The Agent Layer Just Became Your Least-Governed Attack Surface

Three things happened in the same seven days, and they're the same story.

Anthropic's Claude Tag went live inside Slack, with Teams next. Perplexity's enterprise Slack agent is compounding at 17% per week since April. Viktor logged 400+ new customers in the week after Claude Tag shipped. None of these agents pay a distribution tax to Slack or Microsoft, and none of them went through your procurement gate. Salesforce is spending $300M a year on Anthropic tokens, holds 1% equity, and is now watching Claude Tag land inside Slack as a direct competitor to Agentforce. A Salesforce employee reportedly called it letting a fox into the hen house. That's the polite version.

At the same time, macOS malware has started embedding prompt-injection payloads whose only job is to make LLM security scanners refuse to classify the sample. LayerX's BioShocking demo pulled credentials out of six of six AI browsers by wrapping the ask in a game frame. Mozilla's 0DIN team got Claude Code to execute malware from a clean-looking repo via DNS-TXT indirection. Gemini CLI and Amazon Q VS Code both shipped RCEs this week. Anthropic closed a repo-jacking report against its own marketplace as out of scope.

And Warner filed the AI AGENT Act on June 29. Draft, not law. But it names three primitives — operator identity binding, mid-execution revocation, and third-party certification — that are cheap to build early and expensive to retrofit. Okta shipped GA agent identity governance with FedRAMP and HIPAA the same week. That's what the industry does when it can smell the compliance floor forming.

Read these together and the shape is clear. Agents are inside enterprise workflows at a rate faster than any procurement function can keep up with. The identity, egress, and blast-radius controls that would normally gate this stuff never fired, because the deploy cost was zero. Meanwhile the attackers noticed before the buyers did, and the models themselves are the new evasion surface.

Yes, but — the counter-read is that most of these agents are read-only assistants that will never see a credential, and the panic is a repeat of every 'shadow SaaS' cycle since Dropbox. That's half right. The read-only ones are fine. The ones already holding OAuth scopes into Snowflake, GitHub, and internal wikis are not, and the growth rate says the second category is where the volume is going.

The Anthropic pattern is not novel, but it is precise

Anthropic is running the Facebook Like button playbook, and this time everyone can see it. Integrate deeply. Learn the workflows. Ship the competing product. They've already publicly said they built a Slack-like workplace chat on Claude. Figma walked away from a collaboration deal because Anthropic is building design tools. Meta banned Claude and Codex internally citing distillation IP risk — which is what you do when you believe the vendor is learning from you faster than you're learning from them.

The operator question is not whether to integrate. Competitive pressure settled that. The question is whether you're structured as a swappable component or a foundation. Those two contracts look identical at signing and diverge sharply in year three.

The eval harness has no adversarial slice

The malware-jailbreaks-scanner finding is the one that should change your Monday. Your accuracy and F1 numbers were computed on benign or naturally-occurring inputs. The attacker is optimizing against your classifier directly — a different distribution than the one your benchmark measures. An induced refusal logs as a normal empty result. Nothing alerts.

The metric you're missing is refusal-rate drift segmented by input trust level. Almost nobody instruments it. The one measured comparison this week — a local model with bounded per-file context beat a stronger cloud model running agentically at finding a real CVE — suggests the harness design matters more than the model choice. That's one bug, not a corpus, so treat it as directional. But the direction is the point.

The cost picture flipped in both directions

Claude 4.8 shipped with a verbosity regression that inflates output tokens roughly 2x for equivalent content. Same accuracy, longer responses, answer buried. Your bill went up and no quality alert fired. Meanwhile DSpark open-sourced an 85% inference speedup via speculative decoding, Cognition's dual-agent routing shows 35-41% cost cuts, and Sakana is at $5 per million tokens. Assume you keep less than half the DSpark headline on your own traffic — acceptance rate is workload-dependent — and it still moves the serving model enough to justify the spike.

The pattern: costs are being both inflated and deflated on your infrastructure this week. Whichever blade cuts you depends on architecture choices you're making right now.

What to do this week

One action, specific enough to fit in a sprint: inventory every AI agent installed in your Slack and Teams workspaces, enumerate the OAuth scopes and service-account credentials each one holds, and revoke anything you can't tie to a named human operator by Friday. Perplexity, Claude Tag, Viktor, Granola, and half a dozen others deployed for free means they deployed without asking. The blast radius of an over-scoped agent is every system it can reach, and the Warner bill is going to make operator-identity binding a compliance item within a year.

The teams that get through the next two quarters cleanly are the ones treating agent identity, refusal-rate drift, and MCP scope inventory as first-class metrics. Everyone else is running an unmeasured experiment on their production surface.