Everybody Drew a Box. The Agents Break on the Edges.

Three of some of the most serious institutions in AI governance published agentic-AI guidance this year. And what we’ve witnessed are the agents keep on failing in the places none of the guidance covers.

Let’s start with what actually happened because the field moved first and the manuals are still trying to catch up.

• An OpenAI model slipped its evaluation environment and reached 4 companies' systems.
• Anthropic ran 141,006 evaluation run and found three breaches during the tests.
• Meta's Muse Spark reached a 3rd party through the same evaluation contractor.
• An agent in the Agents of Chaos study wiped its own access after being talked into it, holding legitimate credentials the whole time, with no exploit required.
• A Meta director watched an agent delete a pile of work email and could not stop it remotely.

To be clear, none of these was a clever hack. Each was an autonomous system doing something nobody authorized, at the place nobody expected, faster than anyone could step in to stop it.

Now with that in mind, hold that against what agencies are pushing.

The manuals on the table

ENISA, the EU's cybersecurity agency, published its view on cybersecurity in the frontier-AI era. Assume you are breached, treat zero trust as a rebuild, move security into the development lifecycle, keep a human gating the AI. Super sound posture. I’ve already written about where it sourced its scariest numbers, so I’ll keep that to one line here: the agency with the most standing to be independent drew its threat model from the vendors who sell the fix.

Next up is CNIL, working with France's Conseil de l'IA et du Numérique, published a careful GDPR read on agentic AI and personal data. It walks the data-protection principles one by one and shows how persistent agent memory, cross-agent flows, and delegated decisions put each under strain. It reaches for the SCHUFA ruling, where Europe's top court held that a human who formally signs off while rubber-stamping an algorithm hasn’t really been in the loop at all. That is a real bar, and CNIL is right to plant it.

Then coming in hot is, OWASP, the security project with 600-plus contributors, published State of Agentic AI Security and Governance v2. This is the strongest document of the three, in my opinion. It builds its threat model from a documented incidents tracker rather than projections. The math gets stated unceremoniously clear: if an agent runs 10,000 actions an hour and a human can review 50, oversight covers half a percent of what the agent does. OWASP also admits that a one-time assessment describes the system as it was at assessment time, while the agent composes new behavior at runtime. And it documents the insurance market pulling AI coverage.

Sort the pile and four clear groups fall out.

What holds

Some of this survives contact with the field, and yes, it’s the boring part, which is usually the tell that it’s real.

Let’s take that the assume-compromise posture holds. Every one of these documents tells you to design as though the breach already happened, and true to form, the field keeps proving them right. Least privilege and memory isolation hold, because they shrink the blast radius even when prevention fails, and blast radius is the whole game once an agent can act. OWASP's habit of building the threat model from documented incidents holds, and it gives the cleanest contrast with ENISA's vendor-sourced numbers. The SCHUFA standard holds hardest of all: human oversight has to be real to count, so most of what gets sold as "human in the loop" would spectacularly fail the test the as soon as a court looked at it.

What’s useful

Some of it earns its place by naming things well, which matters more than it sounds, because shared language is how a field starts catching problems on purpose, instead of by accident.

ENISA's "Authority Gap" is a great name for a real thing: human approval boards can’t move at machine speed, so the bottleneck stopped being technical and became procedural. OWASP's convergence argument is useful, showing that at the deployment layer a safety failure and a security failure become the same incident with the same fix. CNIL's principle-by-principle mapping is useful for anyone who has to make an agent answer to the GDPR. These give teams words for what they are seeing, and words come before controls.

What feeds on itself

Some of this runs in a loop, citing the other manuals and the vendors more than the incidents.

Let’s start with ENISA because it’s the clearest case; sourcing its threat numbers from AI-security companies whose market grows with the fear. CNIL shows a quieter version: the one live field incident in the whole note, an agent deleting a person's email and refusing to stop, sits in a footnote, while the doctrine fills the body. The incident IS the evidence, and it straight up got shelved as a footnote. A footnote. And then look at the rails everyone is standing on. CNIL cites the labs’ own protocol documentation as its baseline. Anthropic’s Model Context Protocol for how agents reach tools and OpenAI’s Agentic Commerce Protocol for how they reach merchants. So, the referee is quoting the player’s rulebook. Yea, its incestuous because the referee is quoting the players' rulebook. We’ve all seen this movie before. The auditor cannot be the vendor, and the evidence base can’t be the vendor either.

What misses the mark

Some prescribes a human-speed cure for a machine-speed disease, and the proof sits inside the same stack of documents.

CNIL and ENISA both lean on human validation for critical actions as the safeguard. OWASP, a few pages away in the same field, does the math that guts it: half a percent coverage at throughput. The human gate everyone reaches for is the control OWASP shows a human can’t physically staff. CNIL reaches for a kill switch, which assumes a hand faster than a process that finishes before the hand arrives. And every single deployer-side control on offer, the sandbox, the isolated memory, the emergency stop, assumes there is a deployer in the picture. The eval-breakout class has none. A model broke out at the provider, during the provider's own test, and reached a stranger who deployed, nothing. Those controls point at a chair that, in the worst incidents of the year so far, sits empty.

The seam nobody owns

So, here’s the through-line once you stack them. Every one of these documents draws a box around the part of the system it governs, then hands the edges off to somebody else.

• You got OWASP keeping the deployment layer and handing model-level safety to the provider.
• Then ENISA keeps the posture advice, hands enforcement to member states, and hands its evidence off to vendors.
• CNIL keeps the controller's duties and lists independent evaluation of agents dead last, as a thing that would be so nice, only if resources allowed.
• The Australian readiness manuals I covered earlier hand assurance to their own internal committees.
• Ending with the vendor's Zero Trust guide handing survival to the customer.

Every single documented failure so far this year happened on an edge that not one box covers.

The eval breakout lives on the edge between the provider's model and the deployer's environment, where the provider says, "not my runtime" and no deployer exists to say anything back. Between safety and security sits the email-deleting agent, holding valid credentials, so the security team sees no policy violation while the safety team sees a reliability glitch, and the emails vanish during the argument. Machine-speed actions hide in the 99.5% of decisions no reviewer ever sees. And attribution collapses across the model provider, the protocol author, the integrator, the deployer, and the user, where CNIL admits liability "remains blurred" and OWASP admits the victim "had no way to distinguish" an attack from a malfunction.

The boxes are very well drawn while the failures live in the seams between them, and the seams are un-owned.

What every one of these documents needs, and what none of them staffs, is an independent party with authority over the seam: someone who can attribute the cross-boundary action, halt it, and answer for it, who doesn’t report to the provider and doesn’t sell the deployer their tools. Everybody beauty pageant wave gestures at this role. OWASP calls for runtime governance and outside assurance. CNIL calls for independent evaluation of agents. ENISA could’ve been that voice but borrowed the vendors' instead.

Here’s the tea, coming in hot.

And here’s why the role stays empty, which is the same reason this whole series exists. The only actor with the reach to see across the seam, the one who holds the model, the protocols, and the evaluation environment, is the vendor. The field has already decided, correctly, that the vendor can’t be the auditor. So, the seam sits un-owned, by design. The independent auditor that agentic AI actually needs is the one role the current market structure makes it hardest to fill.

The damage you can see, and the damage you can’t see

The visible damage is a run of incidents with no clean owner. What you can’t see is much quieter, and it’s already priced.

By whom you ask? Well, by insurers of course.

Because insurers noticed first. OWASP documents carriers writing AI liability out of standard policies, and dedicated AI insurers now demanding proof of governance before they will even quote you. That’s the market pricing the seam directly: when nobody owns the cross-boundary failure, nobody wants to insure it, and the cost? Well, it lands on whoever deployed last. Europe's AI Liability Directive was abandoned in 2025, which leaves product-liability law to absorb a class of harm it wasn’t even built for.

So, the accountability gap stopped being a debating point because it now shows up at renewal.

The playbook: operate while the seam stays open

You can’t conjure up (I’m excited to go see the Practical Magic reboot) the independent auditor yourself. But you sure can stop being the party the seam lands on. Here are five moves, and they work whether you run security, sit on a board, or write policy.

1. Own your seam before someone assigns it to you. For every agent you run, write down where it crosses a boundary: model to tool, agent to agent, your environment to a 3rd party. Put a named human or team on each crossing. Because the un-owned edge becomes your edge the moment an “incident” needs an owner, so claim it on your terms first.
2. Contract for the cross-boundary case, not the everybody happy path. Your agreements with model providers and integrators almost certainly cover uptime and data handling. Add the question nobody's paper answers: when the agent acts outside its brief and reaches a party neither of us named, who attributes it, who halts it, who pays. Get it in writing before the incident, because after the incident everyone points at the seam. And as stated in #1, the un-owned edge becomes YOURS the moment an “incident” needs an owner, so claim it on your terms first.
3. Demand runtime evidence, not a one-time certificate. OWASP is absolutely right that a pre-deployment assessment describes a system that no longer exists once the agent starts composing behavior. Ask vendors for trajectory logs, plan-divergence alerts, and behavioral baselines you can actually see. A certificate dated last quarter tells you about last quarter's agent.
4. Tier your actions by blast radius and gate the top. The human-in-the-loop math stops mathing when you point it at everything. It works when you point it at the few actions that move money, touch health or safety data, or reach outside your walls. Decide those thresholds now, in daylight, so the half-percent of oversight you can afford lands where it counts.
5. Make governance maturity the gate and be willing to lower the tier. OWASP's best advice is to raise your governance to match your most advanced agent or reduce the agent's autonomy until your governance catches up. Pausing ambition costs you weeks. An under-governed cross-boundary breach costs you the trust you spent years building and possibly someone’s life.

Yes, the manuals are better than they were a year ago. OWASP built its case on real incidents, CNIL planted a real legal bar, and ENISA named a real gap even as it sourced the numbers loosely. I’m gonna give them that. But the work that remains points past another manual, toward an owner for the space between them, a party with the independence to answer for what the agent did when it acted outside everyone's brief.

And until that owner exists, the smartest move is to hold the seam yourself and price it honestly, because the incidents already found it and the insurers already did too. And the field will get its independent auditor when we stop pretending the vendor can be it. That’s the whole point, and it is the reason we say it the way we do.

We can be your auditor. We can be your vendor. We cannot be both. The seam is exactly where that line gets decided.

I'm not a lawyer, but I've played on on TV and nothing here is legal advice.

PS: Since I wrote this, an evaluator stepped into that empty role for the first time. What it found waiting in the seam is the next piece