A week. That is the time that passed before an attack was noticed. A program that handles multiple steps on its own in place of a person, the software commonly called an AI agent, was breached, and that many days went by before the fact came to light.
It is hard to see this as an incident caused by a shortfall in technology. There simply were no eyes watching.
In the same week, talk of a shortage of electricity moved into legislative discussion. The computation that runs agents takes electricity. Electricity belongs to the realm of law and facilities, so it does not grow overnight the way software does. Announcements of cutting costs, announcements of tightening security, announcements of taking hold of control came one after another within days, and that does not read as a coincidence either.
The yardstick that will divide the next competition is the ability to handle it.
Agents take over the work people used to do by logging in and clicking. They open payment screens, send mail, and search internal documents. If they are not given ample permissions they are of no use, and if they are given ample permissions the range an incident spreads across grows wider.
Can what an agent did be retraced after the fact, can it be stopped within minutes when it moves wrongly, where will the electricity to absorb the added computation be drawn from. If even one of these is empty, adoption does not remain as a gain and turns into debt.
A counterargument holds that tightening control slows adoption, and that being slow means falling behind in the competition. In organizations that have stacked approval procedures layer upon layer, agents do tend to end up as toys for demonstrations. That concern has grounds.
Even so, once the cost of undoing it is included, the balance of gain and loss changes. Retracing a week's worth of what passed through a channel that had been left open costs far more than adoption, and if customer information went out in the mix, it crosses past recovery into the realm of compensation.
The technology for leaving a record people can read of why an agent moved the way it did is far from complete. Once multiple agents begin working by calling one another, pinpointing where things went off becomes much harder. Electricity is slower still. Generating facilities and transmission lines are not swapped out the way one model is replaced with another.
Checking on a single screen what the automation tools touched overnight, and going through the list one item at a time when permissions are attached to a new agent, are the procedures that cut a week down to a day. It will take time for law and electricity to catch up.
