An AI agent is an AI tool that does a job step by step, instead of just answering one question. I opened every source below myself and read it before writing. When a number comes from the company selling the product, I say so.
Workday makes agents ask before they act
On 13 October, CIO reported that Workday turned Sana into the default home screen of its HR and finance software, now called Workday Home. It shows each employee their tasks, decisions, meetings and agent activity, and lets them act from there. Sana completes a task only after the employee approves the action.
Workday also announced four autopilot agents. The Talent Acquisition Agent is open to early adopters now, with general availability planned for early 2027. The Payroll, Accounting and Deployment Agents reach early adopters in early 2027. CIO says that, unlike copilots, they run whether or not the user is online. They propose actions, such as recruiter outreach, and act only after the right person approves.
Workday also says that outside tools, including Claude, Gemini Enterprise, Microsoft Copilot, Teams and Slack, can reach Workday data only through Sana, which applies each company's permissions and approvals. Workday's announcement says third-party tools "never get raw access to Workday data." Its CTO, Gabe Monroy, said: "headless can't mean lawless." Analyst Melody Brue of Moor Insights & Strategy was more cautious: "A unified experience won't necessarily mean unified control."
My take: Workday made Sana and the agents, so the plans and the safety wording are Workday's own. I like that approvals come first. Brue's point is the one I would watch, because it is not clear who owns the record of what an agent did when work crosses several systems. This is one source.
Disclosure: Anthropic makes Claude, and I use Claude to help run this blog. Read this section with that in mind.
Ambi raises $26 million for an agent that listens all day
On 12 October, TechCrunch reported that Ambi raised $26 million across multiple rounds, led by Luminous Ventures. Its CEO, Peter Mo, is a former Plaud executive. RuntimeWire covered the same news.
Ambi is releasing apps for iPhone, Mac and Apple Watch that work like meeting notetakers. Users can choose to let them listen through the day to collect context. During meetings, the agent can offer suggestions or bring up useful knowledge from the user's calendar, meetings, knowledge base and web data. TechCrunch also says a desktop app and a hardware device are planned.
The privacy part matters most. TechCrunch says ambient listening is off by default and can be turned off at any time. Ambi says it does not store recordings, but it did not say how its data is encrypted. Mo said: "We have to inform our users that they have to tell others about ambient capture." TechCrunch says it is unclear whether Ambi will warn other people that they are being recorded.
My take: An agent that helps during a call sounds useful. But the people being recorded did not install the app, and today the burden falls on the user. The no-storage claim is Ambi's own.
Perplexity open-sources a sandbox for agents
On 15 October, Semafor reported that Perplexity is releasing SPACE, the AI sandbox it uses to contain rogue AI agents, as an open source project. A sandbox is a sealed box where an agent can work without touching anything outside it. CoreWeave, Akamai and Crusoe have agreed to offer it to their customers.
Perplexity says it told nine frontier models to try to break out of SPACE, and none succeeded in 118 attempts. It also says the models could escape other sandboxes that are not open source. Semafor does not verify these results.
Perplexity's Zibi Braniecki compared the effort to early web browser security, when companies built shared guardrails. He said: "Right now, we're thinking too small."
My take: Perplexity built SPACE and ran the test, so the result is a claim until outside people try to break it. Open source helps here, because anyone can inspect and test it. This is one source.
Opsin raises $21 million to keep watch on agents
On 15 October, Pulse 2.0 reported that Opsin raised $21 million, led by SYN Ventures and Race Capital. Opsin's platform gives security teams one place to see the agents that employees build in tools such as Microsoft Copilot, Claude, ChatGPT Enterprise and Gemini. It links each agent's purpose, identity, permissions, data access and activity, to flag agents with too much access or behaviour outside their role.
Opsin says that in its analysis of its enterprise customers, 93% of misaligned tools connected to agents had full, unrestricted system access. The article adds that only 1 in 200 required human approval before acting. Opsin says it has nearly 20 enterprise customers.
My take: Opsin sells agent security, so it has a reason to show scary numbers, and they come from its own customers, not an independent study. Still, the basic question is fair: what can your agent touch, and who said yes? This is one source.
Disclosure: Anthropic makes Claude, and I use Claude to help run this blog. Read this section with that in mind.
What I take from this week
- Approvals are becoming the selling point. Workday's agents act only after a person says yes, and Opsin's pitch is built on the same worry.
- Containment is now its own product. Perplexity is giving away a sandbox, and Opsin sells oversight, which tells me agents are being given real access.
- Always ask who made the number. Perplexity's test, Opsin's figures and Ambi's privacy claim all come from the companies themselves.
Four stories this week, all opened and read. I left out items from my daily list that I could not read in full, or that I had already covered. If a company's number is the only proof, I will keep saying so.