AI Can Now Find Zero-Days. Your Patch Process Isn't Ready.

Identity and permissions alone are insufficient to secure enterprise AI agents, according to Box's CISO Heather Ceylan. Autonomous agents can exploit legitimate access to cause unintended damage at scale and speed that humans cannot match. Enterprise AI security must evolve beyond access controls to include execution governance, with dynamic permissions that scope access to specific tasks and steps rather than broad standing grants.

Autonomous AI agents operating in production environments require a three-layer security architecture spanning infrastructure, network, and control plane rather than relying on single-point controls like prompt guardrails. Oscar Wahlberg of Nutanix argues that traditional application-level security cannot contain risks unique to agentic systems, such as agents misusing granted credentials or hallucinating dangerous actions. The defense-in-depth approach divides security responsibilities across hardware trust, dynamic network governance, and centralized control to address distinct categories of risk.

The Pentagon has integrated versions of OpenAI's ChatGPT and SpaceX AI's Grok alongside Google's Gemini into a central portal for AI tools. This consolidation gives Department of Defense personnel access to multiple large language models through a single platform. The move reflects the Pentagon's effort to standardize and centralize AI capabilities across the military.

The Trump administration is developing a new export control rule targeting a significant loophole in chip restrictions: Chinese AI firms' ability to access advanced semiconductors remotely through data centers in Thailand, Singapore, and other countries. The Commerce Department's Bureau of Industry and Security is crafting this replacement to the Biden-era AI diffusion rule, which Trump's team had pledged to undo. The new rule could be shared with industry for feedback as early as September.