The Signal

At this year’s summits, both big lakehouse vendors led with governance instead of burying it. Databricks pitched its Unity AI Gateway as a control layer for the whole AI stack, treating MCP services as assets it can govern rather than models it merely hosts. Snowflake went at identity directly, giving each agent a cryptographic ID with role-based access and dynamic masking. The scale behind this is not a rounding error. Databricks says customers have built more than 100,000 agents on its platform, running through north of a quadrillion tokens a year.

Our read. The right place to enforce what an agent may touch is the data layer, because that is where the sensitive material actually sits. Consolidate agent access on your identity provider, put spend and access limits on every AI-facing surface, and make an agent’s reach something you granted on purpose instead of something it quietly inherited.

The pattern across the tooling this year is delegation. A developer hands an agent an entire ticket, a migration or a test suite or a refactor, and it works the problem in a loop on its own. Cloudflare leaned in with Kitesurf, a browser built for agents that runs far lighter than Chromium, and with x402 so those agents can pay their own way. The Register said the uncomfortable part out loud, noting that routine software development and IT services are squarely in the cross-hairs as this shifts from novelty to normal.

Our read. Whatever governs your human developers now has to govern the agents working next to them, and the internal platform is where that happens. Golden paths, signed builds, and automated checks stop being nice-to-haves. They become the only practical way to let agents commit code and spend money without a person checking each one by hand.

The four biggest hyperscalers now expect to spend somewhere around $725 billion on capital projects this year, most of it on AI data centers, up better than 70% from last year. Google alone raised its 2026 range to as much as $205 billion. The revenue is real, too. Google Cloud grew 82% last quarter and AWS grew 37%, its fastest in more than four years. And yet Alphabet’s stock slipped after the print, because investors have started asking the question the rest of us are asking: when does all this spending pay for itself.

Our read. That question lands on your desk as well. The cloud bill is now dominated by AI usage that grows with every prompt, so the discipline is knowing which workloads earn their keep. Fund the ones tied to real institutional value and starve the science projects. FinOps is no longer a back-office chore. It is how you keep the AI program defensible when finance comes asking.

Cisco disclosed a flaw in its ASA and FTD firewalls, CVE-2026-20349, that lets an unauthenticated attacker reboot the device with a crafted request. It is being exploited in the wild, and CISA put it on the mandatory-patch list on August 11. Fortinet is having a similar year. The Gunra ransomware crew has been walking through authentication-bypass bugs in FortiGate gear to get its first foothold. None of this is new in kind. The edge appliance keeps being the door attackers try first.

Our read. Patch the firewalls this week, and put phishing-resistant MFA in front of every management interface while you are in there. Then have the bigger conversation. Every VPN concentrator you retire in favor of identity-based access is one less public door to defend, and the market has plainly decided that is the direction. This is one of the cleaner risk reductions on the table right now.

CISA, the FBI and the NSA put out a joint advisory on Gunra, a ransomware operation built from leaked Conti code that now runs as a rent-a-crew service with a tidy Tor negotiation portal. A week later CISA added four more actively exploited bugs to its catalog, across macOS, SharePoint, VMware vCenter and Windows, and gave federal agencies until today to fix a Microsoft flaw already being used in a North Korean campaign. The pattern is industrial: known bugs, fast exploitation, professional crews doing it for money.

Our read. The defense here is unglamorous and it works. Shrink the gap between a patch landing and you applying it, because that gap is where these crews live. Pair exposure management that tells you what is genuinely reachable with the AI-assisted detection moving into the SOC, and make out-of-band verification the rule for any change to payment details, since the social-engineering side keeps getting better at impersonating your executives.

Harvard Business Review has been pressing an argument that lands squarely on this issue’s front page. As HBR frames it, agent projects stall for a reason that has little to do with the model. They get managed like software when they should be managed like people. Treat an agent as a tool and you get a clever demo. Treat it as a co-worker and you give it what any new hire gets: a written job description, a defined scope, a human who supervises it, and an honest review of how it performed.

The survey HBR reported is sobering. Only 6% of companies say they fully trust an agent to run a core business process on its own, and yet 86% intend to spend more on agents over the next two years. That gap between what leaders trust and what they are buying is where the risk sits. HBR’s other point is just as practical: agents fail most often when the business around them is fragmented, because an agent cannot grasp context its own company never wrote down.

Our read. This is the operating manual for the agent economy we opened with. Before the next agent goes live, write its job description. Spell out what it can touch, what it may spend, who signs off on the exceptions, and how you will judge whether it earned its seat. An agent without a manager is not automation. It is an unsupervised employee holding your credentials.