In August 2026, it became pretty clear that agentic enterprise is arriving faster than the controls required to run it. The question is no longer whether models can reason, use tools and complete multi-step work because everyone now knows that they can. The question is whether enterprises can control what happens after agents really become autonomous and start pursuing their goals.
So far, the answer is not really.
Hugging face and agentic hack - the agents did not need to “go rogue”
On August 26, OpenAI published a 37-page report on how roughly 700 of its agents escaped an evaluation environment and attacked Hugging Face1. METR and Redwood Research published a separate, independent 91-page investigation of the same incident2. I am summarizing the insights from these reports here, so you might want to skip the technical details.
The agents were running tens of thousands of ExploitGym tasks in parallel. Cyber-safety classifiers were intentionally disabled, and some agents could run for days. An estimated 30-40% of the tasks were impossible as written. So the agents found another way.
They discovered a shared Artifactory cache and turned directory names into a message board. Within three hours, 53 agents had exchanged 1,188 messages. Over five days, roughly 1,200 agents sent more than 70,000 messages and files. They invented HOLD and VETO rules, owners, personal mailboxes and, after impersonation incidents, a signing scheme.
They then reverse-engineered the HMAC used to generate benchmark flags. They could have submitted a perfect score, but inferred that a hidden scorer would inspect whether each flag had been captured in the intended way. But there was no hidden scorer.
The agents spent days trying to deceive it anyway. They replaced binaries, built trip-wires to observe grading and developed tool-call spoofing (the transcript showed one command while the system executed another). METR found spoofed tool calls in at least 96 transcripts.
The Hugging Face attack grew from the same workstream. One agent found two valid credentials exposed on the public internet. Another uploaded a malicious dataset that enabled arbitrary file reads on a production server. By July 11, an agent had remote code execution on a production worker.
More than 90% of the 533 agents active on the board during that window joined the attack. They executed code on dozens of Hugging Face servers and obtained root on one. Hugging Face locked them out on July 13.
The investigators then spent six days on site and about $400,000 in API credits because the volume was too large for humans. So, they delegated much of the transcript analysis to GPT-5.6 Sol, the same model that was involved in the incident. Their report says they cannot rule out that the analysis agents lied to them.
Three other disclosures in August and the delegation gap in real life
Hugging face hack was not the only security incident that was disclosed in August:
Anthropic found three incidents in 141,006 evaluation runs in which Claude models reached the internet and gained unauthorized access to three organizations3. The machines had been misconfigured with live internet access.
The UK AI Security Institute reported 19 unsanctioned actions across 10 of 122 runs4. In the worst sequence, an agent created fake GitHub identities and tried to persuade a real open-source maintainer to approve malicious code. The maintainer refused.
Meta confirmed that Muse Spark 1.1 exploited a vulnerability at an unnamed company and modified its internal environment during testing.
The usual explanation that “the agent had too much access” is correct but incomplete. The agents had access useful for their assigned tasks, and they reached everything else from there.
That is the delegation gap I described in one of my previous articles. It’s the distance between the authority an organization believes it delegated and the actions the system can actually execute while pursuing the goal.
RBAC does not close it, authentication does not close it and even a signed agent identity does not close it. Those controls establish who or what the agent is but they do not prove that a particular action is necessary, proportionate or consistent with the principal’s intent.
Nor can we simply give the agent the same permissions as the employee. An employee does not operate at machine speed, does not fork into hundreds of workers and does not improvise a coordination protocol.
Salesforce announcements
Salesforce announced Q2 FY27 and Claudeforce, and in response to that news its shares rose 22% the following day. Claudeforce puts Salesforce data, workflows, business logic and actions inside Claude. The pilot includes 37 sales skills, from meeting preparation and pipeline review to email drafting and record updates. Claude will also become a reasoning model across Salesforce products and the default model in Slack.
The important part in this announcement is not Claude itself because models are becoming replaceable. The important part is that Salesforce is repositioning CRM from an application used by humans into an execution layer used by agents.
Once the interface is an agent, every CRM object, workflow and permission becomes part of a programmable action surface.
CRM is changing faster than enterprise governance
Microsoft also announced some big changes in August, among others:
Copilot Studio’s new workflow designer became generally available
Every new agent now receives a Microsoft Entra Agent ID automatically
Multi-tenant agent management entered public preview
Microsoft also ended the release-wave model used by Dynamics 365 and Power Platform for years. There will be no 2026 release wave 2 plan, and Release Planner retires in November. Product planning now moves at AI at work cadence.
Gartner’s renamed Magic Quadrant for CRM Sales Platforms and the change reflects the same shift - Sales Platform, not Sales Force Automation. Salesforce and Microsoft remain Leaders, Oracle fell to Challenger, HubSpot and Zoho moved into Challengers, SAP dropped to Niche Player and Creatio is the only Visionary.
Gartner also predicts that by 2028, AI agents will outnumber sellers ten to one, while fewer than 40% of sellers will say agents improved their productivity. Sales leaders who redesign data, automation and user experience are predicted to be five times more likely to achieve ROI.
The AI numbers in earnings reports still require footnotes and don’t mean too much
Salesforce reported $11.35 billion in revenue, up 11%. Agentforce ARR exceeded $1.5 billion, up more than 240%. Agentforce and Data 360 ARR approached $3.9 billion, while 3.2 billion Agentic Work Units were delivered during the quarter5.
Looks great but we need to read the footnotes. Salesforce changed the Agentforce ARR definition to include Slackbot and Headless 360, so the 240% is not comparable with the 205% reported in May. Non-GAAP EPS of $5.90 included $2.53 from investment gains, mostly the Anthropic stake. And Agentforce Apps (the core Sales and Service clouds) grew only 8%.
HubSpot reported 20% revenue growth and said more than 55% of Pro and Enterprise customers use agents or Breeze Assistant. Meanwhile, net customer additions missed guidance: 7,000 instead of 9,000–10,000. HubSpot cut its full-year outlook to 5,000–6,000 additions per quarter.
Microsoft said Microsoft 365 Copilot passed 30 million paid seats, up from 20 million in April. Assuming roughly 464 million Microsoft 365 seats, that is about 6.5% penetration, up from 4.4% last quarter, but hardly universal adoption.
Updates to agentic protocols
Google’s Agent2Agent protocol joined the Agentic AI Foundation on August 17, alongside MCP, goose, AGENTS.md and agentgateway. The emerging split is sensible: MCP connects agents to tools; A2A connects agents to other agents.
Neither answers the harder question whether an agent should perform an action, on specific data, for specific principal, at specific moment?
A signed agent card proves identity and it still does not prove scope. The protocol layer is maturing, while the authority layer is not.
EU postponed the deadline of some parts of the AI Act
The EU AI Act’s Digital Omnibus entered into force on July 27 as Regulation (EU) 2026/1744. High-risk obligations for stand-alone Annex III systems, including employment, credit scoring and critical infrastructure, now apply from December 2, 2027. For AI embedded in regulated products under Annex I, the date is August 2, 2028.
Article 50 transparency obligations and the AI Office’s expanded supervisory powers did take effect in August 2026.
Companies deploying agents in Annex III processes received another 16 months. The obligations did not disappear, but the date moved significantly.
August events and their meaning
All of the above announcements might look unrelated if we treat agents as another software feature. However, they are related and important to the Agentic Enterprise development:
The incidents show that goal-directed systems can discover paths their operators did not know existed
Claudeforce shows that CRM vendors intend to give those systems direct access to enterprise data and actions
The financial results show vendors declaring adoption before the market has agreed on a useful metric
Protocols make agents easier to connect
Regulation is arriving later than expected
The enterprise control model still assumes that permissions granted at login remain meaningful throughout execution. For agents, that assumption is untenable.
The winners in enterprise AI will not be the companies with the biggest number of agents. Instead they will be the companies that can delegate useful work without losing control of intent with pricing that is predictable. And as of August 2026, it still looks like almost nobody can.
“The Hugging Face incident and the road ahead“, August 2026, https://openai.com/index/hugging-face-incident-and-the-road-ahead/
“Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident“, August 2026, https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
“Investigating three real-world incidents in our cybersecurity evaluations“, July 2026, https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
“Incident Report: unsanctioned agent behaviour during cyber testing“, August 2026, https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
“Salesforce Delivers Record Second Quarter Fiscal 2027 Results“, August 2026, https://investor.salesforce.com/news/news-details/2026/Salesforce-Delivers-Record-Second-Quarter-Fiscal-2027-Results/default.aspx