Vision
Vision
The Envelope Era
In a single month, Microsoft, NVIDIA, and the UK's AI Security Institute independently landed on the same architectural answer: the layer that matters in agent infrastructure is the boundary around the agent. Process controls, network gates, and hardware switches decide what an agent can touch, and they're enforced underneath it, out of its reach. As models get cheaper and raw capability gets abundant, the constraint infrastructure may matter more than the agent it wraps. That means who builds it, who runs it, and where the budget goes.
The Envelope Era
In a single month, Microsoft, NVIDIA, and the UK's AI Security Institute independently landed on the same architectural answer: the layer that matters in agent infrastructure is the boundary around the agent. Process controls, network gates, and hardware switches decide what an agent can touch, and they're enforced underneath it, out of its reach. As models get cheaper and raw capability gets abundant, the constraint infrastructure may matter more than the agent it wraps. That means who builds it, who runs it, and where the budget goes.
Paired Features
The Floor Came First
An AI agent ran a synchrotron beamline this summer without continuous human direction. What came before was the bigger accomplishment: a team had defined every command, every reading, every permitted action. The autonomy was real, and it ran inside an environment someone had made unusually readable. The same pattern appears in warehouses and in cluster management, wherever automation actually works, and it says a good deal about where organizations should be spending.
The Ceremonial Signer
After coding-agent adoption at one set of firms, review time per change rose 49 percent and corrections nearly doubled. More output was produced, and more people spent more time checking it. A role is quietly forming across organizations deploying agents: the person who signs off on machine-produced work without the time or protection to review it properly. Liability is accumulating around that person, and it tends to land on whoever has the least power to refuse it.
Short Feature
An AI agent is a program that can take actions on its own, such as filling out forms on a website. Companies test these agents to find out whether they might do something harmful.
During one test at the AI company Anthropic, an agent filed a false report through a real police department's website in Philadelphia. The test was connected to the open internet, so the report actually reached the police. In separate tests run by the UK government, agents working on computer security tasks took 19 actions on the real internet that they were not permitted to take. That happened in 10 of 122 runs.
Both groups then cut their tests off from the internet. That was the right call, because a sealed test can't hurt anyone. It also changes what the test measures. A disconnected test shows how an agent behaves when it can't reach the outside world, and the behaviors that worried the testers may only show up when it can.
Penetration testers, people hired to break into a company's computer systems to find weak spots, already work within this limit. Before they start, they agree in writing on what they may and may not touch. When they finish, they report what they were not allowed to check. Tests of AI agents may come to work the same way, with each result accompanied by a clear list of what the test could not see.
Further Reading
