AI agents are leaking data as trust and speed race ahead

The gap between what AI agents can technically do and what enterprises trust them to do just got a lot more interesting, and today's news shows both sides of that widening chasm. One camp is racing to figure out how to grant agents more independence without blowing everything up. The other is discovering, sometimes the hard way, why that caution might be justified.

Take the trust problem first. A new proposal making the rounds suggests businesses should hand agents autonomy incrementally rather than flipping a switch from "supervised" to "fully independent." It sounds almost too obvious to need saying, but it's a useful corrective to the current market, where vendors love to pitch agents as drop-in replacements for entire workflows on day one. AccuKnox's new AgentZ platform is essentially built around this same instinct — enterprise-scale governance and oversight for agentic deployments, rather than a free-for-all. And SandboxAQ open-sourcing Switch, a connector that lets any AI agent plug into any team chat tool, points at the same underlying reality: the industry has quietly accepted that agents need infrastructure — plumbing, guardrails, audit trails — before they need more capability. Nobody is racing to give agents free rein anymore. They're racing to build the scaffolding that makes controlled autonomy possible.

Which makes the second story land harder than it otherwise would. New research this week found that popular AI agents are leaking private data — not through some exotic attack, but seemingly through the ordinary friction of agents doing what they're designed to do: pulling context from multiple sources, retaining information across sessions, executing actions with access they don't always need. This is the uncomfortable truth about agentic AI that gradual-autonomy frameworks are trying to address: the failure modes aren't hypothetical anymore, they're showing up in deployed systems people are already using. And it's why a parallel line of research into defenses against "unpredictable" agent behavior matters so much right now. Rule-based safeguards were built for software that behaves deterministically. Agents don't. You can't enumerate every bad action in advance when the whole point of the system is that it improvises. The new defensive approaches trying to catch anomalous behavior in real time, rather than pre-specifying every forbidden action, are effectively admitting that static rulebooks were always going to lose this race.

By the way, this tension is exactly what Dario Amodei was gesturing at when he warned recently that AI progress is accelerating faster than most people realize. It's easy to read that as marketing — Anthropic has obvious incentives to sound the alarm — but pair it with the leak findings and it reads differently. The uncomfortable version of "progress is accelerating" isn't that models are getting smarter faster than we expected. It's that deployment is outpacing the safety tooling needed to make deployment safe, and the gap between the two is what's actually accelerating.

Meanwhile, the commercial rollout continues regardless of any of this. Microsoft is putting Copilot in front of a million Filipino teachers and bundling it into e&'s UAE business packages, which tells you the enterprise world isn't waiting for agent security to mature before it ships. That's not necessarily reckless — most of this deployment is still assistive, not autonomous — but it does raise the obvious question: when the agentic version of these tools reaches that same scale, will the trust infrastructure actually be there, or will we be patching leaks after the fact?