This week the whole industry converged on a single story: agents are the new workforce. Microsoft's Satya Nadella vision of "20 million AI agents for 200,000 employees" is, per this week's coverage, "becoming a reality." OpenAI shipped ChatGPT Wallet so agents can pay for things on your behalf. Google rolled out Antigravity multi-agent swarms. Anthropic put Claude Meetings live inside your calls.
The pitch is consistent and seductive: grant the machines autonomy, and the humans you no longer need get "redeployed to higher-value work."
Here is the line the keynote skipped. This same week, the autonomy we already shipped produced a very specific, very expensive class of failure — and almost none of it was caught by the agents. It was caught by humans doing incident response, usually after the data was already public.
Three receipts from one week
1. The apps that shipped without auth
German security firm Crissy Field, working with Handelsblatt, examined 159,041 Lovable projects. They found 24,664 sites with Supabase databases readable without authentication — including 200,000+ private chat messages, 80,000+ user profiles, and over 1,000 passport records. The agent generated the app. Nobody generated the access control. This is the defining failure mode of "just ship it": the scaffolding is free, and so is the liability.
2. The agent toolchain is now an attack surface
Cursor disclosed that attackers used an access key stolen from Fireworks AI to publish two trojanized copies of Anthropic's Claude Code extension on Cursor's own marketplace. They stayed live for about 11 hours and may have reached up to 5,000 developers. The moment your "agentic coding" workflow becomes the load-bearing part of your pipeline, it becomes a target worth compromising.
3. Autonomy at internet scale is unguarded by default
A researcher found roughly 35,000 Grok Build apps wide open to anyone. Cloudflare reported that traffic from AI penetration-testing and exploitation tools is up more than 30x since October 1, with 12,000+ repos descended from the open-source ARTEX agentic pen-testing system. The offensive tooling is agentic too — and it moves faster than the defensive tooling does.
The part nobody wants to budget for
Agents don't eliminate labor. They relocate it. Every unit of autonomy you grant is a unit of liability you accept, and somebody has to hold the pager for it. The "20 million agents for 200,000 employees" org chart has a hidden line item: the humans who babysit, audit, and clean up after the agents.
You didn't reduce headcount. You changed the job description from "does the work" to "owns the blast radius."
And blast radius doesn't show up on a productivity slide. It shows up as a 2am page, a regulator's letter, or a headline about 200,000 leaked chats.
The questions the demos never answer
- If your agent writes the code, who signs off that the database isn't public?- If your agent can pay, who owns the fraud?- If your agent is a live participant in the meeting, who is accountable for what it says and what it drafts?- If your agent acts while you sleep, what is the worst thing it can do before a human notices?If the answer is "the agent" — that's not an answer. An agent cannot be accountable. Only people can. ## Autonomy is a dial, not a switch The honest counterargument: it's early, the tooling will improve, and a lot of this is vibe-coding-specific. Fair. But the trajectory is the point — we shipped autonomy faster than we shipped accountability. So treat autonomy as a dial you turn deliberately, action by action. For every capability you hand an agent, map three things:
- Reversibility — can you undo it cheaply, or is it a one-way door?- Blast radius — if it's wrong, how many people, records, or dollars does it touch?- Accountability — a named human who owns the outcome, not a team, not a model.Grant autonomy in proportion to how cheaply you can reverse the damage. Everything else is a demo, not a deployment. ## The uncomfortable conclusion This is boring, unglamorous, non-keynote work. It is also the actual bottleneck of the agent era. The companies that win won't be the ones that deployed the most agents — they'll be the ones that can prove, on demand, what every one of their agents can and cannot do, and who is on the hook when it does the wrong thing. Autonomy is cheap now. Accountability is the scarce resource. Price your roadmap accordingly.
Top comments (0)