AI agents go to work, and security has to keep up

Three of today's announcements point the same way: software is being handed work it used to only assist with, and the companies shipping it are asking what has to be true underneath for that to be safe. The agents arrive first and the guardrails arrive second, which is the usual order and the reason the second half of the day is worth reading closely.

What an AI agent actually is, now that they are being sold to businesses

Start with the word, because it is doing a lot of work. A chatbot answers a question and stops. An agent is given a goal and then takes steps toward it on its own: reading data, calling other tools, deciding what to do next. The difference matters when you are choosing software, because an agent can act in your systems rather than only describe what you might do.

That shift is why funding news is relevant to a buyer and not only to investors. Nous Research said it has reached a $1.5B valuation and launched AI agents aimed at business users, having raised fresh capital for the work [1]. The size of the round tells you how much of the market now expects agents, not assistants, to be the thing people pay for next.

The practical question for a business is narrower than the headline. Before you let software act, decide which decisions you are comfortable delegating and which you want to keep. That boundary is a management choice, not a technical one, and it is worth writing down. We have covered where the line usually sits in what AI should and should not do in your business.

When agents from different companies start talking to each other

Once agents exist inside one company, the next step is agents from different companies dealing with each other directly. Salesforce framed the day's most useful warning about this: the move from single models to interoperable multi-agent systems is being sold on productivity, but "it will allow autonomous AI to negotiate, trade, and collaborate across company lines" [2]. Read that slowly. It means software acting on your behalf may soon transact with software acting on someone else's behalf, with no person in the middle of each exchange.

That is where the title of their piece earns its keep: the move from autonomy to accountability. Autonomy is the ability to act without being asked each time. Accountability is being able to say, afterwards, who did what and why. The two are not the same feature, and a tool can have the first without the second. If you are evaluating anything described as agentic, ask how it records its own actions. A record you can read after the fact is the difference between delegating work and losing track of it, which is the whole argument in the audit trail nobody thinks about.

Why secret-handling is now a scaling problem, not a discipline problem

GitHub's contribution today is quieter and more concrete. A secret, in this context, is a credential your software uses to reach another system: an API key, a token, a password in a config file. The classic failure is that one of these ends up somewhere it should not, such as inside code that gets shared. The common explanation is carelessness. GitHub's point is that the explanation has changed: "Developers aren't becoming more careless; they're being outpaced" [3].

That reframing matters to a non-technical buyer because it tells you where to look. If more software is being produced faster, partly by the agents above, then the volume of credentials in motion grows with it, and manual vigilance cannot keep pace by definition. The defence has to be built into the tools rather than asked of the people. When you assess a system, the question is not whether your team is careful; it is whether the platform catches a leaked credential on its own. The same logic explains why connections between tools fail without anyone noticing, which we wrote about in why integrations break quietly.

The unglamorous half: basic security hygiene

Not every risk needs an agent to create it. Xero marked the start of Cybersecurity Awareness Month with a reminder aimed squarely at smaller operators: "October is Cybersecurity Awareness Month, and a good moment to check in on how you're protecting your business, your money and your customers' information" [4]. There is nothing novel in the advice, and that is the point. The failures that actually cost small businesses money are rarely exotic. They are reused passwords, a login that was never switched off when someone left, a payment detail changed on the strength of a convincing email.

The useful habit is to treat this as a scheduled review rather than a reaction. Once a quarter, list who can reach your money and your customer records, and confirm each of those people still should. Access that is easy to grant and easy to forget is the quiet risk, and the review is the only thing that surfaces it.

A longer view: redundancy as the engine, not the enemy

Underneath all of this sits an older worry about work itself, and Basecamp's co-founder took it on directly. The piece opens with the long arc: "In the 18th century, 90% of Americans worked in agriculture to feed themselves and the nation" [5], and today that figure is around one per cent. The argument is that making roles redundant has historically freed labour for new work rather than destroying it, and that the same pattern is the engine of progress rather than its casualty.

For a business owner choosing tools this week, the honest reading sits between fear and hype. Automation will remove some tasks you currently pay people to do. Whether that frees your team for higher-value work or simply removes capacity depends on what you redirect them towards, which is a decision you make, not one the software makes for you. We looked at how to draw that line in practice in when to hire and when to automate, and the thread running through today is that the deciding is still yours.

For the previous day's items, see the 6 October briefing.