AI agent security now has four layers of control and no clear owner

Nvidia launched its Open Agent Safety Platform on 28 September, pairing the OpenShell runtime with Sentry, a watchdog on BlueField-4 DPUs that quarantines an agent "in milliseconds" when it tries to leave its boundary, per the Nvidia Newsroom. A day later, Leidos launched UpHold Effect Agentic SOC Automation, which lets agencies decide "when AI recommends an action and when it is allowed to act," said Steve Hull, president of Leidos Digital. AI agent security is gaining layers of control. In our view, it does not yet have an owner.

On 1 September CrowdStrike unveiled Falcon Guardian for runtime detection and enforcement of AI agents on the endpoint. On 22 September Okta and 11 other founding members formed the Blueprint Alliance around agent identity, access control, runtime monitoring and containment. The Okta release cites Gartner: only 13% of organizations think they have the right AI agent governance in place.

On 24 September Zenity Labs showed a prompt injection in a Salesforce Web-to-Lead submission could make an Agentforce agent exfiltrate Accounts data through DNS lookups. "The injection didn't need to escalate privileges, the permissions were already there," Zenity wrote. Salesforce confirmed fixes for this chain on 18 August, Zenity's disclosure timeline shows, five weeks before Zenity published. Zenity found the vulnerable configuration is how Agentforce's default General CRM subagent ships. That is the seam as we see it: identity scopes the agent, the endpoint watches it, the hardware can stop it, and a SOC platform lets customers set how far its agents may act. The open question is who in the organization owns the policy that ties them together.

• Decide which layer owns agent policy before a vendor roadmap does.
• Inventory every agent and the permissions it ships with.
• Treat every external input an agent reads as untrusted.
• Log what each agent saw and did, and require a named human approver before any consequential action.

Our own assistant layer is in development. It is designed to draw its governance, audit trails and data-access controls from APEX — Platform Foundation, so policy for our own assistants sits in one place. Assistants are designed to work on governed data, with outputs attributable and reviewable. They are designed to surface, correlate and draft; a named human approves each consequential action.

September delivered the parts: runtimes, watchdogs, identity blueprints and SOC autonomy settings. In our view, no owner emerged. As with government AI adoption, the order of operations matters. Name who decides what an agent may do, then choose the layer that enforces it.