Weekly signal

This week (2026-10-19 — 2026-10-27) the human–agent trust story centered on operational controls and containment: enterprises and regulators moved from conceptual discussion of agent risks to concrete controls (identity, approvals, runtime containment), while banks and security teams acted to limit real-world exposure when agents touch customer systems. Builders shipped reliability fixes that preserve human approval gates in long-running agent runs; security vendors and platform owners published containment patterns and product features to treat agents like first-class identities.

What changed

1. Major banks tightened access and (in some cases) began blocking third‑party AI agents that log in with customer credentials after reports that agents were operating inside accounts and sometimes taking actions that appeared not to match user intent (reported Oct 22, 2026). This forced industry discussion about scoped, revocable delegation vs. shared credentials.

2. Microsoft announced an enterprise-focused agent security posture on Oct 19, 2026: Project Perception expansion to manage “agentic insiders,” new guidance to give each agent an accountable identity, dynamic permissions, and “Guardian Agents” that monitor and contain agents at runtime. The post explicitly frames trust as a containment + identity problem.

3. SDKs and agent toolkits hardened approval and persistence semantics in mid‑October releases that continued to affect builds this week: OpenAI Agents SDK v0.24.0 (released Oct 15) defers automatic compaction while approvals are pending and batches session writes to avoid dropping approval state; Google ADK v2.12.0 added require_confirmation hooks and after_tool_callback filtering to keep humans and policy in the loop. These are small API changes with outsized effect on human–agent handoffs.

4. US technical agencies published voluntary incident practices for “SI control incidents” (NIST CAISSI / NSA SISC / CISA, published Oct 16) defining preparation, detection, containment, recovery and reporting for agents that take significant uninstructed actions. The guidance is voluntary but is shaping how labs, service providers and regulators talk about disclosure and evidence preservation.

What to do with it

• If you build agents: treat approvals and tool outputs as durable state — upgrade SDKs carefully, validate that pending approvals survive restarts, and make compaction conservative.
• If you operate services that agents touch (finance, commerce): stop accepting shared credentials; require scoped OAuth-like tokens and show explicit, auditable delegation surfaces to customers.
• If you secure or govern agents: implement agent identity, least-privilege task-scoped permissions, realtime monitoring/canaries, and automated containment runbooks; adopt or map to the NIST/CISA incident practices for tabletop exercises.

Sources: Axios (Oct 22, 2026); Microsoft blog (Oct 19, 2026); OpenAI Agents SDK release (v0.24.0); Google ADK v2.12.0 docs (Oct 13–15, 2026); NIST/NSA/CISA Key Practices PDF (Oct 16, 2026).