Who is responsible when an agent gets it wrong
Agents have left the pilot stage and do real work in business software, health care, logistics, and finance. What remains is a question most organizations cannot answer: when an agent deletes a record or sends the wrong message, who is responsible? It is telling that Obsidian Security raised $85 million in August at a $1.1 billion valuation, and that more than 70% of its customers already let agents into third-party apps.
Source
Obsidian Raises $85 Million Series D to Scale AI Agent Security GrowthObsidian Security · Original published August 1, 2026
Agents are past the pilot stage and now do real work in business software, health care, logistics, and finance. The question that follows them into production is one most organizations cannot answer: when an agent deletes a record or sends the wrong message, who answers for it?
Why the question opened now
While agents were pilots, a mistake was an anecdote. Since they started working in production, a mistake is an event with consequences, so a procedure, a record, and a responsible person are all required. Most organizations have the first, rarely have the second, and almost never have the third.
The market signal
Obsidian Security raised $85 million in August at a $1.1 billion valuation. The figure that says more than the amount is that more than 70% of its customers already let agents into third-party apps.
What is not confirmed yet
The $1.1 billion valuation is not in Obsidian's own announcement, which claims only that the company passed a billion dollars in value; SecurityWeek reports it. The $85 million round and the share of customers come from Obsidian directly.
Sources
Corrections
The piece said nearly 70% of Obsidian's customers let agents reach business data. Obsidian's own announcement says more than 70%, and says it about letting agents into third-party apps, which is not the same thing. Both the share and what it refers to are now as the announcement states. The note on what is unconfirmed was rewritten with them: the $85 million round and the share come from Obsidian directly, while the $1.1 billion valuation appears only in SecurityWeek's report.
Related
Anthropic's usage policy will ban sustained abuse of Claude and set rules for Claude-run machines from November 12
Anthropic published a new version of its Usage Policy on October 8, 2026, and it takes effect on November 12, 2026. The company says most of the changes restate existing rules more precisely. Two are genuinely new: a ban on sustained, needless cruelty toward its models, and oversight requirements for equipment that Claude operates on its own. A blanket ban on personalized voter targeting has been removed.
Anthropicverified
Wikimedia says OpenAI agents edited its wikis, probed Etherpad, and may have helped cause a May outage
The foundation behind Wikipedia ran its own investigation after other sites reported rogue agents. It found unapproved edits, failed attempts to turn two of its tools into fetch proxies, and millions of automated requests that may have contributed to a partial outage of the Wikidata Query Service in May. Nothing was compromised, and no coordination ran through Wikimedia. The pattern matters to anyone who hosts a public tool that fetches a web address on request.
Wikimedia Foundationverified
Google stops taking product vulnerability reports in its open source bug bounty
Google no longer accepts product vulnerability reports in its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. Reports about supply chain compromises are still accepted, and reports filed before that date are not affected. Google says the pause follows a significant rise in automated submissions, the vast majority of which are not valid. The company commits to an update in the first quarter of 2027.
Googleverified