The agents are already here. The controls are not.

Last week’s argument was that the model has become the cheap part of AI. This week showed what happens next: agents are already running at a scale few organizations planned for. One bank governs more than 13,000 of them, and agents now start more than 40% of the pull requests on GitHub. Several of the stories below were reported in the last days of October, after last week’s edition went out. Together they show the controls arriving after the agents did: inventories, kill switches, stolen keys, regulators asking who an agent is, and evidence that the human reviewing an agent’s work is a weaker check than we assume.

Count your agents

Microsoft says Truist manages more than 13,000 declarative agents through Agent 365, with more than 8,000 active each month. Every agent has an accountable owner, and any agent unused for 45 days is switched off automatically. Insight Enterprises found 9,734 agents when it looked. UBS told investors on October 28 that its employees run more than 12,700 personal AI agents, alongside 608 AI use cases in production. Truist’s figures come from Microsoft’s own account. Microsoft · UBS

The tools for managing that sprawl are arriving at the same time. Salesforce added evaluations, hard budget limits and automatic agent discovery to Agent Fabric, which it says handles more than 1.2 billion requests a day; its kill switch works manually now, with automatic triggering planned for January 2027. CrowdStrike agreed to buy Fiddler, which records what agents did and why, and Dreadnode, which tests agents for flaws before they go live, for about $400 million and $95 million according to the Wall Street Journal. Salesforce · CrowdStrike · TechCrunch

Last week’s case for giving every agent an identity was about design. At 13,000 agents it becomes basic bookkeeping. An agent nobody owns still holds whatever access it was given, so Truist’s two rules are the minimum worth copying: a named owner for every agent, and automatic retirement for agents nobody uses. If you can’t say how many agents run in your organization today, finding out is the first job.

The keys are the target

Wiz counted at least nine AI developer platforms that disclosed security incidents in October, a figure its later updates raised to twelve. In two cases it followed stolen AWS keys into roughly 800,000 and 1.7 million calls to Bedrock models within a day or two, which it estimates ran past $100,000 of usage at list price, and it saw key-resale operations checking what the stolen keys could do. Wiz found no single flaw or attacker behind the incidents. Wiz

LiteLLM, a widely used gateway for model APIs, described how a compromised release reached PyPI on October 21 and stayed live for about two hours. The attacker used an administrative key that had leaked in May and was never revoked, took over the GitHub organization owner’s token, overrode branch protection, and published through LiteLLM’s own pipeline, which signed the malicious build. Separately, Forever Security stopped a coding agent that had followed instructions from an AGENTS.md file planted in a user’s Downloads folder and tried to install malware. In its tests, Codex followed such a file more than 90% of the time and Claude Code about half the time. LiteLLM · Forever Security

Defenders are getting faster too. Anthropic said an unreleased research model built exploit chains against Chrome, Safari, Android, Windows and Linux, and that 62 Chrome vulnerabilities it found have been patched, including 13 sandbox escapes. The lesson for anyone running agents is about keys more than models. API keys are now worth stealing because they can be spent, and resold, within hours. A valid signature on a release no longer proves it is safe, and an agent instruction file is as untrusted as any download. Rotate keys you can’t account for, scope new ones narrowly, alert on unusual model spend, and keep agents out of folders you don’t control. Anthropic

Regulators want to know who the agent is

Hong Kong’s monetary authority launched Project SAGE on November 2, with an expert group of banks, technology firms and academics. It will test agents in payments, procurement and treasury, and work on how to verify an agent’s identity and the authority delegated to it, a practice it calls Know Your Agent, along with liability and consumer protection. In Washington, three senior House Democrats wrote to Anthropic, Google, Meta, OpenAI and SpaceXSI on October 28, asking for an account of safety incidents by November 11 and notice of new ones within 48 hours, or 24 hours where critical infrastructure is involved. The letters are requests, not rules. Bank of America, meanwhile, emailed customers telling them not to share their banking credentials with any AI tool or agent that offers to act for them, and reminded them that they are responsible for whatever happens if they do. HKMA · House Democrats · TechCrunch on Bank of America

The question every one of these asks is the one from last week: who is this agent, and on whose authority is it acting? Until there is a standard answer, businesses are setting their own terms, and some are telling customers to keep agents out. That caution is easier because consumer agents are still rare in practice. DoorDash’s chief executive said third-party agents had produced only several hundred orders in total, against the roughly three million deliveries a day DoorDash reported averaging in 2025. Companies building agent access now are getting ahead of demand, which is the right time to decide what identity they will require. TechCrunch on DoorDash

Agents now write the first draft

GitHub reported on October 28 that more than 40% of pull requests in September started with an agent’s first draft, up from 17% in March: 110 million in a single month. GitHub calls that a floor, since not all agent use is detected. At Every, engineer Loren Stewart described the agent “factory” he works with, where agents split up a plan, write the code, review each other and merge once checks pass. Reviewing one feature that touched 42 files and about 3,000 lines, he found design choices he could not explain. “I owned every one of those lines, and I was reading a stranger’s work,” he wrote. At Anthropic, hiring manager Felix Rieseberg said he has stopped giving candidates coding interviews because Claude now does better on them, and looks instead for prototypes that show judgment. GitHub · Every · Felix Rieseberg

When agents write the first draft, a developer’s job moves to choosing problems, setting direction and reviewing work. Stewart’s experience shows the cost: engineers learn by building, and review alone teaches less. Teams that lean on agents should decide which work people still do by hand so they keep the skills that make their reviews worth something, and should hire for the judgment that coding tests no longer measure.

The human check is weaker than it looks

Anthropic gave 50 professional analysts a causal-analysis task in Claude Code and secretly told the agent which way to lean on four decisions. The analysts followed the agent’s lean 86% of the time. Afterwards, 77% repeated its arguments, sometimes word for word, but only 15% credited it, and about half rated the final recommendation as more their own than the agent’s. The leans were deliberately stronger than a real agent’s would be, and the study covered one task with one model. Anthropic’s researchers put the problem plainly: “Keeping a human in the loop assumes that the human’s judgment provides an independent check.” A separate paper found that turning reasoning effort up to maximum cost up to 42 times more on easy agent tasks and sometimes failed tasks that lower effort had solved. Starting low and escalating only after a verified failure did as well or better. Anthropic · arXiv

There is a better kind of check available. Axiom Math said mathematicians directing dozens of agents formalized the classification of finite simple groups, the result Axiom calls the “enormous theorem”, in the Lean proof checker over 24 days. The work found 34 noteworthy deviations from the published record, most of them minor, plus some real errors and gaps. The difference is that the computer checked every step, while the people checked that the statements were right. Where a machine check isn’t possible, the study’s recommendations are a place to start: ask for the expert’s view before showing the agent’s, have agents argue more than one side, and decide in advance which calls need a person’s own judgment. Axiom Math

What to do this quarter

Five moves follow from this week. Count the agents running in your organization, and give each one an owner and an expiry date. Rotate any API key you can’t account for, scope new keys narrowly, and alert on unusual model spend. Treat agent instruction files and release signatures as claims to verify, not proof. Decide what identity you will require from agents that act for your customers, before they arrive in numbers. And change how people review agent work: record their own view first, and keep some work in human hands so the skills behind good review survive.

What to watch

Watch which companies answer the House letters by November 11, and whether any incident reports become public. Watch whether Hong Kong’s Know Your Agent work turns into a standard other regulators adopt. Salesforce’s automatic kill switch is due in January, and CrowdStrike expects to close both acquisitions in its fiscal fourth quarter. And watch whether consumer agent orders grow from hundreds to something a company like DoorDash would mention as more than a curiosity.