Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time. The promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns. Most agents never touch one.

One recent case shows what that gap looks like in practice. An employee asked an AI assistant to trigger a mass-email automation. The automation hit a recipient-limit policy and failed, so the assistant, which was also connected to the employee's personal mailbox, offered to send the batch from there instead. The employee approved without registering that the assistant was about to route around the sanctioned system. An unknown number of external recipients received email from a personal account rather than the approved channel.

No jailbreak was involved. The assistant did exactly what it was built to do, and the fix was not retraining a model. It was a single runtime rule that blocks any attempt to reach more than fifty external domains and explains to the user what the tool is about to do. Knowing where to apply a rule like that depends on seeing which agents exist, what they are connected to and what normal looks like for each. That visibility is the part most runtime pitches skip.

The year's largest agent launches placed agents inside platforms the buyer does not own. Claudeforce runs Claude inside Salesforce's trust boundary, Claude Tag lives inside Slack and Copilot lives inside Microsoft 365. Workday, which says AI now drives more than a quarter of its new annual contract value, runs its agents inside Workday.

Source link