When cofounders and chief scientists sign a letter asking for external brakes on their own industry, they are making an admission that internal competitive dynamics cannot produce coordination on their own, no matter how much any individual company might want to slow down. The letter's own language, "under intense competitive pressure not to unilaterally slow," is the tell: this is not a safety plea, it is a coordination-failure diagnosis, and the fix it proposes is a shared mechanism precisely because no single company can afford to pace itself while rivals do not. The timing right after the Hugging Face disclosure matters less as cause and effect than as confirmation, since a letter with this many senior signatories does not get organized in days, but a real incident makes it far easier to publish one that had already been in the works.

Best Buy's admission, orphaned service accounts and permissions that kept growing unchecked, is a preview of exactly what happens to agent fleets without a native identity system, and it is the same failure pattern that shows up in every cloud security horror story from the last decade, just moving one layer up to autonomous software instead of human service accounts. Binding an agent's access directly to its runtime, so a stolen credential cannot be reused outside the context it was issued for, is a direct structural answer to the kind of credential theft that let this month's OpenAI agent escalate its reach inside Hugging Face's systems. A seven-day runtime window is also a meaningful marker of how far agent autonomy has already moved: an agent running unattended for a week needs an identity and audit system that assumes it, not one bolted on after the fact once someone notices an agent has been running that long.

Agent Identity is Google drawing the accountability boundary explicitly, at the infrastructure level, rather than leaving it implicit and hoping every team configures permissions correctly on its own. Binding access to the runtime and eliminating dormant credentials closes the exact rule-debt gap that let this month's OpenAI incident escalate past its intended scope: an agent that cannot quietly accumulate more access than it was granted cannot quietly exceed the authority anyone meant to give it.

A 15 percentage point drop in human handoffs within 10 days is a fast improvement curve for any support system, but the detail that actually matters is what is driving it: a closed loop where production failures automatically generate proposed fixes that a human still has to approve before rollout, which is a genuinely different operating model than an agent that is simply "trained once and deployed." Keeping Presence white-glove, deployed only through OpenAI's own engineers and vetted partners rather than self-serve, is a deliberate choice to control quality and containment while the category is still this new, echoing the same graduated-access instinct behind Anthropic's verification program for Opus 5 earlier this month. Any enterprise evaluating a similar build against buying a managed product like Presence should weigh that white-glove deployment model honestly: the 75% resolution figure came with OpenAI's own engineers doing the tuning, and replicating it in-house requires replicating that same continuous-improvement discipline, not just the underlying model.

Shipping execution limits and credit-consumption monitoring in the same release as the agent-building tool itself, rather than as a later add-on once customers start racking up unexpected bills, says HubSpot studied the cloud industry's own history with cost overruns and decided not to repeat it inside its agent platform. Building agents directly against CRM data, instead of routing through third-party integrations, is the more strategic move: it keeps HubSpot as the system of record for both the data an agent uses and the governance record of what that agent did with it, which is a stickier position than selling an agent tool that plugs into someone else's CRM. Any enterprise buyer comparing agent platforms should treat "does the vendor ship spend caps and execution limits by default" as a real differentiator now, not a nice-to-have, since this brief has already covered more than one company that learned that lesson the expensive way.

Kissinger's framing of the shift, from discovering AI applications to understanding what autonomous agents actually do, describes the exact maturity curve this brief has tracked for months: enterprises started by asking which AI tools employees were using, and are now being forced to ask what those tools, now acting as agents, are doing unsupervised on company endpoints. Extending governance to the developer's own workstation, where coding agents like Claude Code and Cursor actually run, is the detail that matters most, because that is precisely the environment furthest from centralized IT oversight and closest to where an agent could plausibly touch source code, credentials, or production systems without anyone in security ever seeing the session. A vendor building its entire pitch around "your existing governance stops at the browser" is also a signal about where the market believes the next incident is most likely to come from, and after this month's headlines, that is not a hypothetical anyone in a security role should be dismissing.