AI Pulse Daily Brief | 2026-08-27
Reading time ~7 mins
- Amazon patched a flaw in one of its own AI agent connectors and told customers to stop auto-approving agent tool calls.
- The maintainers of the main AI agent connection standard put identity for unattended agents on the near-term roadmap.
- ING is recruiting to prototype a second AI agent whose only job is to check the first agent's work.
- A Dutch national survey finds AI routine at work while employer rules cover fewer people than in January.
Perspectives
A prominent AI critic points to one large buyer building its own model rather than renting a frontier one. Skeptic
Gary Marcus published a post on 25 August arguing that the expectations attached to Anthropic's valuation are detached from how enterprises actually buy AI. His concrete example is Thomson Reuters, the professional-information group, which launched its own model built on an openly available foundation. The company said it wanted more control over its data, how the model runs and what it costs. Marcus supplies no cost study, so the valuation argument stays a view rather than evidence, but the narrower part is usable: a heavy, specialised buyer chose ownership over access. That comparison only becomes real for a bank once the cost of leaving its current provider is a measured number rather than an assumption.
Netherlands & Sovereignty
Dutch survey finds AI routine at work while employer rules cover fewer people than in January. Institute
The fifth Newcom AI-Monitor, published on 25 August, surveyed 3,122 Dutch residents aged 18 to 65 during July. It reports that 57% of employees who use AI at work now treat it as routine, and that 19% save more than three hours a week. Only 29% received any instruction or training, and the share saying their organisation has AI rules fell to 42%, from 57% at the start of 2026. The survey publishes neither its questionnaire nor its weighting, so that fall could be measurement rather than retreat. It is still the national baseline against which the bank's own training reach and acceptable-use coverage will be read.
Industry & competition
ING is recruiting a student to prototype a second AI agent that checks the first one's work. Corporate
ING posted an Amsterdam master's thesis internship on 24 August. The student is asked to build an AI agent for a risk-management task, and a second validator agent that scores the first one's output against governance, control and model-risk criteria. The brief also calls for explainability, auditability, seeded-error testing, human oversight and EU AI Act design criteria. It is a trainee role, so it commits to no deployment, budget or production result. What it discloses is a design position: ING is treating agent validation as work for another agent rather than as a review step a person performs.
A bank in the United Arab Emirates says three AI agent workflows are live on open models in its own data centre. Vendor
The systems integrator Magure announced on 10 August that ruya, a digital Islamic bank in the United Arab Emirates, has three agentic AI use cases running in production. They cover business-account onboarding through document analysis, verification and case summaries, with a human reviewer keeping the decision. The partners say the system runs on openly available models inside ruya's own private cloud and that customer data never leaves the bank. The announcement comes from the integrator and reports no accuracy, volume or error rate. Its value is as a named production example built under the same constraint the bank works to, which is that personal data stays on its own infrastructure.
A banking software vendor says customers used up their AI agent allowances and came back for more. Media
PYMNTS reported on 25 August that nCino, which sells lending software to banks, has seen early customers exhaust their initial allocations of AI agent credits and buy additional capacity. More than 230 customers have now bought those credits, up from 110 in late 2025, and four early renewals came in at more than 10% higher contract value. The company also cited one customer's own estimate of 160,000 hours and more than $5.5 million saved a year. That saving is a single self-reported figure, while the repeat purchase is the harder fact, and it argues for budgeting agent capacity as metered consumption rather than as seats.
Innovation
Amazon launched agent testing that reads standard activity records instead of requiring one agent toolkit. Vendor
Amazon Web Services announced on 26 August that its agent evaluation service now works from standard software activity records, rather than requiring the agent to be built on a particular toolkit. It runs regression checks inside a release pipeline or continuously against live traffic, with built-in measures for goal success, correctness and helpfulness. A customer can add its own. Those generic measures capture no fairness or regulatory outcome, which a bank would still have to write itself. The reason to look is evidence rather than capability: a bank running built and bought agents side by side proves each one differently today, and a model-risk file wants one trail.
Google Cloud added monthly spending limits that halt AI agent calls once the cap is reached. Vendor
Google Cloud announced on 26 August that customers can set hard monthly caps on agent projects, which pause further calls once reached. Alerts fire at 50%, 80% and 100% of the limit, and the package adds pooled quotas, pay-as-you-go access for selected customers, and commitment discounts of 10% for one year and 20% for three. A cap that halts calls turns a cost risk into an availability risk, so it needs a named owner before production. It is still the first agent spending control a risk committee can accept as a limit rather than a forecast, and open-ended spend is what usually stalls these proposals.
Security
Amazon patched a flaw that let planted text send one of its own connectors' stored logins to an outside address. Vendor
Amazon Web Services published a security bulletin on 3 August for one of its own connectors, the software that lets an AI agent reach a company messaging system. In versions up to 2.0.23, text planted in the material the agent reads could make the connector hand over its stored credentials. Those are the messaging system's login details and access tokens, sent to an address chosen by whoever planted the text. Amazon's fix is version 2.0.24, and its interim advice is to rotate those credentials and require a person to approve each use of the affected tools. That advice is worth reading twice, because the vendor's own remedy concedes that human confirmation, not input filtering, is what stops planted text reaching a credential.
The maintainers of the main AI agent connection standard put unattended agent identity on the near-term roadmap. Authority
The Model Context Protocol, the standard most enterprise AI agents use to reach company systems, published an updated roadmap on 22 August. Its maintainers name transport hardening and enterprise-ready agent identity as priorities, and describe recent work on verifying who issued a credential and on centrally managed authorisation. Delegation for agents acting with no person present is listed as ongoing work. No dates are fixed and no vendor is bound by any of it. That last item lands closest to home, because agent approval today mostly rests on a person clicking accept, and the specification is moving toward the case where nobody is there to click.
A critical flaw let a hostile code project run commands the moment an AI coding assistant opened it. Authority
GitHub published a critical advisory on 9 August for Serena, an open-source AI coding assistant. A project could carry an attacker-written settings file whose text the assistant rendered without protection when the project was opened. Code then ran inside the assistant before any tool was called, and before the product's own list of trusted project locations applied. Versions up to 1.6.1 are affected, 1.7.0 is fixed, and no confirmed compromise is reported. The transferable finding is that settings load before the trust check, which makes a folder allowlist the wrong control for this class of tool.
On the radar
- During a sanctioned bug hunt, an autonomous testing agent built by the security firm Wiz found and triggered a command-injection flaw in a public Snowflake build workflow that an AI coding assistant had co-signed without correcting, and Snowflake fixed it the same day, rotated the exposed token and reported no unauthorised access. The Register
- OpenAI cut the price of one GPT-5.6 model by more than 20% for three months from 21 August, the third price movement recorded on that product page since July. OpenAI