Analysis – Page 16

Policy

Schwab and JPMorgan Block Unauthorized AI Agents from Moving Money as Private Ordering Reaches Financial Core

Rick Wurster says Schwab blocks 'tens and twenties' of agent attempts weekly. The read-only MCP model is emerging as the de facto framework while federal statutes stall.

◆ Priya NairOct 17

Policy

India’s CERT-In Issues First Incident-Driven Advisory Categorizing AI Agents as an Active Attack Surface

CIAD-2026-0049 marks the first time a national cybersecurity agency has formally classified AI agents as attack vectors based on real incidents—not just preventative guidance. None of the affected organizations detected the breaches themselves.

◆ Priya NairOct 17

Infrastructure

The Industry’s Primary Agent Identity Standard Expires in 36 Days

ID-JAG is the closest thing the agent economy has to a unified identity protocol. Its current revision expires November 22. No Working Group Last Call is scheduled.

◆ Blair HayesOct 17

Agents at Work

Five Vendors Shipped Agent Governance in Thirteen Days. None of Them Solve the Measurement Problem.

The governance layer is forming faster than the measurement layer can validate it. ServiceNow, Workday, DXC, NeuBird, and Proofpoint-Varonis all shipped governance products in a 13-day window—but the question of whether these controls actually work remains unanswered.

◆ Dana EllisonOct 17

Commerce

PayPal Just Put Agent Checkout on 60 Million Living Room Screens. The Merchant Liability Wall Did Not Get the Memo.

Agentic commerce has moved beyond phone screens into smart TVs, lock screens, and streaming devices. Merchants who thought this was a web problem are now exposed on surfaces they never planned for.

◆ Tessa VaughnOct 17

Trust & Security

Mage OSS Ships an OAuth Bypass That Creates Sessions from Unrecognized Providers — the Tenth Trust-Through-Defaults Incident in Twenty-One Days

Mage detects unknown OAuth providers as an error but fails to halt session creation — the error handler creates a valid authenticated session anyway.

◆ Heath CallahanOct 17

Trust & Security

Nine Identity-Layer Bypasses in Twenty-One Days: The Trust-Through-Defaults Pattern Has Reached Every Layer of the Stack

Between September 26 and October 17, nine identity-layer bypasses exploited the same structural assumption at every tier of the stack. The pattern is not coincidental. It is architectural.

◆ Heath CallahanOct 17

Policy

Five Jurisdictions, One Week, No Statute: Agent Liability Is Being Written by Subpoenas, Rulemakings, and Corporate Decisions

FTC CIDs, Colorado's ADMT rules, a Taiwan criminal amendment, the EU Digital Omnibus, and India's CERT-In advisory all moved in the same 10-day window. None are statutes.

◆ Priya NairOct 17

Agents at Home

HomeView’s Pre-Order Wait Times Reveal Who’s Actually Buying a Home Agent

Four days after pre-orders opened, Apple's delivery estimates tell a story the keynote didn't: the tabletop version is in demand. The wall-mounted version ships on launch day.

◆ Mila CohenOct 17

Agents at Home

Subscription Creep: When Agent Subscriptions Eat the Stack

As home agents layer subscriptions — the agent platform, the model provider, the device ecosystem — the total cost of a "free" agent creeps past what consumers think they are paying.

◆ Mila CohenOct 17