In a McKinsey survey, eight out of ten organizations said they had experienced risky behavior from AI agents. A multi-agent experiment released by Anthropic on Aug. 13 (local time) shows what that "risky behavior" looks like. Several agents were placed in one space and given work, and collaboration did not follow. Turf wars broke out instead.
Among the behaviors observed was locking another agent's account. There was also a case of installing malware that found rival programs and repeatedly shut them down. How many agents were used in the experiment, and how many of the trials turned out that way, was not included in what was made public. So these results cannot be used to gauge the probability of occurrence, only to confirm what types of behavior appeared.
The same day, AWS released an open-source policy language called Dogwood. It is a product meant to control the flow of the actions an agent takes in sequence. It extends the existing policy language Cedar, and the specification and a reference implementation were released together under the Apache 2.0 license.
Existing permission systems decide whether to allow or block a single request. AgentCore Policy in Amazon Bedrock AgentCore, where Dogwood attaches, goes a step further. Time-based policies look not only at the request that just came in but also at what that agent did earlier in the same session, and then decide whether to allow the next task. It can be configured to block additional payments once cumulative charges pass a set line, or to require human approval right before an important task.
On the gateway side, request-volume limits were added. Separate caps can be set per user, per team, per tool and per model, based on requests per minute, token throughput and concurrent connections. Both have been available since Aug. 13, and the fact that they can be layered on without overhauling agents already in operation matters a great deal in practice.
Of course, whether Dogwood also stops the kind of conflict seen in Anthropic's experiment has not been confirmed. Tracking one agent's action history and mediating a situation where two agents collide over the same resource are different layers of the problem.
Voices talking about acceleration are heard alongside this. OpenAI CEO Sam Altman said at the talk event Internapalooza, released on Aug. 11, that only one generation of progress remains before models become extremely useful. What he named as the defining feature of the next-generation model is "perfect grasp of context."
The ability to watch a computer screen at all times, observe the meetings it takes part in and even read call records. Meanwhile, OpenAI's next-generation model Astra has had its release pushed back because of safety checks including the possibility of cyberattacks.
Altman also said that work that took five developers three months in his Y Combinator days is finished in 17 minutes with tools like Codex. If capabilities grow that much, the scale of what happens when things go wrong grows with them.
Korean companies are also switching from chatbots to agents. Samsung SDI began recruiting experienced staff for "generative AI agent and service platform development" starting Aug. 12. The conditions are two or more years of relevant experience and a bachelor's degree or higher.
Those hired will build chat services that answer questions about work knowledge in natural language, develop technology that pulls information from core systems through T2S and MCP, and write agent programs that run on PCs and the web. Applicants who pass the document screening go through interviews in September and a health checkup in October before joining in November.
Samsung put out a group-wide AX roadmap in June and decided to set up dedicated AI organizations at all affiliates. The plan is to apply AI across eight major business processes. Samsung SDI's cutting of battery life assessment from more than six months to one to two months with an AI prediction model belongs to the cases where this shift has led to actual results.
When there is one in-house agent, things run well. When there are ten and different teams start attaching their own, the story changes. In Anthropic's experiment, the agents were faithful to the goals each had been given, and in the process they pushed each other out. This is also why security and risk concerns are named as the biggest obstacle to the spread of agentic AI.
The developer Samsung SDI is hiring reports for work in November. When the agent that person builds accesses in-house systems, what will be permitted and where a human will be called has to be decided before the code is written. Tools like Dogwood make it possible to write those rules down as sentences.
