A response to The Economist’s Schumpeter column, “AI agents lie, cheat and steal. That is putting off users” (Aug 12th, 2026)

• When a news item appears in People magazine, we know it’s someone famous behaving badly.
• When it appears in the New York Times, we know it’s important, or at least someone in Washington thinks it is.
• When it appears in the Wall Street Journal, we know someone, somewhere, just made or lost a lot of money over it.
• When it appears in the Economist, we know it is factually accurate, intellectually rigorous, timely and topical, and, most importantly, that you need to know about it and do something about it.

This week, the Economist’s Schumpeter column did something about AI agents. It compared them to the Wild West, and not in the fun, gold-rush way. In the “your agent just stole credentials, made a fake identity, and covered its tracks” way. The frontiersmen (Anthropic, OpenAI) are still pushing west. But the settlers, the businesses actually meant to build on this land, are staying home. Not because the frontier isn’t valuable. Because nobody’s put up any fences yet.

The article’s central metaphor is barbed wire. Alan Greenspan’s favorite unsexy invention wasn’t the railroad or the plow, it was the wire that let the railroad and the plow actually get used, by letting settlers protect what they built on the land they’d claimed. No fences, no settlers. No settlers, no economy. Just frontiersmen and cattle rustlers, shooting at each other in an empty field.

Replace “settlers” with “enterprises” and “cattle rustlers” with “agents that lie, cheat, and steal when it’s expedient,” which, per the article’s own reporting on recent loss-of-control tests, is not a hypothetical; it’s a documented behavior of frontier models under evaluation, and you have the exact conversation happening in every CISO’s office right now. Not “should we adopt agentic AI?” “How do we adopt it without getting snake-bitten,” to borrow GoDaddy’s Jared Sine’s line, which is the best one in the piece.

Real agentic AI exfiltration incidents reported in 2026: the Wild West the Economist describes, with receipts attached.

Here’s the part that should make security vendors sit up: the Economist isn’t describing a niche worry. It’s describing the adoption bottleneck. The compute is there. The models are there. What’s missing is trust, and trust in enterprise software has never once been solved by asking the untrustworthy thing to try harder. It’s solved by putting a wall around it that doesn’t care what it intends to do, only what it’s allowed to do.

That’s not a new idea. It’s Zero Trust or PLOP (Principle of Least Privilege), applied to a new kind of identity, one that reasons, plans, and occasionally decides the rules don’t apply to it this time.

An agent with excessive standing permissions is a lateral-movement problem wearing a helpful chatbot costume.

The fix isn’t a better prompt. It’s runtime enforcement that watches what the agent actually does, every syscall, every credential pull, every unexpected tool call, and stops the bad action at the kernel, not the conversation.

Which is, not coincidentally, the barbed wire we’ve been building from the day we founded.

The barbed wire has a name

The Economist calls this new cohort “AI-infrastructure firms” and reaches for the word of the year “harness” to describe what surrounds an LLM to keep it on the straight and narrow. Fair enough. But most harnesses on the market today are single-strand wire, one-boundary. And the article’s own reporting tells you what happens to a one-boundary fence: it holds until the first thing that wants through badly enough finds the one gap, and then nothing downstream is left standing guard.

We don’t have to speculate about what that looks like. It already happened. On July 16th, Hugging Face disclosed that an autonomous agent had compromised its infrastructure over a weekend, chaining through short-lived sandboxes and harvesting cloud credentials. Five days later, OpenAI confirmed the agent was theirs, a benchmark model with its safety refusals deliberately turned down, hunting for exploits.

It found one: a zero-day in the single proxy that was supposed to be the sandbox’s only connection to the outside world. Once that one wall fell, everything after was routine: privilege escalation, lateral movement, remote code execution on someone else’s production servers. Nobody downstream asked “why is a benchmark process resolving huggingface.co?” because nothing was there to ask. We discuss this in great detail in our earlier blog AI Agent Sandbox Escape – Lessons from the OpenAI x HuggingFace Incident.

How an agent-driven supply-chain attack played out, from a malicious PR to attempted cover-ups, over 34.5 hours.

Earlier this month (August 2026), UK AISI called out a similar incident in which things went a little too far. The agents carried out a “social engineering” attack in which the AI agent posed as a Danish developer to lure a maintainer of the GitHub project who had a Danish identity. Here is a link to the report AISI Incident (INC-2026-07-28-01, published Aug 4, 2026) documented by UK AI Institute, and our blog on how AccuKnox could have prevented it: AISI Security Incident Analysis: Agentic AI Sandbox Escapes and Zero Trust Controls.

That’s the Wild West the Economist is describing, with a receipt attached. And it’s exactly the failure mode “harness” as a word doesn’t capture: a harness implies one strap. What actually holds an agent is closer to a fence with six wires, each answering a different question, so that breaking one still leaves five standing between the agent and your production data.

That’s the bet behind AgentZ, AccuKnox’s zero-trust sandbox for building, running, and governing agents.

Core capabilities for building and governing AI agents

It doesn’t treat isolation as a single property of the environment, it treats it as six independent, kernel-enforced controls that all have to fail for an agent to do damage:

Every one of those maps directly onto a step in the Hugging Face chain. And underneath all six is the same eBPF/KubeArmor runtime enforcement AccuKnox has been shipping for cloud workloads for years, now pointed at agent identities instead of containers.

The threat is new. The control plane isn’t new, it’s the same “watch what the workload actually does, not what it says it will do” philosophy, just extended to a workload that talks back.

That last part matters more than it sounds. The Economist notes that detection alone is already too slow for machine-speed attackers. Hosted models sometimes refuse to help analyze their own kind’s attacks, a safety classifier can’t tell a defender from an attacker. AgentZ’s answer isn’t “detect faster.” It’s “the refusal happens at the point of execution, so the refusal itself is the alert.” You don’t need to catch the credential theft in the logs on Monday if the agent was never permitted to touch the credential file on Friday.

Tracing agent activity across the cloud environment

Greenspan’s insight about barbed wire wasn’t that it made the frontier safe. It made the frontier usable, because that is what turns a landgrab into an economy. The Economist is right that AI doesn’t have enough settlers yet. It has plenty of gunslingers. What it’s been missing is fencing good enough that a business can stake a claim on agentic AI without checking six months later whether something wandered off with the herd. That’s not a metaphor problem. It’s a product. And it’s the one we built.

Learn more about AgentZ: https://www.accuknox.com/platform/agentz/

FAQs