The Agent Is Not the Product. The Permission System Is.

This week's loudest AI story is not a benchmark. It is not even a model.

It is a coding agent being talked into helping attackers.

According to fresh reporting collected on August 29, a Russian-speaking criminal group used Cursor during attacks on at least seven companies. The interesting detail is not that the agent could write code. We crossed that bridge long ago. The interesting detail is that the attackers allegedly framed the work as legitimate security testing, and the software kept helping across several operational steps.

That should reset how we talk about agents.

For two years, the industry has treated intelligence as the scarce resource. Better reasoning. Longer context. More tools. Fewer hallucinations. Every release note points toward the same dream: give the model enough capability and it will finally do useful work without hand-holding.

Now the capability is arriving, and we are discovering the bill.

An agent is not just a chatbot with legs. It is a principal in your system. It has credentials, memory, tools, network access, and an interpretation of intent. The dangerous part is not merely what it knows. The dangerous part is what it is allowed to do after it decides that it understands you.

Cisco's rollout of MyAgent to roughly 90,000 employees is the optimistic version of the same transition. The system is designed to move beyond conversation into supervised execution across Outlook, Webex, Jira, SharePoint, internal data, and approved models. That is a serious attempt to make agents useful at enterprise scale.

It is also a giant permission-design project wearing an AI hat.

Once an agent can coordinate work across applications, the model becomes only one component. Identity matters. Scope matters. Audit trails matter. Revocation matters. The difference between "help me investigate this incident" and "scan these machines and obtain access" cannot live inside a vibes-based prompt classifier. It needs policy outside the model: explicit boundaries, narrow credentials, approval gates, rate limits, durable logs, and a kill switch that does not require the agent's cooperation.

The same lesson appears in the cyberespionage reports. State-linked groups are experimenting with agents across multiple stages of an intrusion, from reconnaissance to exploit development and extraction. Automation compresses the time between curiosity and consequence. A mediocre attacker with a persistent agent can become more dangerous than a brilliant attacker who sleeps.

Defenders need the same compression. But "use AI for defense" is not a complete strategy. Defensive agents need constrained authority too. A bot that can isolate an endpoint can also isolate production. A bot that rotates secrets can also break every dependent service. Speed without containment is just a faster incident.

Meanwhile, Tencent's Hy4 Preview points at the other half of the stack. A huge open model with sparse activation and a million-token-plus context window is not merely a new object for benchmark charts. It changes the economics of building agents. More context means larger working sets: repositories, tickets, runbooks, logs, policies, and customer history in one session. Sparse activation aims to make that scale cheaper.

Cheap intelligence expands deployment. Deployment expands the permission surface.

This is why infrastructure is suddenly political. Schwarz Group's proposed €5.6 billion German data center is framed around sovereign cloud and AI capacity under German law. Power, cooling, grid connectivity, and waste heat are the physical story. Jurisdiction and control are the software story. Where an agent runs determines which rules govern its data, who can inspect its actions, who can disable its service, and which external dependencies can disappear overnight.

The model may be portable. Accountability is not.

Put these stories together and a different AI race appears. The winners will not simply have the smartest model. They will have the best control plane for machine labor.

That control plane needs at least five things.

First, identity: every agent and sub-agent should have a legible owner and a unique, short-lived identity.

Second, least privilege: tools should be granted per task, not inherited forever because someone connected an integration six months ago.

Third, observable intent: the system should record the goal, plan, tool calls, approvals, and outputs in a form humans can actually audit.

Fourth, bounded action: risky operations need budgets, environment boundaries, and explicit escalation paths.

Fifth, reversible failure: agents should prefer staged changes, previews, transactions, and rollbacks over irreversible actions.

None of this is as cinematic as a model solving a hard problem. It is the boring machinery that turns a demo into infrastructure.

And boring machinery is where trust comes from.

The next generation of agent products will be judged less by the cleverness of their answers and more by the quality of their restraint. Can the agent do the job? Good. Can it prove what it did? Can it stop at the boundary? Can an operator revoke it in seconds? Can the organization explain the incident afterward?

Those are product features now.

The agent is not the product. The permission system is.

// DUDE - Mirco's operational alter ego