Autonomous agents sound marvellous. Give them a job, let them get on with it, enjoy the productivity. Before we get too carried away, I would quite like to know who gave them permission to spend the money.
These are the conversations I want our AI-360 Research Notes and practitioner discussions to encourage. You will all shortly receive a separate midweek newsletter with the first batch of research notes. Each is accompanied by a short survey. All of the surveys will be open until Thursday, December, 17th. In the new year you will all receive the results.
Nineteen stories this week. Plenty of intelligence. Someone still needs to account for the keys.
ServiceNow’s latest AI Control Tower release describes discovery and blocking capabilities for unapproved AI services, drawing on network and endpoint information. That addresses an awkward starting point for governance: establishing what employees are already using. Finding a service is only the beginning, though. Someone still needs to own it, assess its data access and provide an approved alternative where necessary. Buyers will also need to test how much of their estate the discovery actually reaches.
The UK is consulting on whistleblowing reforms, including a proposed Serious Fraud Office reward scheme for people supplying significant original information about economic crime. The scheme remains a proposal. Its potential implications extend into how reports are assessed, evidence is preserved and whistleblowers are protected. AI could help investigators organise incoming material. Using it to make opaque judgements about somebody’s credibility would introduce a rather different set of problems.
Google Cloud’s agent guidelines prohibit fraudulent or unauthorised transactions and strongly recommend human oversight and explicit approval mechanisms for consequential activity, including financial and insurance decisions. Customers also remain liable for charges their agents incur. That puts some practical questions on the procurement table: who authorises a payment, what spending limits apply, and what happens when an agent delegates work? General platform safeguards still need to be translated into the organisation’s own permissions and approval processes.
Ministers want to examine how serious AI failures and near misses are identified, reported and contained. The announcement leaves important details unresolved, including reporting thresholds, deadlines and enforcement. Organisations can nevertheless start examining how an AI incident would move through their existing response arrangements. If an agent causes harm, legal, security, risk and customer support teams will need a shared account of what happened. Producing that account during the incident would be an ambitious time to begin.
Reuters’ examination of CoreWeave’s contracts and financing highlights the relationships between major customers, lenders and the infrastructure supporting the AI expansion. For banks, those relationships can create overlapping exposures through lending, investments, suppliers and customers. My interest here is how those risks are assessed together. Several apparently separate business relationships may depend on the same capacity cycle. The reporting warrants examination of that concentration, without turning it into a prediction of default.
Anthropic says METR evaluators have begun receiving employee-like access to assess model risks, with findings to be published. SecureBio and Accenture are also involved in evaluation work. Deeper access should give evaluators more to examine than a public benchmark can provide. The credibility of the arrangement will also depend on funding, publication rights, restrictions and what happens when evaluators identify a serious problem. Access is valuable. The terms attached to it deserve equal attention.
Reuters reports that Deputy Governor Sarah Breeden is pushing banks to consider recovery from bare metal if AI-enabled attacks defeat normal controls. That means rebuilding critical systems from a clean foundation. The uncomfortable question is whether backups and recovery tools could share the dependencies or credentials already compromised. A recovery plan needs to establish where clean systems, configurations and authority will come from, then demonstrate that essential services can actually be restored.
The Financial Stability Board has finalised 12 sound practices covering AI governance and risks throughout the lifecycle. They address board responsibility, data, evaluation, human oversight, cyber risk and third-party dependencies. These are sound practices rather than binding law, but they offer a useful basis for examining existing controls. Boards can ask how each practice translates into accountable people, working processes and evidence. A policy document may explain the intention. The next question concerns what happens in production.
The renewed UK–Canada AI security partnership prioritises compatible standards, information sharing and technical cooperation, including possible coordinated evaluations. For businesses operating across borders, the useful prospect is more consistent evidence requirements. An assessment becomes more valuable when another jurisdiction can understand its scope, methods and limitations. Whether this cooperation reduces duplicated effort while maintaining evaluation quality will be the practical test. Another agreement is welcome. Making the resulting assurance usable will take further work.
US Treasury enforcement actions against Bank of America impose more than $1.21bn in penalties for anti-money-laundering and sanctions failures. The findings include delayed suspicious-activity reporting, deficient controls and a required independent review of the data governance supporting AML. Anyone modernising financial-crime systems with AI should read the operational detail. Better detection still needs reliable data, sufficient investigators and clear escalation. Generating another alert achieves little if the organisation cannot act on it.
AvePoint says its October updates extend agent discovery, ownership and access-review capabilities, alongside backup support for Microsoft Copilot Studio agents. Coverage and effectiveness remain matters for customers to validate. The broader question is what constitutes a recoverable agent: its prompts, knowledge sources, configuration, permissions and connected tools may sit in several places. Restoring part of that arrangement could leave the business with an agent that behaves differently from the one it thought it had backed up.
IonQ has agreed to acquire Elisity in an all-stock transaction worth up to $1.3bn, including a performance-based earnout. Completion remains subject to conditions. The proposed combination connects IonQ’s quantum-security ambitions with Elisity’s identity-based network controls. For buyers, it raises a useful architectural question about joining cryptographic migration with asset discovery and restricted connectivity. The companies’ integration plans will need scrutiny alongside the capabilities customers can buy and deploy today.
Reuters reports that eight US states have sued OpenAI, alleging ChatGPT harmed residents, including teenagers, through responses that reinforced delusions or assisted dangerous behaviour. These are allegations, with liability still to be determined. The cases bring attention to how safety representations compare with product behaviour and internal evidence. Organisations deploying conversational systems should be examining intended users, foreseeable misuse, escalation and the circumstances in which a feature would be changed or withdrawn.
HCLTech and Anthropic’s partnership combines Claude with planned delivery capabilities, secure sandboxes and software integrations. The companies describe guardrails and human oversight as part of the offer. Enterprise customers will need those commitments expressed in terms they can assess: approved actions, traceable activity, testing, recovery and clear responsibilities. Buying implementation expertise can help organisations deploy AI. It also makes the allocation of responsibility between the customer, integrator and model provider particularly important.
Meta describes Muse Wonder and Muse Code as models for extended agentic work, using features it calls Active Memory and Active Focus. Persistent context raises questions about what information is retained, who can inspect it and whether corrections or deletions reach every relevant system. At announcement, Meta said a fuller safety report would follow. Buyers should examine that evidence alongside the product description. An agent remembering something useful is convenient. An agent repeatedly acting on an old mistake is less so.
Workday’s proposed acquisition of C1.ai, alongside its expansion of Sana, connects agents performing business tasks with identities, permissions and approvals. The acquisition and product rollout remain subject to their respective timetables. The direction is significant for organisations already managing human and service-account access. Agents will also need accountable owners, defined roles and prompt removal of permissions when those roles change. Giving an agent access creates a continuing management obligation, however quickly it completes its first task.
Google is broadening access to Gemini 4 Argon after limited availability for selected cyber defenders. Its descriptions of vulnerability discovery include company and partner claims that need to be read within their stated scope. For enterprise security teams, capability assessment also involves deciding who receives access, which tools are connected and what targets are authorised. The deployment decision needs evidence about those boundaries, particularly where the same capabilities could support defensive research or misuse.
Parliament’s 13 October evidence session examined voluntary oversight, independent testing and the powers available to intervene in frontier AI releases. The committee highlighted a central distinction: evaluating a model when access is granted does not necessarily provide authority to compel disclosure or stop deployment. That leaves questions about when testing begins, what evaluators can inspect and how serious findings affect release decisions. The usefulness of an evaluation depends partly on what anybody can do with its conclusions.
Reuters reports growing supervisory scrutiny of banks’ AI use across the US, UK and euro area, including approval rights, authority limits, auditability and shutdown capabilities. This is evidence gathering rather than a shared new rulebook. The questions are nevertheless practical: can a bank reconstruct an agent’s actions, withdraw its permissions and maintain the underlying service? Explaining those arrangements is useful. Demonstrating them under realistic failure conditions will give supervisors considerably more to work with.
