unnecessarily or misses something important.
There is plenty here for our AI-360 conversations: agent permissions, security automation, verification, deepfake fraud and the point at which a recommendation becomes an action somebody must answer for.
I can read the announcements. What I want to hear is how these arrangements work inside an actual bank, insurer, security operation or enterprise technology team. Where does approval slow things down? Where is it essential? What happens when the agent gets something wrong and the customer is already on the phone?
If you have experience to share, a result worth examining or a strong objection to the way these questions are being framed, I would like you in the conversation. Practitioners and suppliers are both welcome. There is room for useful disagreement.
