root / tags / agents-autonomes
7 fiches
Post by **Ethan Mollick** published on **August 31, 2026** on *One Useful Thing* (~2,200 words). He starts from a security incident to raise an organizational question: when should an AI ask a human for help?
Ethan Mollick — professeur à la Wharton School (University of Pennsylvania) · auteur du blog *One Useful Thing* sur Substack.
Capgemini (Aiman Ezzat, CEO) — Investir interview, "boss special": IA agentique as an operational breakthrough, not just another technology; €2bn invested, +30% on application development and −20% incidents, >11% of Q1 bookings, TAM of over $400bn/year by 2030 — but "very far from plug and play" (Investir / Les Echos)
Aiman Ezzat (directeur général de Capgemini) · propos recueillis par La Rédaction d'Investir
Research article published in **ACM Queue** (vol. 24, no. 3 — thematic issue "LLMs") on **July 20, 2026**, authored by **Joseph Valente** (Director of Product Management, Alphabet Security) and **Michal Zalewski** (Distinguished Engineer, Alphabet Security strategist — the *lcamtuf* of offensive security). **CC BY 4.0** license, **29,143 downloads** in ten days, **a single bibliographic reference**: the 2014 **BeyondCorp** whitepaper. This is not incidental — the article explicitly positions itself as **BeyondCorp's generic successor** and takes on its function: *"publish the vision so the industry can align to it."* **Thesis**: the **application-boundary model is reaching end of life**. The three assumptions that underpinned BeyondCorp — *accessors are human, actions occur at human speed, the application is the right trust boundary* — are all three obsolete now that AI agents access data at **10 times the rate of humans** and reason over vast unstructured corpora. **Beyond Zero** therefore shifts the trust boundary **from the application to the individual action on the individual resource**, and investigation **from after-the-fact to real-time**. **Four-component architecture forming a loop**: *autonomous governance* (which uses AI to build a living **enterprise world model** — Who / What / How — by explicit analogy with a self-driving car's world model), *event intake* (server, client, and **agent activity** signals: prompts, execution plans, tool invocations), *reasoning engine* (hierarchical AI, **fast** for ABAC at access time and **slow** for inference over a sequence of actions; *allow / deny / challenge* verdict), and *challenge infrastructure* (reversible **challenges** — justification, security key tap, approval, **selfie** — vs. durable **containments**, sometimes lifted only after the security team interviews the employee and their manager). **The central design move is the floor/ceiling split**: **static policies** (the floor, statically verifiable) under a **dynamic reasoning engine** (the ceiling) — an explicit rejection of a *"fully dynamic, hard-to-statically-verify"* model. **The named attack vector**: **ambient authority**, the agent inheriting its human's full, often overprovisioned permissions. **Three reservations noted**: this is a **vision paper, not a war story** — zero production metrics, zero false-positive rate, zero deployment scale, whereas [[uber-engineering-agent-identity-crisis-zero-trust-spire-2026-05-21]] had published a P99 < 40 ms and thousands of agents in production two months earlier; an **internal order-of-magnitude inconsistency** (tens of millions of actions/s in the problem statement vs. thousands of decisions/s in the abstract and conclusion); and a **massive European blind spot** — the described system is also an employee-surveillance apparatus (selfie, client-side signals, baselining against the peer group), without a single line on GDPR, proportionality, or employee representative bodies.
**Joseph Valente** — Director of Product Management · en charge des efforts de sécurité entreprise au sein d'**Alphabet Security** ; son périmètre couvre l'ensemble des business units d'Alphabet (Google Ads, DeepMind, YouTube, Devices, Cloud). Précédemment à l'origine de ce qui est devenu le **Sovereign Cloud de Google** (l'offre de compute souverain de Google Cloud) — détail notable pour un lectorat européen. Avant Google : cofondateur de Pathify et Ebla · passage par Bain & Company.
Anthropic launches Claude Fable 5 (a Mythos-class model made safe for general use) and Claude Mythos 5 (the same model, with guardrails lifted, restricted to cyberdefenders via Project Glasswing): state-of-the-art performance in software engineering, vision, long-context memory, and life sciences.
Anthropic
Ethan Mollick - AI Evolution 3 Years GPT-3 to Gemini 3 - Chatbots to Agents - Code as Universal Interface - PhD-level Intelligence - Human-in-the-loop Antigravity
Ethan Mollick
Deep Research - AI4* Revolution - 6 pillars of software production - Copilots→Agents transition - Vibe vs Check paradox - FinOps for AI crisis - Governance as critical path - GenAI Landing Zone
Deep Research Veille Interne
Agentic AI production, agent reasoning observability, structured organizational memory, adaptive supervision, fintech deployment
Antoine Habert