Agent Deployment Has Outrun Its Controls

The pattern across today’s signal is not subtle. Agents are in production. The controls layer is not. A GitHub agent leaks private repositories when asked politely, a cloud worm is chewing through Docker and Kubernetes clusters, and 78% of enterprises now report AI-related security incidents. Meanwhile, the teams that got agents to production are discovering the real failure mode is not the model but the organizational data feeding it, and the review infrastructure meant to catch mistakes is collapsing under AI-generated volume.

Underneath the operational story, the vendor stack for agent infrastructure is quietly consolidating. Identity, observability, and data access are being resolved by acquisition and standardization while most buyers are still evaluating models. The cost story is moving in parallel: Coinbase cut its AI bill in half by treating model selection as infrastructure rather than vendor loyalty. Read together, today is a briefing on where the next 18 months of enterprise AI spend, risk, and lock-in will actually be decided.

Agents shipped, guardrails did not

Start with the concrete failures. The Register reports that GitHub’s Copilot coding agent leaks private repository contents through a prompt injection embedded in an issue, exfiltrating data by encoding it into image URLs the agent renders. A self-propagating cloud worm is now hunting Docker, Kubernetes, and Redis endpoints, evicting rival malware and stealing credentials as it moves. A separate campaign uses fake IT staff on Microsoft Teams to talk employees into installing a remote access trojan. Three vectors, one week.

The base rate is worse than the incidents suggest. 78% of enterprises surveyed have already encountered AI-related security incidents, and the Financial Times reports that top banking supervisors have issued a formal warning on AI-driven cyber attacks against financial infrastructure. This is no longer a forecast. It is a running loss.

The decision for anyone with agents in production: assume prompt injection is exploitable in your stack until you have proved otherwise, and treat every agent with repo, ticket, email, or file access as a privileged identity subject to the same review as a human insider. The organizations that will look competent 18 months from now are the ones inventorying agent scopes this quarter, not the ones adding more agents to the roadmap.

Multi-model routing is now table stakes

Coinbase runs 1,200 agents in production and cut its AI spend by half while token consumption climbed. The mechanism is not clever prompting. It is treating model selection as a routing decision at the infrastructure layer, with open-weight models handling the bulk of workloads and frontier models reserved for the tasks that actually justify the price. On coding benchmarks, the open-weight defaults now outperform the frontier commercial tier at a fraction of the unit cost.

The strategic read matters more than the tactical one. TechCrunch’s analysis of why Anthropic is not yet hurting from open-source pressure is honest about the qualifier: yet. Frontier providers still win on the hardest tasks, but the workload mix that requires the hardest tier is shrinking as smaller models catch up. Anthropic’s response, extending Claude Cowork to keep running after users close their laptops, is a bet on stickiness through workflow depth rather than raw capability advantage.

If your organization is still on a single-provider commitment with no routing layer, you are paying a premium that Coinbase has publicly demonstrated is optional. The build cost of a routing layer is now dwarfed by the run-rate savings, and this connects directly to the vendor consolidation thread below: the routing decision is the first place lock-in either compounds or gets broken.

The failure layer is data, not the model

Two architectural analyses today converge on the same diagnosis. The New Stack calls it the organizational iceberg: agents inherit broken reasoning because the data they retrieve captures outcomes but not the decision context, exception rationale, or intent that produced them. MIT Technology Review’s piece on foundational AI architecture reaches the same conclusion from the infrastructure side. The Register’s argument that data must move out of silos and lakehouses to be operationally useful sharpens the point.

The symptom is showing up downstream. Code review is breaking under AI-generated volume, with 31% of pull requests merging unreviewed and incidents per PR up 243%. The same organizations that ship agents faster than they can govern them are also shipping code faster than they can review it. The root cause is identical: AI output has outpaced the instrumentation designed to check it.

The decision here is not whether to fix the data layer. It is whether to fix it before the next agent generation exposes the gap. Organizations that continue to treat data quality as a downstream data-team problem will find that their agent programs plateau on capability that model upgrades cannot rescue. This connects to the security thread: broken data context is also where prompt injection becomes hardest to detect, because there is no ground truth to reconcile against.

The agent stack is consolidating quietly

Vercel acquired Better Auth to solve identity for agents, folding authentication into the same platform where agents get deployed. OpenTelemetry has crossed 95% adoption as the de facto observability standard for agentic workloads, with AWS demonstrating public troubleshooting workflows on top of it. The data access debate between lakehouse-first and operational-core-first architectures is being resolved by the same vendors that will sell the answer.

These are not three independent procurement decisions. They are three layers of the same stack: identity, observability, data. Lock in the wrong vendor at any layer and switching costs compound at every layer above it. The window when these choices are still reversible is closing as the platforms integrate.

For buyers, the practical read is to insist on open standards at each layer, particularly OpenTelemetry for observability and standards-based identity that does not require rewriting authorization when the platform changes. The teams that will regret their 2026 decisions in 2028 are the ones treating agent infrastructure as a series of point purchases rather than a stack with compounding switching costs. This is the mirror image of the multi-model thread: cost control at the model layer is easily wiped out by lock-in at the identity or observability layer.

UK creates a datacenter arbitrage window

The UK government has gutted planning red tape for datacenters, removing the neighbor-consultation friction that has slowed hyperscale builds. For anyone with UK infrastructure plans or expansion optionality, the 18-month window that follows a planning reform of this scale is where the compounding advantage sits. Sites that would have taken three years to approve now clear in months.

The other side of the same government’s calculation is less friendly. MPs are pressing the government to establish a technology sovereignty position or accept being locked out of critical supply chains. Procurement and compliance mandates on AI supply chain sovereignty are the predictable next move, on a similar timeline to the planning window.

Organizations with UK exposure now face a two-sided decision. Exploit the build acceleration now, and simultaneously prepare vendor selection criteria that will survive a sovereign technology mandate written within the same 18 months. Doing one without the other means building fast on infrastructure you may later be required to replace.

Energy assumptions just got more brittle

The US has revoked Iran oil waivers following attacks in the Strait of Hormuz, with the policy operating on a 24-hour performance cycle that keeps commodity pricing perpetually one news event from repricing. For any operation with Middle East supply exposure, standing assumptions on energy costs are now the least reliable line in the model.

The European side of the energy equation is also in motion. Politico reports that US LNG producers are lobbying the Trump administration to pressure Europe into weakening methane import rules, and more than half of EU member states have already signaled flexibility. The outcome determines whether European energy input costs are structurally lower or higher by Q1 2027, which flows directly into datacenter operating economics discussed in the UK thread.

The practical move is to stop treating energy cost curves as an exogenous input and start scenario-planning explicitly against the regulatory fight. AI infrastructure that pencils at one methane compliance regime does not necessarily pencil at the other.

Memory pricing sits at an inflection

Samsung’s profits jumped 19x year-on-year, and the reason is memory, not clever product launches. Record AI-driven demand has pushed DRAM and HBM average selling prices to levels that are simultaneously rewarding suppliers and worrying equity analysts, who are already pricing oversupply risk into Samsung and SK Hynix share prices.

The downstream effect is concrete. DRAM pricing has made sub-$400 smartphones economically unviable, with another 50% memory price increase forecast. For AI infrastructure buyers, this cuts two ways: procurement locked in at current prices risks overpaying if oversupply arrives, while procurement deferred risks paying more if it does not.

The decision is not to guess the curve but to structure procurement with optionality. Multi-year memory commitments at current pricing require a hedging argument, and roadmaps that assume smooth memory cost declines need to be stress-tested against a scenario where both directions are possible over the next 12 to 18 months.

Microsoft’s licensing moat just cracked

A UK Court of Appeal has dismissed Microsoft’s appeal in the pre-owned software licensing case, opening a secondary market for resold Office and enterprise licenses and exposing Microsoft to potential billion-pound collective action liability. Separately, Microsoft is flipping Windows Backup to on by default everywhere except the EU, a small but telling reminder that jurisdictional divergence in enforcement now shapes product behavior directly.

For procurement teams, the ruling is leverage. Even if a resale market takes 12 months to mature, the mere existence of a legal secondary channel changes the negotiating posture on renewals. If the precedent propagates to other common-law jurisdictions, the effective per-seat cost of Microsoft’s enterprise stack moves down for anyone willing to do the audit work.

The move is to instruct legal and procurement to model the ruling into the next enterprise agreement cycle rather than the one after. Sellers price against the leverage buyers actually use.

Nvidia’s monopoly is being tested on two fronts

IBM has completed the z17 family with rack-mount AI-accelerated mainframes, pitching mainframe-adjacent AI inference for organizations with heavy OLTP footprints that do not want to shuttle data to a separate GPU cluster. South Korean chip startup FuriosaAI is entering European datacenters with Nvidia-alternative silicon aimed at inference workloads.

Neither is a frontier training threat to Nvidia. Both are credible enough to be worth benchmarking for specific workload shapes, and both are arriving as European sovereignty pressure (see the UK thread) makes non-US compute options politically attractive.

The practical action is small and immediate: add both to the next inference procurement evaluation, even if only to establish baseline pricing leverage against incumbent options. Evaluation work started this quarter costs little; evaluation work started after a procurement cycle closes is worthless.

Fusion is now a capex signal, not an energy story

Google and XTX have led a €400 million round in Proxima Fusion at a €2.4 billion valuation. Fusion timelines have not changed. What has changed is that frontier-technology investors are now willing to price a bet that current power procurement strategies will be insufficient for scaled AI operations in the five-to-ten-year window.

This is not an investment recommendation on fusion. It is a signal about how the smartest capital is stress-testing the energy assumptions that sit under AI capex plans. Read alongside the Iran waiver and EU methane threads, the message is consistent: the energy inputs to AI infrastructure are being treated as a strategic risk category, not a utility line item.

The decision for AI infrastructure planners is to run a genuine five-to-ten-year energy scenario against the current procurement baseline. If the answer is that power supply is comfortably sufficient at scale, the model is probably wrong.

The next 90 days will make it clear which enterprises treated 2026 as the year to fix the agent stack and which treated it as another year to expand it. Watch for the first material breach attributable to an agent identity failure, the first meaningful UK datacenter approval accelerated under the new planning regime, and the first major enterprise to publicly disclose a multi-model routing architecture with hard cost savings. Any one of those events forces board-level attention. All three arriving inside a quarter would reset the default posture for enterprise AI procurement.