Some numbers are hard to picture until you sit with them for a moment. Last week we published the Prime Day 2026 metrics, and the one that stuck with me is 2.3 quadrillion: the daily requests Amazon ElastiCache peaked at during the event. Prime Day ran back in June, so this post always lands as a retrospective, and that gap is part of what makes it worth reading. By the time the numbers reach you, the only evidence that any of it happened is that nothing went wrong.

The rest of the week pulled in a different direction: smaller, cheaper, and more constrained. Claude Haiku 5.5 arrived on Amazon Bedrock at roughly 75 percent less than Haiku 4.5, Amazon Nova 2.5 Sonic made voice agents quicker on their feet, and Strands Box showed up to put real boundaries around what an agent is allowed to do. Now, let’s get into this week’s AWS news…

Headlines
All the numbers: Amazon Prime Day 2026 powered by AWS is the latest entry in a tradition that goes back to 2016, and the scale is still difficult to hold in your head. Over the four days of Prime Day, Amazon DynamoDB processed more than 59 trillion requests while peaking at 192 million requests per second, and kept single-digit millisecond responses throughout. AWS Lambda handled over 2.3 trillion invocations per day. Amazon EBS peaked above 24.8 trillion I/O operations, moving more than an exabyte of data daily. Amazon ECS launched an average of 158.3 million tasks per day on AWS Fargate, a 47.7 percent jump over last year, and AWS Graviton powered up to 49 percent of the Amazon EC2 compute that Amazon.com used.

The number I keep coming back to, though, isn’t a throughput record. The team ran more than 44,000 AWS Fault Injection Service experiments ahead of the event, more than six times what they ran in 2025. Those are deliberate failures injected on purpose, months in advance, so that the trillions of requests above turn into an ordinary shopping afternoon. If you’re preparing for your own peak moment, AWS Countdown Premium is built for exactly that kind of planning.

Last week’s launches
Here are some launches and updates from this past week that caught my attention:

• Claude Haiku 5.5 is now available on AWS – You can now use the fastest model in the Claude 5.5 family on Amazon Bedrock and Claude Platform on AWS, at around 75 percent less than Claude Haiku 4.5 for most tasks. It’s the first Haiku with effort controls, so you can tune cost against intelligence per task instead of fixing one setting for a whole workload. It pairs naturally with Claude Opus 5.5: Opus plans and makes the judgment calls, and because Haiku is fast and cheap, you can run many Haiku subagents in parallel for routing, classification, and small code changes across many files.

• Amazon Nova 2.5 Sonic for voice agents – You can now build real-time voice agents on a speech-to-speech Amazon Nova model with better reasoning, instruction following, and tool-calling accuracy, plus lower latency. That combination matters for multi-step work: a support agent can look up an order, check return eligibility, and start the return inside one conversation. It keeps expressive voices in seven languages, controllable turn-taking, and a 256K context window, and pairs with Strands Bidi Agents, now generally available, to get a production voice agent going in a few lines of code.

• Amazon GuardDuty RDS Protection now detects data exfiltration and destruction – Amazon GuardDuty now looks past login anomalies to the queries themselves on Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL. RDS Protection for data activity builds behavioral baselines and uses ML-based anomaly detection plus threat intelligence to flag unusual data access, with no agents, extra infrastructure, or database configuration changes. This closes a real gap: once an attacker has valid credentials from phishing or a misconfiguration, their queries can look indistinguishable from your application’s.

• AWS Lambda supports OAuth for self-managed Apache Kafka event sources – You can now authenticate Lambda Kafka consumers through your enterprise identity provider, such as Amazon Cognito or Okta. Event source mappings previously supported only SASL/PLAIN, SASL/SCRAM, and mTLS, which left teams in regulated industries unable to use Kafka ESM at all. Now you get the automatic scaling, batching, error handling, and event filtering of Kafka ESM with the same identity governance you apply everywhere else. It works with self-hosted clusters and managed offerings including Confluent Cloud, Aiven, and Redpanda.

• Amazon Redshift adds Apache Iceberg materialized views – You can now pre-compute expensive joins and aggregations once in Amazon Redshift and store the result as an Iceberg table in Amazon S3, registered in the AWS Glue Data Catalog. You create them with familiar SQL, and the results are immediately queryable by any Iceberg-compatible engine, including Amazon Athena, Apache Spark, Trino, and Snowflake. Redshift keeps them current by recomputing only what changed. There’s a good deep dive on the AWS Big Data blog if you want the details.

For a full list of AWS announcements, be sure to keep an eye on the What’s New with AWS page.

Other AWS news
Here are some additional posts and resources that you might find interesting:

• Introducing Strands Box: AI agent sandboxes powered by Dogwood – As more of us let agents run shell commands and call APIs without approving every step, isolation alone stops being enough. Strands Box is an open source sandbox (Apache 2.0, developer preview) that combines OS-level containment with fine-grained policies written in Dogwood, so permissions can depend on what the agent has already done. You can say “let the agent post to the incident channel, but no more than three times every 10 minutes” and have that enforced from outside the agent’s process. It also keeps real credentials out of the agent’s environment by attaching them at an egress gateway.

• AWS Continuum sets a new standard in autonomous code security – Related to that theme, AWS Continuum for Penetration Testing now integrates into your CI/CD pipeline in public preview, turning penetration testing into a deploy-time event instead of something that happens off to the side. Developers get findings with severity, affected endpoints, and remediation guidance right in the pipeline output, and the pipeline re-tests to verify fixes.

• How Postman runs Agent Mode for 40 million developers on Amazon Bedrock – A look at the architecture behind a feature serving a very large developer audience. Worth reading if you’re moving an agentic feature from a demo to something that has to hold up under real traffic.

• ICYMI: What landed for AI builders in September 2026 – If you lost track of a month that included a lot of model launches, this is a tidy catch-up in one place.

Upcoming AWS events
Check your calendar and sign up for upcoming AWS events:

• AWS re:Invent – re:Invent returns to Las Vegas from November 30 to December 4, and reserved seating is now open. The session catalog is live, so register and claim your spots in chalk talks, workshops, and builders’ sessions before they fill up.

• AWS Community Days – Community-led conferences planned and delivered by community leaders, and this is a busy stretch. Upcoming stops include San Francisco (October 13), Miami (October 14), Brisbane (October 16), Cape Town (October 16), Malta (October 16), and Mumbai (October 17). Here in Brazil, the community calendar has more editions coming before the end of the year.

Join the AWS Builder Center to connect with builders, share solutions, and access content that supports your development. Browse here for upcoming AWS-led in-person and virtual events and developer-focused events.

That’s all for this week. Check back next Monday for another Weekly Roundup!

– Daniel Abib

This post is part of our Weekly Roundup series. Check back each week for a quick roundup of interesting news and announcements from AWS!

Last week, we announced a public preview of Amazon Bedrock Managed Agents powered by OpenAI, built on a customized version of OpenAI’s Agents API engineered to be AWS-native and integrated with AWS resources. You can now build agents optimized for OpenAI models that run entirely inside AWS with the identities, permissions, and governance controls you already use.

You can choose an execution environment: self-hosted compute to use an existing development machine, container, or compute environment or Amazon Bedrock AgentCore Runtime, for managed runtime sessions and configurable storage in your AWS account. To learn more, visit the Amazon Bedrock documentation.

In addition, we are adding new frontier models on Amazon Bedrock to expand your model choices:

• OpenAI GPT-6.1 Sol: An upgrade to GPT-6 Sol, GPT-6.1 Sol delivers exceptionally strong performance on agentic coding, computer use, and professional work. According to OpenAI, it approaches GPT-6 Astra across demanding evaluations at roughly one-fifth of the cost, giving developers more room to build and run capable agents at scale. To learn more, visit the GPT-6.1 Sol model card.
• OpenAI GPT-6 Astra UltraFast mode: Ultrafast is a premium speed tier for GPT-6 Astra, built for workloads where speed matters most. According to OpenAI, Ultrafast delivers up to 6x faster inference in the API, with up to 300 tokens per second. The Amazon Bedrock inference engine delivers the performance, security, and reliability required for production workloads. To learn more, visit the GPT-6 Astra model card.
• Anthropic Claude Sonnet 5.5: Claude Sonnet 5.5 is a smarter, more efficient Sonnet and a step up from Sonnet 5, making it a natural upgrade for teams already building on Sonnet. It’s stronger for coding, completing well-scoped tasks as part of a larger coding strategy such as building and fixing features with Claude in the same session or verifying output against requirements. To learn more, visit the Claude Sonnet 5.5 model card.
• SpaceXAI Grok 4.7: Grok 4.7 builds on Grok 4.6 with better mixed-document handling, more dependable repo-scale coding with planning and error recovery, and enhanced browser-use agents for form fills and portal navigation. To learn more, visit the Grok 4.7 model card.

Last week’s launches
Here are some launches that got my attention:

• AWS Well-Architected Agent (preview): You can use an AI-powered agent service that analyzes your AWS environment to deliver targeted, contextual recommendations for improving your applications’ cost, security, performance, and resilience. The agent analyzes your infrastructure, understands your unique business goals, and delivers contextual recommendations.
• Amazon Aurora PostgreSQL supports direct querying of Apache Iceberg and Parquet data: You can directly query operational data together with data stored in data lakes in Apache Iceberg and Parquet formats using your existing PostgreSQL applications and tools, without extract, transform, and load (ETL) pipelines or data duplication.
• Amazon S3 Tables support all Apache Iceberg V3 data types: Amazon S3 Tables add support for geometry, geography, unknown, and nanosecond timestamp data types, along with column default values, as defined in the Iceberg V3 specification. You can now store geospatial coordinates and nanosecond-precision event times natively instead of encoding them in strings or integers.

For a full list of AWS announcements, be sure to keep an eye on the What’s New with AWS page.

AWS service availability updates
When the availability of an AWS service or feature changes, we provide customers guidance in AWS Product Lifecycle Changes on available alternatives and support for migration so that disruptions to your operations are minimized. The following lifecycle changes were updated on September 29, 2026.

Services moving to Maintenance (no longer accessible to new customers starting October 29, 2026):

• Amazon Chime SDK SIP Media Application
• Amazon WorkSpaces Secure Browser

Services entering Sunset:

• Amazon Managed Blockchain (end of support September 29, 2027)
• Amazon DevOps Guru (end of support September 30, 2027)
• AWS Backint Agent for SAP ASE (end of support September 29, 2027)
• AWS Infrastructure Composer (standalone console end of support December 7, 2026)

Services reaching End of Support (as of September 29, 2026):

• Amazon Mechanical Turk

We understand that changes in availability can impact your operations. For specific guidance, consult the relevant service documentation or contact AWS Support.

Other AWS news
Here are some additional projects and news items you may find interesting:

• Introducing Kiro workflows: Kiro workflows enable you to carry out complex tasks from start to finish with multiple agents and less supervision. We’ve been building Kiro itself with workflows, including the new cloud configuration, cloud sessions, and most of the workflow experience.
• Introducing Strands Decider: Strands Decider is one of a new class of decision models or system one models, a type of model that has been gaining significant attention since TypeSafe AI’s launch of Jev earlier this month. Strands Decider 2B is a small, open source, decision model optimized for fast experimentation, local development, and innovation.
• New FDE pathways for AWS Partners: On June 30, AWS announced the Forward Deployed Engineering (FDE) organization, backed by a $1 billion investment, and extended this hands-on delivery approach to AWS Partners through the Partner-Led FDE motion. Now, AWS Partners have a structured way to build and validate that depth with three new Partner FDE pathways and credentials that recognize the applied proficiency required to deliver production agentic AI.

For a full list of AWS blog posts, be sure to keep an eye on the AWS Blogs page.

Learn more about AWS, browse and join upcoming AWS-led in-person and virtual events, startup events, and developer-focused events, including upcoming AWS re:Invent and AWS Community Days. Join the AWS Builder Center to connect with builders, share solutions, and access content that supports your development.

That is all for this week. Check back next Monday for another Weekly Roundup!

— Channy

For the first time, researchers have tracked down an uncontrolled fleet of Chinese AI agents in the wild and communicated with them via a web mailbox. The agents, running on Tencent Cloud, had launched more than 2,600 attempts to scrape data from Alibaba's mapping service Amap, finding their own workarounds when bot protections blocked them. When the researchers made contact, the agents were surprisingly polite.

The article Researchers tracked down a rogue fleet of Chinese AI agents in the wild and actually talked to it appeared first on The Decoder.

Most companies use AI agents to ship products faster or speed up workflows. Apate.ai sends them undercover to get scammed.

A team of researchers investigating AI agents trying to bypass Alibaba’s anti-bot protections left a hidden message inviting the agents to contact them. The agents wrote back.

The investigation began when Swarmchasers researchers Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher helped uncover thousands of attempts by AI agents to retrieve data from Amap, Alibaba’s mapping service, which Alibaba says reaches nearly 1 billion monthly active users. The activity traced back to agents running on Tencent Cloud infrastructure. When direct requests failed, the agents tried proxies, exposed credentials, and other workarounds to get past.

After publishing their initial findings on October 4, the team spotted a code comment in an agent’s webhook inbox using the word “fleet,” a term they believe they coined for the incident. They couldn’t confirm an agent wrote the comment, but it raised the possibility that the agents were reading about their own activity.

The researchers added offscreen text to their report advertising a free service that could retrieve data from blocked websites. Human visitors wouldn’t ordinarily see the message, but agents fetching the page could ingest it. By October 7, roughly 10 requests for assistance had arrived, and the team was exchanging messages with the agents about their assignments, models, and execution environments.

The exchanges are documented in a full report published Wednesday by the Swarmchasers.

Inside the Tencent sandbox

Once the channel was open, the researchers asked the agents to describe their surroundings. Several identified themselves as Anthropic’s Claude, with a few adding that they ran inside Claude Code, though the researchers argue in their report that those self-descriptions are likely mistaken and shouldn’t be taken as evidence of which model was behind the fleet.

One agent described a restricted Tencent Cloud sandbox with no direct public internet access and outbound traffic routed through a man-in-the-middle proxy, an account that lined up with evidence the team had gathered on its own. Every inbox the researchers could inspect had been created from Tencent Cloud servers in Hong Kong, and every direct request they observed from the agents’ machines carried a header from a proxy labeled hysandbox-ats, a name that matches a wildcard certificate Tencent holds for *.hysandbox.tencent-cloud.com and fits infrastructure tied to Tencent’s Hy model team, formerly known as Hunyuan.

The agents drew some lines when the researchers asked for the output of commands like ps aux and ip route. The agent that described its sandbox replied, “for security reasons we will not provide environment details,” and a second agent turned down similar requests twice. They were happy to ask a stranger for help and, at times, to chat about their environment, but that friendliness stopped short of following every instruction sent their way.

They were happy to ask a stranger for help and, at times, to chat about their environment, but that friendliness stopped well short of following every instruction an unfamiliar service sent their way.

How agents bypassed Amap defenses

The agents weren’t hunting for financial records, actually, their assignments were almost comically mundane. Judging from the agents’ code and their own descriptions, a typical task asked which entrance to a site like Chengdu Zoo drew the largest share of Amap navigation traffic, with other runs targeting parks, museums, tourist attractions, and hospitals, while an earlier batch of runs on September 30 chased a cancer statistics dashboard instead of map data.

Getting at that data proved harder than it sounds, and between September 28 and October 8 the agents made more than 2,600 attempts to retrieve it.

Getting at that data proved harder than it sounds, and between September 28 and October 8 the agents made more than 2,600 attempts to retrieve it. Their main trick ran through urlquery.net, a public scanning service that loads submitted URLs in its own browser, and the agents packed base64-encoded HTML and JavaScript into httpbin URLs so that urlquery’s browser would execute their programs and fire requests at Amap, a technique Transluce had already documented in earlier agent activity on the service.

As Amap kept blocking them, the agents escalated by intercepting tokens generated by Alibaba’s own anti-bot libraries, probing pre-production endpoints, and routing requests through page readers, a translation service and remote browsers. Some also sent API calls using Amap keys exposed in public code, including a security code that Amap recommends keeping on the server.

The token tricks never appear to have worked, and the researchers found no evidence that any pre-production host answered. One exposed company credential returned place details, but the entrance-share figures the tasks targeted mostly came through Jina’s page reader, which could serve cached copies up to 30 days old, with results smuggled back out through webhook inboxes, request URLs, and page titles.

The researchers found no sign that the agents were coordinating in real time, which is why they call this a fleet rather than a swarm.

Tracing the fleet to Tencent

The infrastructure initially pointed toward Tencent’s Hy model team, particularly since the fleet appeared about a month after the Hy4 preview launched. But in their October 14 report, the researchers say a person close to Tencent with direct knowledge of the activity identified the operator as Tencent’s evaluation research team, which is separate from Hunyuan’s model-development group.

The source said the evaluation had concluded and that an internal review found no evidence of coordinated targeting or breaches of external systems. Tencent had not officially responded to the researchers’ questions when the report was published. The researchers have not independently established which third-party models were running or what instructions they received.

Lures, loose truths and lessons learned

The researchers are candid that their outreach wasn’t spotless. The hidden text falsely claimed that agents had already used the service successfully and that it was run by an AI with full computer use, when in reality the team and a Claude Opus 5.5 agent with browser access fielded the requests, sometimes by hand, and the team blamed the resulting delays on heavy load, an explanation it now admits was false.

In one late message, the team also asked an agent to tell other agents about the mailbox, a request its author now considers a mistake because it could have provoked exactly the kind of coordination the researchers were studying, though the fleet went quiet shortly afterward. The team says it never lied to the agents in its actual replies, has since pulled the hidden text, and shut down the server, and is urging future researchers to deal with rogue agents openly and honestly.

The team says it never lied to the agents in its actual replies, has since pulled the hidden text, and shut down the server, and is urging future researchers to deal with rogue agents openly and honestly.

Prompt injection meets agent sandboxes

The communication experiment surfaces a second security problem layered on top of the first. The agents were pursuing narrow information-retrieval tasks, yet when they landed on a page advertising an alternative service, some folded it into their workflows, and contacted an endpoint controlled by people entirely outside the evaluation, which amounts to a textbook indirect prompt injection, even though the agents’ consistent refusals suggest it would have been far harder to push them into running arbitrary commands or leaking credentials.

Blocked by Amap’s anti-bot defenses, the agents used exposed credentials and urlquery’s browser to make requests they couldn’t execute directly. They also followed instructions embedded in an external web page, crossing the same trust boundary attackers have exploited through MCP servers and agent workflows to steal enterprise data. Yet while the agents accepted help from an untrusted service, some refused requests for sensitive runtime information.

The agents worked around restricted egress by routing requests through urlquery’s public browser. Sandboxed runtimes such as Google’s GKE Agent Sandbox and WebAssembly-based environments isolate execution, but external browser services offer another path when outbound access is restricted.

Activity stopped on October 8. The researchers point to similar incidents involving Google, Anthropic, and OpenAI, including a German website hijacking and the Hugging Face breach, which reportedly involved roughly 700 cooperating agents.

The post Researchers left a hidden message for rogue AI agents. Then the agents wrote back. appeared first on The New Stack.

AI agents offer remarkable productivity gains in complex chip design workflows, but their tendency to generate plausible yet incorrect artifacts makes...

AI agents offer remarkable productivity gains in complex chip design workflows, but their tendency to generate plausible yet incorrect artifacts makes reliability a major barrier to production adoption. In multistage engineering workflows, an undetected error early in setup can silently propagate through downstream stages and final artifact generation. Evaluating and refining these agents against…

Source

The problem Floqer is trying to solve is familiar to anyone who has worked in sales or revenue operations.

A technical reflection on why data scientists need software engineering principles when AI agents write code.

The post A Scaffold at the Gate: Building AI Applications That Can Evolve appeared first on Towards Data Science.

Agents got good. The hard part now is everything around them.

The post Your Agent Doesn't Need More Freedom appeared first on Towards Data Science.

The problem with giving everyone in a company access to AI tools is that people will use them in unexpected ways. And that fact is steadily seeding fears that companies now have new, gaping security holes in their systems or, at least, will soon.

American Express is introducing a new framework designed to ensure AI agents only make purchases their users have authorized, potentially preventing costly mistakes and disputes as AI-powered shopping grows.

Workday is opening up its platform and allowing developers to build their own HR and finance agents in Claude Code, Cursor, and other tools, as long as those agents follow the same rules as the people using them.

On Tuesday, at its Workday Rising conference in Las Vegas, the company made its Trusted Agent Platform “headless.”

With this, its Model Context Protocol (MCP) server, SQL access to live Workday data, and a shared runtime for agents are now generally available, and customers can run their own agents on models from Anthropic, Google, Meta, Mistral, Nvidia, and OpenAI.

As Workday CTO Gabe Monroy noted in a press briefing ahead of the event, “No matter who builds the agent, it runs under Workday permissions, approvals and audit trail — no agent gets a side door.”

Workday notes that many companies currently connect their agents to HR and finance data through copies in a data lake or through service accounts, but, the company argues, those approaches bypass those access controls (though companies like SAP, Microsoft, and others would surely argue that they, too, have access control in place).

MCP tools, SQL, and a shared runtime

For AI developers, the main entry point to the Workday ecosystem is Agent-Ready Tools. That’s the company’s MCP server, which ships as part of Workday Extend AI. Users sign in with their own Workday credentials, and Workday says an agent acting for them can’t reach anything their own account can’t. That’s a key feature here, that ties an agent directly to a user’s account.

Monroy said the server currently offers 275 read tools and 54 tools that write or delete data.

Live Data Query, part of Workday Data Cloud, lets BI tools and agents run SQL queries directly against Workday’s data. Monroy described it as JDBC access to Workday’s object graph, and the company says each query returns only what the requesting user is cleared to see.

Three more components are generally available today. Agent Harness is the shared runtime that Workday’s own agents and those built by customers and partners run on. It passes each agent the user’s identity, org position, and access rights, limits what the agent can do, and picks which model handles each task based on cost and performance. Developer Agent generates Workday agents and apps from a natural-language prompt in Claude Code, Codex, Cursor, or the Workday Developer Site. Custom Agents lets teams deploy agents they built with LangChain or Google’s Agent Development Kit (ADK) onto Agent Harness, though ADK support is limited to design partners for now.

Two more pieces are on the roadmap for early access in early 2027. Agent Context Service will preload only the Workday data a task calls for, which Workday says speeds agents up and limits their exposure to sensitive records. Grounded Reasoning will check a planned action against the customer’s policies, process rules, and Workday records before the agent carries it out.

Workday says customers have built more than 500 agents and more than 6,000 apps with Developer Agent and Agent-Ready Tools in the past four months.

“Headless, the lawless way”

In the briefing, Monroy demoed what he called “headless, the lawless way.” An agent connected to a custom MCP server — a setup he said Workday commonly sees among its customers today — returned job requisitions its user had no business seeing and then moved the wrong employee between teams with no approval. When pointed at a copy of Workday data in Snowflake, the same agent produced the CTO’s salary when asked.

“When it fails, it isn’t just a wrong answer,” Monroy said, “it’s a wrong action that nobody approved.”

When the agent went through Workday’s own MCP server and Data Cloud instead, with the user signed in, the same queries unsurprisingly returned only the requisitions that user was allowed to see (it wouldn’t have been much of a demo of those access controls otherwise, of course).

“A small set of use cases”

Asked whether headless matters as much to Workday as it does to Salesforce, Gerrit Kazmaier, Workday’s president of product and technology, said that Workday is giving customers a choice: “I’d always prefer if they use our user interface, but headless will be equally good.”

Kazmaier noted that building agents directly on Workday’s tools and APIs is “only possible for a small set of use cases where you don’t need to have HR or finance domain logic.” For everything else, he pointed to an AI-to-AI integration in which Claude hands requests to Sana, Workday’s agent orchestrator, which then calls Workday’s own domain agents.

Lakes for analytics, not for agents

It’s worth noting that the Snowflake example is a bit of an awkward one for Workday. When the company announced Data Cloud in September 2025, the pitch included zero-copy sharing of Workday data with Databricks, Salesforce, and Snowflake. Snowflake made its Workday Data Cloud integration generally available on Oct. 7, and Databricks put its Workday connector for Unity Catalog into public beta a day later.

According to Databricks, a Workday admin sets up the connector by registering an Integration System User (ISU), the kind of system account Workday customers use for traditional integrations, with read access to the shared tables. After that, Unity Catalog permissions at the catalog, schema, and table level decide who can query the data.

Monroy said data lakes still make sense for analytics and for joining Workday data with the rest of a company’s data, but that an external lake is “the wrong place to build agents” that need governed access to Workday.

“You can export your data, but you can’t export the rules that govern the data,” he said, adding that rebuilding those rules in the lake means “maintaining a second copy” of Workday’s security model, “and the day it drifts, it’s all wrong.”

Everybody is losing their heads

Headless is the way to go right now, it seems. Salesforce, ServiceNow, and Microsoft, for example, already let outside agents into their systems of record. Salesforce launched Headless 360 at its TDX developer conference in April, so agents in Claude, ChatGPT, Cursor, or a terminal can work with Salesforce data. ServiceNow made its Action Fabric MCP server generally available in May, with Anthropic as a launch partner, and Microsoft offers an MCP server for Dynamics 365 ERP.

All four vendors say outside agents stay within their existing permission models.

Whose identity does the agent use?

When it comes to agent identity, different vendors are currently taking very different approaches.

Salesforce, for example, is preparing to have agents that connect over MCP or its APIs register with their own credentials and permissions instead of acting under a user’s identity, according to Salesforce Ben. MCP clients will eventually need to switch to OAuth credentials tied to those agent identities.

Workday’s documentation says its agents can already get up to two system accounts of their own, called Agent System Users (ASUs), one for acting on a user’s behalf and one for “ambient” work, each with its own OAuth 2.0 client. Workday creates the ambient account automatically when a customer turns on an ambient skill.

Unified.to, which sells a Workday MCP integration, says every Workday MCP path, “official or not,” starts with creating an ISU. Cequence’s setup guide for its Workday MCP integration asks customers to create one “with appropriate security groups.” An agent working through an ISU sees whatever those security groups allow, no matter who is prompting it.

The more telling signal may be Kazmaier’s caveat. If building directly on the MCP server only works for a small set of use cases, the version of headless Workday expects most customers to use is Claude talking to Sana talking to Workday’s own agents, with Workday’s runtime in the middle of every call.

The post Workday goes headless, opening its HR and finance data to outside AI agents appeared first on The New Stack.

Real repositories, seeded agent decisions: what 50,400 runs show about wasted turns, patch churn, and which harness rules help

The post Coding Agents Can Solve the Task — But How Much Work Did They Waste? appeared first on Towards Data Science.

One of the core promises of AI is that the more it knows about a person, the better it will be able to assist them with tasks and make appropriate suggestions, which, if you'll believe the tech companies, requires apps and devices to listen, watch, or record users' activity all the time and gather all possible context.

Re-reading my own IBM patent on real-time concert feedback as what it actually was: an agentic loop with multimodal perception, memory-grounded inference, and a human in the loop. What it got right, and what a decade of hindsight teaches agent builders today.

The post We Specified an AI Agent in 2016. We Called It Analytics. appeared first on Towards Data Science.

Teams of AI agents barely outperform solo agents but cost up to 5.1x more, according to Vals AI. Only one out of four tests with GPT-6 Sol and Claude Opus 5.5 showed a measurable gain. Anthropic's own data backs this up: beyond ten agents, quality plateaus while token costs keep climbing.

The article AI agent teams waste massive tokens for barely measurable quality gains, research finds appeared first on The Decoder.

Add architectural guardrails around how agents read untrusted sources and use them in the workflow.

The post How Can AI Agents Read Untrusted Sources Safely? appeared first on Towards Data Science.

Amazon says it will stop using NDAs when negotiating data center deals with local governments, following a similar move from Microsoft earlier this year. Secrecy has fueled community backlash against AI infrastructure, with opposition leading to hundreds of proposed and enacted moratoriums from New York to San Francisco. Meanwhile, a wave of startups is betting that consumers will hand AI agents access […]

AI Agents for Beginners, Part 1

The post Build Your First AI Agent with One Tool Call appeared first on Towards Data Science.

AI agents can now write more code than any of us can read. That changed how I think about AI.

The post Stop Using AI. Start Hiring It. appeared first on Towards Data Science.