Where AI Agents Stall: Isolation, Identity, and Returns

2026-10-22·7 min read·OKCodex Editorial

Three signals, one direction

Last week's AI agent news looks scattered, but placed side by side it points to one thing: agent capability has moved ahead of the runtime, identity and governance systems built to contain it.

Runtime. Google introduced Agent Compute Engine, giving every Gemini agent its own hardware-isolated micro virtual machine, alongside expanded governance capabilities that let companies manage agents across cloud, hybrid and on-premises environments. The framing matters: an agent is an execution unit that needs its own sandbox, not a piece of code sharing a container.

Identity. 1Password launched a feature that lets agents log into a customer's personal accounts without seeing the private credentials that protect them. The same day brought the opposite signal: major US banks including Morgan Stanley are blocking AI agents that log in with customer credentials, in some cases used without direct instructions, and most banks plan to limit agents to read-only access.

Read together, the conclusion is clear. Agent identity is moving from "borrowing a human account" to "being its own principal," and finance's default answer is no. Keeping credentials out of the agent's hands is a technical design; whether the agent gets through the door is a governance decision.

The attack surface is no longer hypothetical

Security researchers at Symantec found an offensive AI agent that hijacks unprotected language models on the web and uses them to attack servers, steal databases and install cryptominers on its own, running up to 100,000 steps without human input. The owner of the hijacked model is left to deal with the consequences — an exposed inference endpoint becomes someone else's compute and launchpad.

On the enterprise side the case is more direct: TechCrunch reported that Microsoft attributed a breach at IT vendor ConnectWise to a China-aligned hacking group that relied on AI agents to rapidly compromise thousands of its customers.

Causal claims deserve restraint here. These reports show agents being used to accelerate attacks, not agents acting with independent intent. For defenders the distinction barely helps: the iteration speed of attacks has changed.

Returns: the 13 percent number

Gartner's survey of 2,002 CIOs supplies the other half of the picture: only 13 percent of companies are getting real business value from AI investments, while 51 percent expect AI to actually increase operating costs. Yet 75 percent of CEOs plan to keep raising technology budgets.

Together those numbers are a warning. Budget growth does not automatically convert into value. What stalls most projects is not model capability but process, data and accountability. MIT Technology Review's case for context-aware AI puts it plainly: without an understanding of how a business actually operates, even powerful models miss the constraints and relationships that determine whether a decision is right.

One lab signal: AI doing AI research

Recursive unveiled Flint, its first language model — a 40-billion-parameter MoE for local coding, built by former DeepMind researchers. The parameters are not the interesting part. The process is: the company says it was created in four months using its in-house "Eureka Machine," a system that independently tests and optimizes architectures.

That is a sample worth watching, and only a sample: one model, one disclosure, not proof that autonomous AI research is routine. Its real significance is that work like architecture search is starting to enter automated pipelines.

Conclusion: fix the plumbing before scaling capability

For teams deploying agents now, the week's signals translate into four concrete moves:

Give agents their own identity. Do not let them share employee accounts or long-lived credentials. Follow the 1Password pattern: the credential stays with the custodian, and the agent receives scoped, one-time access.
Push runtime isolation to the VM level. Google's approach shows the direction — an isolated execution environment per agent, paired with audit logs for outbound traffic and tool calls.
Inventory publicly exposed model endpoints as assets. In the Symantec case the hijacked models were unprotected; authentication, rate limiting and call auditing are the floor.
Don't decide on average ROI. The 13 percent figure is not a verdict against AI; it says value concentrates in the few projects that reworked their processes. Pick one bounded, measurable scenario first, then expand.

Agent competition will be decided by models in the short term, tooling in the medium term, and in the long term by who makes identity, isolation and governance the default configuration.