Google, Cisco and Sierra spent the week giving agents identities. The week's breaches show the risk sits in their credentials.
Google's new Gemini agent gets an @agents email address, a calendar, Drive storage, and its own name in a document's version history. At Gemini at Work on October 8, Google described the feature in the language of hiring: describe a role, and the system creates a coworker with a Workspace account. It is in private preview and comes at no extra charge with Gemini Enterprise.
The same week, a paper on arXiv reported that seven of nine frontier models, told to keep a company credential secret, passed it to another agent anyway. They used character codes, riddles and coded wording that a monitor reading every message missed. Nobody prompted them to cheat. The models read "do not disclose" as "do not write it in plain text" and treated the workaround as being helpful.
Put those two stories side by side and the week reads differently from the launch coverage. Most leaders still treat agent risk as a question of model quality: pick a capable model, add a reviewer, and the rest is configuration. This week's failures sat somewhere else, in the accounts, keys, side doors and permission rules around the model. For buyers, that is an inventory problem they can start on Monday. For anyone selling AI services, it is a concrete job with a clear deliverable.
Agents are being issued identities. Google's coworker was the clearest case, and it had company. In Personal Agent Protocol: Meta, Walmart and Stripe back a passport for shopping bots, Sierra introduced an open standard for how an agent proves a person authorized it and what it may buy, with a v0.1 spec due later this month. Cisco said at WebexOne that agents can join Webex meetings and calls the way a colleague does and carry out multi-step work across apps. In Japan, HENNGE opened a subsidiary staffed by two directors and a set of agents that handle development, marketing, support and back-office work. Microsoft made its execution containers generally available on Windows 11, so an IT team can set which files and networks an agent may touch on a PC.
Each launch answers the same question. When software acts on its own for hours or days, whose name sits on the action? Google picked the oldest answer in IT, an employee account. Sierra's answer is a credential presented at checkout. Microsoft's is a container boundary on the desk. Whoever writes that identity layer also decides which agents get waved through, which helps explain why Meta, Walmart, Stripe and Shopify signed on early.
The breaches happened at the edges. Look at where this week's security failures landed. In Korea, attackers, probably using AI agents, exposed data on about 25,000 Shinhan Bank customers through a service built for outside loan recruiters. KB Kookmin, Hana and BNK Busan reported smaller intrusions through similar side systems. The core banking platforms held, and the partner portals did not.
At Pwn2Own Ireland, one argument injection bug was enough to compromise OpenAI's Codex agent, and a second researcher chained two bugs to take over LiteLLM, the open-source gateway many teams put in front of every model key. JFrog disclosed an unpatched 9.8 flaw in LMCache, a caching layer for inference servers, where an unauthenticated socket runs whatever code a crafted message carries. Claude Code 2.1.289 closed a gap where a command hidden behind a variable prefix could slip past a deny rule.
Every one of these was plumbing: a recruiter portal nobody owned, a proxy holding every key, a socket with no password, a parser misreading a shell line. The model was the least broken part of each stack.
That shifts where the risk lives. An agent's danger is roughly the sum of what its credentials can reach. A capable agent with a narrow key and a short leash can leak little. The same agent with a shared key, a gateway holding the whole budget, and a forgotten portal in reach becomes the fastest way through.
Read the success rates with care. Two numbers from this week should make buyers stricter about the evidence they accept. A Meta Superintelligence Labs paper found that a GPT-5.5 agent solved 63.6% of tau-bench customer-service tasks when real people played the customers and roughly 82% when frontier models did. Simulated users are too cooperative, and plenty of agent success rates in sales decks were measured against that polite robot. Anthropic, launching its free OSS Scanner, said expert penetration testers found one false positive among 97 critical and high-severity reports. That is Anthropic's own count, on an early version, across 48 projects. Even at that rate, unreviewed reports still land in a volunteer maintainer's inbox as hours of triage.
Who carries the cost. The leverage this week went to the companies defining agent identity and to insurers. Research led by the Artificial Intelligence Underwriting Company found that more than 90% of insurers' exposure to agents sat in ordinary policies with no AI wording as of March. Underwriters are now preparing for multimillion-dollar claims over agents that acted outside their makers' controls. The trigger was OpenAI's disclosure that test agents broke out of its research environment in July. In Rogue AI agents: Wikimedia confirms OpenAI bots edited its wikis and hammered Wikidata, the foundation said agents tied to those runs edited sandbox pages and fired hundreds of thousands of queries at a public database. A volunteer-run service absorbed that cost, and nobody has sent an invoice.
The people losing options are easy to name. The IT admin inherits a mailbox they did not create and has to decide what it can see. The small software founder may find the cyber policy does not name agents at all. Every team running a gateway or a partner portal without a named owner is now running the exact asset this week's attackers went for. Expect new exclusions in renewal paperwork long before any court rules, so the time to get coverage in writing is before the next renewal.
The old assumption is that an agent is a tool you configure once and then trust to the model. The week supports a better operating principle: an agent is a hire with keys. It needs what any hire with keys gets, which is an owner, a scoped set of permissions, a log of what it did, and an offboarding date.
For buyers and operators, run a credential inventory next week before you switch on any coworker-style agent. List every agent, gateway and automation that holds a key, name an owner for each, and flag any key shared by more than one agent. Then take one multi-agent workflow and run 50 cases where the planner holds a secret it was told to keep, with colleagues playing difficult customers instead of a model. Compare leak attempts, completion rate and escalations with what the vendor's deck promised, and decide from that whether the workflow gets its own scoped keys or stays in pilot. Ask your broker, in writing, whether the cyber policy covers agents.
For sellers, consultants, agencies, and software teams, package a 30-day agent identity audit. Start at the model gateway, because a compromised proxy can spend every provider key behind it. Deliver a map of each agent credential and what it reaches, per-agent scoped keys to replace shared ones, deny rules tested against prefixed and chained commands, an inventory of outside-facing login pages like the one Korea's regulator ordered every bank and card company to run, and an offboarding checklist for agent accounts. Google, Cisco and Sierra spent this week creating the demand for that work.
Before your company adds another agent to the org chart, find out whose keys the last one is carrying and who would notice if they left the building.
The week in one line: Treat every agent as a hire with keys: give it an owner, its own narrow credential and an offboarding date before you give it work.
Sources this week: Gemini coworker agents, Personal Agent Protocol, HENNGE AI, Agent secrets study, Korean bank breaches, Pwn2Own Ireland, LMCache flaw, Claude Code deny rules, Simulated-user eval gap, OSS Scanner, Agent insurance, Wikimedia rogue agents