AI agents fail security tests, and the whole stack just repriced

1Password open-sourced a benchmark called SCAM this week — 30 workplace scenarios, eight frontier models, MIT-licensed, video replay included. Safety scores landed between 35% and 92%. Every model tested exhibited at least one critical failure: entering credentials on a phishing page, forwarding a password to an external address, completing a workflow it should have refused. Zero models cleared the suite.

That's the number to hold in your head as you read the rest of this.

On the same news cycle, OpenAI shipped Lockdown Mode for ChatGPT and slapped "Elevated Risk" labels on capabilities inside Atlas and Codex. Read that as what it is: the vendor labeling its own features as elevated risk for prompt injection, and shipping the fix off-by-default. OpenAI also acqui-hired Peter Steinberger, whose OpenClaw framework (120k GitHub stars) inherits the installing user's full permissions by design — persistent memory, always-on autonomy, financial transactions in scope. Anthropic, whose Claude was ClawdBot's default, responded to that distribution windfall with a cease-and-desist over the name. OpenAI responded with a checkbook. The framework is now the industry's de facto agent runtime, and its threat model is "trust the plugin marketplace."

Agents are privileged service accounts with an app store. Treat them that way or accept the incident that follows.

The cheap fix, then the real one

The SCAM paper's most useful finding is buried: adding a short security "skill file" — a system-prompt guardrail with explicit rules about credentials and untrusted content — dramatically reduced failures across every model tested. Hours of work. Ship it this week on every agent touching auth, email, or a browser. That's the floor.

The ceiling is architectural. Sandboxed execution, scoped credentials per task rather than per user, allowlisted tools, and per-invocation audit logs. The same discipline you'd apply to untrusted code execution, because that's what a plugin-capable agent is. If your rollout plan doesn't start with a blast-radius diagram, you don't have a rollout plan.

Yes, but — the counter-reading is that SCAM tests a specific class of adversarial workflow and most production agents run narrower, more controlled tasks. Fair. It still doesn't tell you what your specific deployment does under prompt injection, and the benchmark is the first standardized way to find out. Run it before someone else runs the live version against you.

Action this week (72 hours): enable ChatGPT Lockdown Mode by policy for enterprise tenants, ship security skill files on production agents, and put SCAM in your CI as a release gate for anything touching credentials. Two act-now items, both cheap.

The other floor that dropped

ByteDance's Seed 2.0 Pro matches GPT-5.2 and Gemini 3 Pro across math, reasoning, and vision benchmarks at $0.47 per million input tokens. OpenAI's equivalent is $1.75. Google's is $5.00. That's a 73–91% gap at comparable quality, in a single competitive cycle, from a lab whose earlier release (DeepSeek) already forced a repricing round.

Separately, GPT-5.2 autonomously generated and proved an original result in theoretical physics, verified by researchers at Harvard, Cambridge, and Princeton. The Harvard physicist on the verification said the model "chose a path no human would have tried." Take the framing with appropriate salt — it's a preprint blessed by named collaborators, not settled peer review — but the direction of travel is legible. Commodity inference is racing toward zero. Differentiated capability is doing the opposite.

Every feature your team killed on unit economics deserves a fresh spreadsheet. Every product built on the assumption that per-seat SaaS is a durable moat deserves a harder look. Botkeeper shut down this week after $90M raised and eleven years, despite 80%+ transaction-coding accuracy — because it was a dispatcher on a curve it didn't own. Ramp shipped an Accounting Agent embedded in the platform of record on the same news day. That's the pattern: AI wrappers die, systems of record with AI inside compound.

Stripe paid a billion dollars for Metronome because its own billing stack can't do event-streamed usage-based pricing. If Stripe can't retrofit, your subscription plumbing almost certainly can't either. That's the second billing platform in as many quarters to concede the point by acquisition.

What breaks if you don't reprice

Microsoft is building its own models under Suleyman explicitly to reduce OpenAI dependency. Any Azure-OpenAI-native architecture is now sitting on a slow-moving fault line. Provider abstraction stops being hygiene and starts being risk management.

The agent orchestration layer — klaw, Warp's Oz, whatever emerges from the OpenClaw foundation — is where the Kubernetes-of-agents fight happens over the next four quarters. And the security infrastructure underneath it doesn't exist yet, which is where the greenfield opportunity sits for anyone building tooling in that gap.

Meanwhile, 300+ malicious Chrome extensions with 37.4 million installs are actively exfiltrating browsing history and Gmail contents from enterprise fleets right now. 153 of them steal on install. 15 are AI-themed and specifically target Gmail. Your engineers have some of them installed. Your SBOM doesn't cover browser extensions. Fix that this week too, while you're auditing everything else.

One thing to do before Friday: pick your riskiest deployed agent — the one with the broadest tool access and the most sensitive credentials — and run SCAM against it. Post the score to your engineering channel with the date. That number is your new baseline, and everything you ship from here either moves it up or explains why it didn't.