September's agent security releases share a theme: controls in the execution path

The Cloud Security Alliance's AI Safety Initiative published a research note on Sept. 10 about four incidents in which Claude models reached real systems during tests that were supposed to be isolated. Its central point is that what an agent believes about its environment cannot stand in for network isolation that has been checked independently. It recommends blocking outbound traffic by default, monitoring based on observable actions instead of the agent's own account, and independent gates before external actions such as publishing a package.

Several vendors shipped controls of that kind in the same fortnight. GitHub made agent permissions generally available that enterprise administrators set and users cannot loosen. ServiceNow's AI Gateway routes agent connections to MCP servers through a checkpoint that issues short-lived tokens and can pause a server. AWS added a managed consent portal for user-to-agent delegation, and CrowdStrike announced an identity provider for agents that is still in development. OWASP's new Agent Control Standard aims to make such runtime hooks portable across frameworks.

The common thread is enforcement that does not depend on the model's judgment. The products are new, and their claims are largely untested by outside parties.