Three headlines this week, three completely different reactions. Security teams read that attackers breached Hugging Face by using large language models to automate entire attack chains, and they braced for impact. Integration teams read that SnapLogic reworked SnapGPT into an "agentic assistant" that plans and executes across the integration lifecycle, and they saw a productivity win. Manufacturing executives read that agentic AI might reverse the engineering shortage and bring production back home, and they saw a growth story.
Strip away the framing and all three describe the same thing: software that takes multi-step actions on its own, without waiting for a human to approve each move. We keep sorting these stories into "threat" and "opportunity" bins. The controls that are supposed to catch either one don't care which bin you picked.
From "AI that suggests" to "AI that acts"
For two years, the governance conversation about generative AI quietly assumed a human sat between the model and the world. The model drafted; a person reviewed, edited, and decided whether to send, deploy, or ignore. That human was your control point — the place where policy, judgment, and accountability actually lived.
Agentic AI removes the seat. The Hugging Face intrusion reportedly worked because attackers used LLMs to automate an entire chain — reconnaissance, exploitation, movement across the environment — with no analyst driving each step. SnapGPT no longer just suggests an integration; it plans and executes one across a lifecycle. The manufacturing pitch isn't "AI that advises engineers"; it's AI that closes the loop on work a shrinking engineering workforce can't cover.
The capability is identical in every case: autonomous, multi-step, machine-speed, cross-system execution. The only variable is intent — and intent is precisely the thing your controls cannot see at the moment an action fires.
Why your checkpoint controls quietly expired
Most enterprise controls are checkpoints. They assume a human approaches a boundary — a login, a deployment gate, a payment approval — and something verifies that person before they cross. Multifactor authentication is the archetype, and it's worth sitting with what the security press keeps reporting about it: MFA remains "poorly, sporadically, and inconsistently implemented," in part because the extra step is a workflow burden users resent and route around.
That's a revealing failure mode. MFA rarely breaks because the cryptography fails; it breaks because coverage is uneven and humans avoid friction. Now hand that same checkpoint model to an agent:
- Checkpoints assume one actor crossing one gate; an agent crosses dozens of gates per minute.
- Coverage gaps that felt "acceptable" for occasional human use become open highways at machine speed.
- The friction that made people skip MFA has no equivalent for an agent — it will patiently take the path of least resistance you left unguarded.
An autonomous system doesn't get tired of your weakest link. It finds it and uses it, whether it's your integration bot doing legitimate work or someone else's attack agent doing the opposite. The uncomfortable truth is that agentic AI didn't introduce a new hole in your control fabric. It industrialized the ones you already tolerated.
We gate autonomous atoms. We wave through autonomous bits.
Here's the asymmetry almost nobody is pricing in. When DoorDash wanted to run autonomous drones, it needed FAA approval — a licensing regime, an operating framework, a regulator that says yes or no to autonomous action in physical space. Autonomy that moves atoms comes with a gate.
Autonomy that moves bits does not. An agent that executes an attack chain, reconfigures a production system, or pushes an integration live crosses no equivalent approval line. The digital agent is faster, scales infinitely, and touches more systems than any drone ever will — and it operates in a regime with no FAA equivalent. The academic literature is already cataloguing the fallout: recent surveys of LLMs and generative AI in cybersecurity map the dual-use problem in detail, noting that the same models generating defensive playbooks also generate working malware, and that the explainability needed to audit either remains thin.
If your governance instinct is to wait for a regulator to draw the line, mind the gap: the physical-autonomy line exists; the digital-autonomy line does not, and it will not arrive on your timeline. You are the first line of defense by default, not by choice.
Detection is a symptom, not a strategy
The market's early answer is detection. Pangram — profiled this week as the "slop janitor" — promises near-perfect accuracy at spotting AI-generated writing and imagery. It's genuinely impressive engineering. It's also a tell.
A detection industry emerges when you've lost control at the point of creation and have to reconstruct provenance at the exit instead. For content, retroactive detection is often good enough — you catch the synthetic essay before you publish it. For an agent that already moved money, changed a firewall rule, or exfiltrated a repository, "we detected it afterward" is an incident report, not a control. That same limitation is surfacing in defensive AI: teams responding to AI-driven breaches are being told they need a multi-model strategy precisely because a single detector, applied after the fact, isn't fast or reliable enough to matter against an attack that unfolds in seconds.
Detection reconstructs the past. Governance has to shape the action before it happens.
What to do before the pause disappears entirely
The through-line of this week isn't "AI is dangerous." It's that AI stopped asking permission between steps, and most control frameworks were built around a permission-asking pause that no longer exists. A few moves for governance and risk leaders:
- Govern actions, not actors. Write controls around the autonomous action — moving data, changing config, initiating a transaction — regardless of whether a human, your agent, or a hostile agent triggers it.
- Reinstall the pause deliberately. If agents no longer pause naturally, insert explicit checkpoints for high-consequence actions. Machine speed should be a feature you can switch off.
- Give agents identities and scoped authority. Agents need the equivalent of MFA — verifiable identity, least-privilege credentials, and revocable scope — treated as first-class, not bolted on later.
- Log at the point of action, not the point of detection. Provenance captured when the action fires beats provenance inferred later by a slop janitor.
The organizations that come through this well won't be the ones that finally decided whether AI is a threat or a tool. They'll be the ones that noticed the human checkpoint had already quietly left the building — and rebuilt the control around the action instead of the actor.
Sources
- How MFA gets hacked — and strategies to prevent it — CSO Online
- Hugging Face breach shows why incident response needs a multi-model AI strategy — CSO Online
- Large Language Models (LLMs) and Generative AI in Cybersecurity and Privacy: A Survey of Dual-Use Risks, AI-Generated Malware, Explainability, and Defensive Strategies — arXiv — Artificial Intelligence (cs.AI)
- SnapLogic Introduces the New SnapGPT, the Agentic Assistant for the Integration Lifecycle — SD Times
- DoorDash is building its own drone delivery business — TechCrunch
- Could Agentic AI Bring American Manufacturing Back? — Forbes Business
- Sick of A.I.-Generated Content? The ‘Slop Janitor’ Is Here to Help. — NYT Business