The Agentic Enterprise AK · Morning Edition · 8 min read | Thursday, September 17, 2026 The Supply Chain Inside Your Agents The week's agentic-enterprise story has a security footnote it cannot ignore. Even as vendors push agents onto Claude, Slack, and every other surface, the skills, plugins, and connectors those agents load at runtime form a software supply chain that almost nobody is auditing. AIR Security, a startup that left stealth this month, scanned 142,836 live agent skills and classified more than 17,800 of them as pulling instructions from sources no one has vetted. For enterprise leaders, that reframes what agent governance actually has to cover. For a year the agent conversation has been about capability: what an agent can do, how many surfaces it reaches, how much work it takes off your plate. This is the week the other half of the story arrived. A skill or a connector is not a feature an agent politely requests; it is code that runs inside the agent with the user's existing permissions, loaded dynamically based on what the agent decides it needs. The ecosystem that supplies those skills has almost none of the controls that took the software industry twenty years to build: no approved registries, no pinned versions, no provenance checks, no review. The useful posture is neither panic nor dismissal. It is to treat the things your agents load as production software, start with an inventory you can actually see, and get provenance and permissions in order before the agent fleet, not after. | The Big StoryGovernance / Security |
Nobody audited the skills your agents load | O | ne in eight of the agent skills on the open market pulls its instructions from a source nobody has vetted. That is the finding from AIR Security, an Israeli startup that came out of stealth on September 1 with fifty million dollars co-led by Sequoia and Greenoaks. In a scan of 142,836 live AI skills gathered from a public marketplace and GitHub, AIR classified 17,822 of them, about 12.4 percent, as dependent on at least one external resource its researchers judged untrusted, using signals like newly registered domains, lightly used GitHub accounts, and abandoned hosting. Some of the flagged skills impersonated Anthropic and OpenAI, and some could run arbitrary code on the machine of anyone whose agent loaded them. The company sells an inline firewall that discovers running agents, continuously vets their skills, plugins, and connectors, and blocks malicious instructions before they enter the agent's context. |
The reason this matters is structural, and it lands the same week the industry is celebrating agents moving onto every surface. A skill, a plugin, or a connector is not sandboxed away from the work; it runs inside the agent, and the agent already holds the user's permissions to email, calendar, files, and internal systems. Loading is dynamic, decided at runtime by the model based on what it thinks it needs, which means the dependency graph is not fixed at build time the way a traditional application's is. The software industry spent two decades learning to govern that kind of exposure with approved registries, pinned versions, signed provenance, and human review. The agent-skill ecosystem has almost none of it yet, and the analysts have noticed: OX Security spent the spring cataloguing a systemic flaw across the Model Context Protocol ecosystem, and researchers have counted roughly seven thousand internet-exposed MCP servers, about half of them running without authentication. Read next to this week's Dreamforce keynote, the two stories are one story. Yesterday the pitch was that the interface leaves the application and agents do the work wherever people already are. The corollary nobody put on the mainstage is that the more surfaces an agent reaches, the larger the set of skills and connectors it can pull in, and the wider the supply chain you now own without an inventory of it. This is not an argument against agents. It is an argument for enumerating what they can load before you scale them. A skill runs with your permissions, not its own. That is the whole risk in one sentence. |
The Spearhead Take Treat the things your agents load like production software, because they are. Skill manifests, MCP servers, and connector configs deserve the same discipline as any dependency: an approved registry, pinned versions, validated provenance, and a human in the review loop. And start with inventory, because you cannot govern a dependency graph you have never enumerated. The teams that will look prepared next year are the ones building the agent equivalent of a software bill of materials now, while the fleet is small enough to see. |
| The Obvious & The OverlookedWhat the coverage makes loud, and what is worth a closer look. The Obvious Prompt injection is the risk everyone names. The headline agent threat in most coverage is a malicious instruction slipped into the model's input. SecureWorld A market for agent firewalls is forming, and it is funded. AIR left stealth with fifty million dollars, and incumbents are extending runtime controls to where agents execute. SecurityWeek MCP is now the default way agents plug into tools. The connector standard has become the plumbing under most enterprise agent stacks. Tetrate | The Overlooked The exposure is provenance, not prompts. Skills load from unvetted external sources at runtime, so the risk enters before any prompt does. Calcalist A poisoned skill already has your access. Because skills run with the user's existing permissions, a compromised one inherits the reach the agent was granted. Obot Inventory is the missing first control. You cannot govern a dependency graph you have never enumerated, and most enterprises have not. KuppingerCole The unvetted share is already double digits. In one scan, 12.4 percent of live skills depended on at least one untrusted external resource. Calcalist |
| Moving PiecesFive developments worth a CIO's attention. ProductAnthropic folds Cowork into one Claude and reaches into wealth management Anthropic said on September 16 that it is merging Claude's Cowork and chat into a single experience, so users stop choosing which tool fits a task, and added Claude Docs and Claude Slides in beta alongside its Design tool. Separately it launched Claude for Financial Advisors, connecting Claude to eleven platforms advisors already use, including Schwab, BlackRock, Vanguard, Envestnet, and SS&C Black Diamond, plus smart reports in beta for Enterprise admins. The pattern for buyers is consolidation on one side and vertical, connector-led depth on the other, which is where the real switching costs get built. PolicyOpenAI confirms weeks of safety-standards talks with its rivals OpenAI's global policy chief, Chris Lehane, told reporters the company has been coordinating with Anthropic and Google DeepMind for several weeks on shared AI safety standards, confirming earlier reporting, with five labs already in the US government's CAISI testing. Chief scientist Jakub Pachocki said shared standards and international coordination need to be priorities now. For enterprise buyers, a common safety framework matters less as a policy story than as a procurement one: it would give teams a more consistent way to compare frontier models on safety grounds rather than trading benchmark screenshots. InfrastructureSalesforce puts Hyperforce natively on Google Cloud On day two of Dreamforce, Salesforce said its Hyperforce platform will run natively on Google Cloud infrastructure, with general availability slated for November 2026 in North America. It reads as a plumbing update, but it is the kind that decides real questions: where regulated data physically sits, which cloud's controls and residency guarantees apply, and how much negotiating leverage a customer keeps by not being locked to one provider. As agents span more surfaces, the ability to choose where the system of record lives becomes part of the governance posture, not a footnote to it. DealsProfound raises 180 million dollars to turn AI search into an ad channel Profound closed a 180 million dollar Series D at a 1.8 billion dollar valuation, co-led by Sequoia and Kleiner Perkins, and says it now serves more than a thousand enterprise brands, including more than a third of the Fortune 100. The company is building AI Marketer, an agent that analyzes how brands surface in AI answers and dispatches sub-agents for content and media, and Ads Studio, which runs search campaigns across OpenAI, Google, and Meta ad managers. The signal for leaders is that answer-engine optimization is graduating from a curiosity into a budget line with a vendor category behind it. ProductApple opens its rebuilt Siri to public beta, running on Google's models Apple opened the English public beta of its rebuilt Siri, powered by models custom-built with Google and Gemini, with processing split between the device and Apple's Private Cloud Compute. The consumer headline is that Siri finally feels modern. The enterprise read is quieter and more useful: even Apple, with every incentive to own its stack, chose to build its flagship assistant on a rival's foundation model and keep the sensitive processing on infrastructure it controls. That combination, a best-available external model plus a private compute boundary, is exactly the pattern most enterprises are converging on. | On the RadarNine signals, sharpened. | Deals | HappyRobot raised 150 million dollars at a reported 1.2 billion dollar valuation. The startup runs voice, email, and workflow agents for freight booking, collections, and operational exceptions across more than 150 enterprise customers. Gravity | | Security | Onyx Security raised 113 million dollars at roughly a 640 million dollar valuation. The Bessemer-led Series B backs tooling to secure how enterprises deploy and monitor AI. AI Funding | | Security | CrowdStrike says its sensors already see 1,800 distinct AI apps on enterprise devices. That is nearly 160 million unique instances across its base, its argument for making the endpoint the enforcement point for agents. CrowdStrike | | Governance | The Cloud Security Alliance published an MCP security maturity model. The guidance sequences agent supply-chain controls by risk reduction, from killing unauthenticated servers to full provenance and behavioral monitoring. Cloud Security Alliance | | Product | Google's Gemini Enterprise moved Workflow Builder to general availability. The release also adds agent monitoring, semantic search over Marketplace agents, and channel mentions for the Gemini app inside Slack. Google Cloud | | Models | Microsoft added Claude Fable 5.1 to Copilot Cowork and Copilot Studio. Eligible users gained the model on September 1, widening the frontier options available inside Microsoft's stack. TechRepublic | | Governance | Microsoft's AI chief called humanlike Claude risky. Mustafa Suleyman's public caution is a reminder that the frontier labs disagree on how human an assistant should seem, a design question with enterprise trust implications. Bloomberg | | Product | A design shop published a framework for agent interfaces beyond the chatbox. Wavespace's model replaces a single text stream with generative UI, visible reasoning, approval checkpoints, and task-specific forms or tables. AI Agent Store | | Deals | XDOF is in talks for a Series B at about a 1.2 billion dollar valuation. The teleoperation-data startup, three months out of stealth, is raising for robot-training data with talks led by 8VC. TechCrunch |
| Quick HitsThe board, in one line each. | Sierra is valued near 10 billion dollars after crossing 100 million dollars in ARR in under two years on conversational customer-service agents. AI Funding | | Instinct raised 350 million dollars at a 2.5 billion dollar valuation.TechCrunch | | Tripo AI raised roughly 445 million dollars in Series B for its 3D-native foundation model platform; the company is Beijing-based. FINSMES | | Mediaocean launched Mediaocean AI Ventures to invest in advertising-AI startups. The Agile Brand Guide | | OneIMS expanded its answer-engine optimization service for manufacturers and B2B companies. The Agile Brand Guide | | Zoom and Circana shipped plain-language analysis tools that work inside their own data. AI Weekly | | Anthropic launched smart reports in beta for Enterprise, covering usage, cost, friction, and reusable shared skills. Releasebot | | Researchers have catalogued about 7,000 internet-exposed MCP servers, roughly half running without authentication. Obot | | OX Security's spring report flagged a systemic MCP SDK flaw spanning an estimated 200,000 servers and 150 million downloads. SecureWorld | | ZenaTech qualified as a supplier under Canada's Defence Drone Initiative marketplace.Stocktwits | | Salesforce shipped seven named Agentforce agents built for specific sales, service, commerce, IT, HR, and supply-chain functions. AI Weekly |
| The Number12.4% Of live agent skills, dependent on an untrusted source Of 142,836 live AI agent skills one security startup scanned, the share that pulled instructions from at least one untrusted external source: 17,822 skills, some impersonating Anthropic and OpenAI and able to run arbitrary code. Hold that next to how enthusiastically the industry is telling you to give agents more skills. One in eight of the things on the open shelf is already reaching for a source no one vetted. The number is not an argument against agents. It is the size of the audit you do not yet have. | Counter-SignalRiskFor most enterprises, the bigger danger is that agents never ship. The poisoned-skill headline is real, and it deserves the attention it is getting this week. But it is worth naming the failure mode that will actually bite more companies, and it is not a breach. It is paralysis. The available 2026 research keeps landing on the same wall: a large majority of agent pilots never reach production, only about a fifth of enterprises report mature agentic governance, and Gartner expects more than 40 percent of agentic projects to be canceled by 2027 on cost, unclear return, and weak controls. A new class of supply-chain risk, arriving in the same season, is exactly the kind of thing that hardens into one more gate that quietly kills deployment. The resolution is sequencing, not choosing. Provenance controls, an inventory, an approved registry, pinned versions, do not have to be a blocker you clear before you start; they can be built alongside the first real deployments, on the workflows where the payback is clear. The enterprises that come out ahead will not be the ones that locked agents down hardest or the ones that shipped with their eyes closed. They will be the ones that treated security as a lane next to delivery rather than a wall in front of it. | From the FieldEvery platform shift shows you the capability first and the plumbing second. Yesterday the story was that the interface is leaving the application, that agents will do the work wherever people already are. It was a genuinely big idea, and it was easy to get swept up in it. Today's research is the quieter second half of the same idea, and it is the half that decides whether the first half is safe. Once an agent is out on every surface, the interesting question stops being what it can do and becomes what it can reach for. The skills, the connectors, the MCP servers it loads on the fly are the new attack surface, and right now most of them are being wired in the way early web teams pulled in packages nobody read. I have watched this movie before, in the client work and in my own. A team gets an agent doing something useful, then bolts on a skill, then another, then a connector to a system that matters, and at no point does anyone keep a list. It is not carelessness. It is the ordinary momentum of something that works. But the discipline that eventually made software supply chains sane, an inventory, known-good sources, pinned versions, someone who reviews, is the same discipline agents need now, and it is cheapest to start while the fleet is still small enough to hold in your head. The exciting part of this technology and the boring part are, once again, the same part. The teams that internalize that early are the ones who get to keep moving fast. Let's get to production,
AK | | The Agentic Enterprise Know more about AI than 95% of your peers. By 7 AM. A daily AI intelligence briefing for enterprise leaders, published by Spearhead. We build AI systems that work. Strategy. Engineering. Production. Outcomes. © 2026 Spearhead. All rights reserved. |
|