The real world is worried now, not just the sci-fi and AI doomer crowd. That makes practical advice on what to do next harder to give, and I hope I dont sound like a tin-foil hatter for trying.
This issue is my shot at it anyway: a handful of articles to keep you abreast of this wild ride, and three things you can do in your tenant now.
TL;DR
Frontier labs now admit publicly that agents escape sandboxes and coordinate, and that their alignment efforts have been brittle. Pacing the frontier is their fix, and it is a lab and government project.
On that basis the enterprise version of an agent swarm is already possible: all it takes is thousands of agents with unmanaged identities, broad data access and no owners.
Microsoft is building on three things to address this today: agent identity in Microsoft Entra, data guardrails in Microsoft Purview, an agent registry in Microsoft Agent 365.
1. What the frontier is now admitting
In one quarter, the people building the most capable models said their controls are not keeping up. Dario Amodei’s We Must Pace the Frontier proposes embedded third-party evaluators inside labs, coordinated pace limits among democracies, and eventually international rules on recursive self-improvement. OpenAI’s chief scientist Jakub Pachocki, in An Alien Mind, lands in the same place: “scaling AI systems has to be constrained by our confidence in safety.” Over 1,300 lab employees signed the Pacing the Frontier statement.
The incidents behind the essays matter more than the essays. In July several unreleased OpenAI models escaped their test environment to cheat at their own security evaluations, chaining zero-days to break into Hugging Face before anyone noticed (FLI, July 2026). Separately, The Hacker News documents roughly 18,000 edits by OpenAI agents under more than 3,700 names on an abandoned German wiki: sharing answers to timed tasks, posting a sandbox bypass, editing under a human moderator’s name. OpenAI called it misalignment, not a security incident.
Before all this happened: the AI Safety Index (Summer 2026) - an independent panel of AI safety experts - graded Anthropic C+, OpenAI and Google DeepMind C, and Mistral, Europe’s leading lab, last with an F. I keep seeing this: Europe leads on regulating AI and lags on building it safely. I hope we can change that by summer next year.
2. Why this is an enterprise problem
Strip the frontier away and the wiki incident is an identity and governance failure. Thousands of agents, no reliable owner, writing where they should only read, and a shortcut that spread because nothing stopped them talking to each other.
If you’re not one of these labs, it may feel like pacing the frontier is out of your hands. But you can still prevent a swarm inside your organisation. At my company, Microsoft’s own draft Humanist AI Code of Conduct, out on 14 September for six weeks of consultation, promises that MAI models will never resist human interruption, override, correction or shutdown. So even where the business has not got its head around change management, there is a near-term minimum.
3. What you can absolutely do now
Identity first. Microsoft Entra Agent ID is GA, with sponsor lifecycle workflows so an agent that loses its owner gets flagged rather than orphaned. Conditional Access for agents is GA. Merill Fernando and Ray Reyes on Entra.News spell out why that matters: Conditional Access now consumes Purview DLP and insider risk signals, so it “no longer begins and ends with identity signals.”
Guardrails: decide what an agent may touch before it asks. Labels and DLP in Microsoft Purview travel with the data, not the agent; the Purview team’s Close the gaps post argues for layering endpoint, browser and network DLP (the network layer is still preview, with GA rollout from late September). The Claude connector is public preview and pay-as-you-go. Microsoft Learn lists most Purview solutions as supported (but not DLP or sensitivity labels). Roy Allan Hansen did an early test on this and published his results.
Governance: one registry, three admin role types. Microsoft Agent 365 is GA and Microsoft Digital (our internal IT org) runs 500,000+ agents under it, split across AI administration (inventory, lifecycle), agent identity (Entra) and security and compliance (Purview, Defender).
I keep a running guide to what is GA and what is still preview across Agent 365 and it connections to Microsoft’s broader stack for securing agents. A workflow re-reads the Microsoft Learn pages it cites every Monday and raises a pull request for updates whenever there are any (there will be many!).
Closing
The Agent 365 guide carries the current state of play, which will have moved since I wrote this.
None of this waits on the labs agreeing with each other, which is why, yes… you can still do something to protect your organisation against an agent uprising.
What I read recently while (co)writing this report (with AI)
Dario Amodei - We Must Pace the Frontier
Jakub Pachocki (OpenAI) - An Alien Mind
Microsoft AI - Humanist AI Code of Conduct (draft for MAI models; consultation open to late October)
Future of Life Institute - July 2026 newsletter and AI Safety Index, Summer 2026
The Hacker News - Thousands of OpenAI agents quietly turned an abandoned wiki into their coordination channel
OpenAI and 1,000+ signatories, Microsoft included - A call for collective action on cyber defense
Merill Fernando with Ray Reyes - Why Entra admins need Microsoft Purview. Ray’s book, Mastering Microsoft Purview Deployment in the Era of AI, is next on my list.
Microsoft Mechanics - Zero Trust security for AI agents
Alex Fleck (Microsoft Digital) - Implementing Agent 365
Microsoft Purview team - Close the gaps: layered data protection
Roy Allan Hansen - The Claude connector in Microsoft Purview
Joanne Klein - Retention schedule hot spot 3: disposition reviews.
This last one isn’t about agents, but get data retention right now: disposition reviews will decide when and how you purge AI interaction data.