Security Agents Get the Power to Act

Security Agents That Can Act

The same system that spots a vulnerability could soon rank it, test it and propose the fix at machine speed. That’s useful right up until a bad remediation becomes an outage.

That tension is why Microsoft’s Project Perception is worth spending time on. Announced on 27 July, it coordinates red-team, blue-team and remediation agents across Microsoft’s security products, with a worldwide public preview scheduled for 3 August.

Microsoft says the system continuously combines security signals with operational context, rather than simply generating another alert for an analyst to investigate. Its first vulnerability-management configuration pairs the MDASH agent harness with Microsoft’s MAI-Cyber-1-Flash model. The company reports a 96 per cent score on CyberGym and a cost almost 50 per cent below its current MDASH configuration. Those are Microsoft’s own evaluation results, though, and we don’t yet have independent evidence about real-world false positives or remediation safety.

Microsoft also says human operators retain control of consequential actions. That boundary will be crucial. Once a system can move from diagnosis into prioritisation and remediation, permissions, approval paths, audit logs and rollback controls become part of the core security design.

My read is that constrained deployments could shorten the time an attacker remains inside a system. But early users should favour narrow permissions and reversible actions, because an incorrect machine-speed response can create a machine-speed outage. Pricing, customer eligibility and the timeline for production availability remain unspecified.

Europe Resets the AI Clock

That’s the larger operational shift; now to a legal one with a much slower clock.

The European Union’s AI Omnibus entered into force on 27 July, changing several parts of the AI Act and postponing major high-risk-system requirements. Annex III systems now move to 2 December 2027, while AI governed through product-safety legislation moves to 2 August 2028.

The amended regulation also softens the wording around AI literacy. Providers and deployers must support staff literacy measures, but they aren’t required to guarantee a particular level for every person. Some proportionality measures expand from small and medium-sized enterprises to small mid-cap companies, and access to supervised regulatory sandboxes broadens.

This isn’t a blanket pause. Providers of synthetic-content systems already on the market before 2 August 2026 still face an Article 50 transparency deadline on 2 December 2026. Several guidelines, standards and delegated acts also remain unfinished, so the practical burden is still evolving.

For organisations operating in Europe, the extra preparation time is valuable. The risky interpretation would be to treat the Omnibus as a universal delay. Compliance teams need to remap each system and obligation against the amended text, because some deadlines moved substantially while others are still approaching this year.

Jobs Are Stretching Sideways

The rules are shifting on paper, but work itself is already changing in quieter ways.

OpenAI has published the first report in its Work at the Frontier series, analysing more than 800,000 messages from US ChatGPT users. It introduces “task crossover”: work associated with an occupation other than the user’s own.

OpenAI reports that 16.8 per cent of work-related messages crossed those occupational boundaries. Once generic tasks were removed, the share rose to 43.5 per cent of occupation-specific messages. Customer-experience workers, designers and human-resources workers showed the highest outside-occupation shares under that measure.

The pattern wasn’t confined to large workplaces. Among average users, outside-occupation work represented 18.9 per cent of messages in workspaces with two to five seats, compared with 16.3 per cent in workspaces with more than 100 seats.

There’s an important limit here: this study observes ChatGPT prompts, not completed work, quality, productivity, wages or job losses. It’s also company research based on US users and automated classification.

Even with those cautions, the near-term labour effect may be people quietly inheriting adjacent tasks rather than entire jobs disappearing. That can make teams more flexible, but it also makes review ownership harder to ignore—especially when someone crosses into specialised legal, financial, technical or marketing work without equivalent training.

An Open Defence Layer for Agents

If agents are going to take on more work, somebody has to secure the machinery around them.

NVIDIA and more than 30 inaugural partners have launched the Open Secure AI Alliance. The group plans to develop and share open technologies for securing software and AI agents, covering vulnerability remediation, identity, isolation, model formats, scanning and secure coding workflows.

The membership spans Microsoft, Cloudflare, CrowdStrike, HPE, IBM, Hugging Face, LangChain, Red Hat, Synopsys and the Linux Foundation, among others. NVIDIA’s first contribution is its Object-Oriented Agent research framework, intended to make agent behaviour easier to test, trace, audit and govern.

The useful idea is that security has to cover the entire agent stack. Model weights are only one boundary; tool permissions, identity, execution environments and software dependencies can all decide what an agent is able to do.

Still, the announcement doesn’t specify binding commitments, funding, governance or a delivery timetable. Coalition membership is not a security certification. Organisations should judge the artefacts individually: are they maintained, inspectable and backed by reproducible evaluations and credible disclosure processes? An open defensive stack could reduce dependence on a single provider, but only if the alliance produces durable engineering rather than a long list of logos.

Agent Controls Reach JetBrains

For developers, some of that governance is arriving much closer to the keyboard.

GitHub has updated Copilot for JetBrains so developers can connect MCP servers and custom agents inside Claude agent flows. MCP, or Model Context Protocol, is the interface agents use to reach external tools and data. The release also adds improved MCP diagnostics and lets teams export OpenTelemetry data from agent workflows.

Administrators gain controls over built-in model availability, while custom token limits are available for bring-your-own-key and custom model endpoints. In the related Copilot CLI update, sessions can be forked, tasks are shown in a visible list, and developers get a rubber-duck command for talking through reasoning.

The JetBrains features require the latest Copilot plugin. GitHub hasn’t published independent productivity or reliability measurements, and connecting an MCP server or custom agent doesn’t make it trustworthy by default.

What improves here is operational visibility. Teams can bring specialised tools into a familiar IDE while tracing what agent workflows do and constraining which models they use. The corresponding responsibility is to treat tool permissions and exported telemetry—including any prompt or context data it captures—as production security and privacy decisions, not harmless editor preferences.

Samsung’s Two-Hundred-Billion-Dollar Outline

At chip scale, the ambition gets very large very quickly.

Samsung Electronics and Broadcom signed a memorandum covering high-bandwidth memory for future Broadcom AI accelerators, Samsung foundry processes at two nanometres and below, and advanced 2.3D and 2.5D packaging.

The companies estimate that collaboration across memory and foundry could exceed 200 billion US dollars through 2030. That figure deserves careful handling. This is a memorandum of understanding, not a set of disclosed purchase orders or guaranteed revenue, and neither company announced product volumes, production milestones or customer delivery dates.

Strategically, the outline could give Broadcom a more integrated source of memory, logic fabrication and packaging, while giving Samsung a substantial opening in custom AI accelerators. The practical value is supply-chain diversification. For now, though, the headline number is an aspiration; binding orders, manufacturing yields and delivery milestones will tell us whether the industrial partnership matches the scale of the announcement.

Agents Enter Chip Verification

Designing those chips is also becoming a test bed for much longer-running agents.

Synopsys has introduced two autonomous workflows developed with Microsoft and made them available for requested evaluation through Microsoft Discovery. AMD says it’s evaluating their use for future products.

One workflow coordinates specialised agents for verification, root-cause analysis and debugging closure. The other automates implementation tuning and closure through Synopsys Fusion Compiler running on Azure. Synopsys reports early reductions of 25 to 40 per cent in debug-cycle time, although those figures are vendor-reported and no sample size was disclosed.

These are evaluation offerings, not generally available production services. Pricing, independent error rates and a broader release date remain unknown.

This domain is a serious test of agent reliability. Shorter debugging cycles could save chip teams significant time, but a plausible-looking design mistake can survive for months before becoming an extraordinarily expensive silicon failure. Agentic electronic-design automation may make exploration and verification faster; it should make independent sign-off more important, not less.

What Changes for You

One last development is genuinely usable now, although “downloadable” doesn’t mean easy to run.

Moonshot AI released the full weights for Kimi K3 on 27 July. It’s a native multimodal mixture-of-experts model with 2.8 trillion total parameters, 104 billion active parameters and a one-million-token context window. Builders can download the weights from Moonshot’s official Hugging Face account, use hosted Kimi products, or connect through an OpenAI- or Anthropic-compatible API.

That gives developers another frontier-scale model to inspect, fine-tune or deploy independently. It may also add pricing pressure and give organisations more control over where their model runs.

The limitations are substantial. Moonshot recommends a supernode with at least 64 accelerators, putting practical self-hosting beyond most individuals and small teams. Its custom licence also requires a separate agreement for commercial model-as-a-service operators whose group revenue exceeds 20 million US dollars over any consecutive 12 months. And Moonshot warns that mishandling preserved reasoning history can destabilise output, while the model may act too proactively without explicit constraints.

So the immediate choice for most builders is likely API access or specialised infrastructure, not a machine under the desk. Kimi K3 broadens access to model weights, but its hardware demands, harness requirements and non-standard commercial terms still need review before anyone calls it an inexpensive route to model independence.