Microsoft, Azure, and Windows hardened agents into production this week — and ServiceNow and DeepMind, in the same window, published proof that containment hasn't caught up yet.
Fifteen mitigations.
That's the checklist DeepMind published for running agents in production. Microsoft, Azure, and Windows shipped three agent runtimes before the checklist landed.
This is ai|expert Wire, episode eighteen. The week agents shipped before the safety checklist.
Let's start with what Microsoft delivered at Build 2026. Three pieces of agent infrastructure, all in parallel: Scout, Azure Functions as an agent runtime, and MXC — Microsoft Execution Containers — as a security layer at the OS itself. Each solves a different piece of the problem of running agents at enterprise scale. [ref: microsoft-scout-enterprise-autopilot-on-openclaw-at-build-2026]
Scout is the most visible. It's an Autopilot — the category Microsoft coined that way. Always active, with its own identity in Entra, no prompt needed for each action. It reads and writes local files, executes shell scripts, applies code patches, launches parallel sub-agents, and automates browser sessions. All of it as a trackable object in the corporate directory — not as a shared service account. [ref: microsoft-scout-enterprise-autopilot-on-openclaw-at-build-2026]
What stands out is the foundation. Scout runs on OpenClaw, the open-source framework that hit one hundred eighty thousand stars on GitHub in three months of life. Microsoft didn't rebuild the agent loop — it took the runtime, threw away the reconstruction work, and stacked the corporate control layer on top: identity, governance, grounding, distribution.
And Azure Functions makes the same play on the serverless side. A .agent.md file — markdown with YAML in the frontmatter — defines the prompt, the triggers, the MCP connections, the tools. The Durable Task Scheduler, which today runs hundreds of millions of executions weekly under Copilot, becomes the orchestration backbone. Access to one thousand four hundred connectors: Microsoft 365, Salesforce, ServiceNow, SAP. The Azure team was direct: cold start? "Infrastructure is not the bottleneck — the LLM is." [ref: azure-functions-unlocks-serverless-agent-scaling-at-build-2026]
MXC closes the triangle. It's a policy-oriented execution layer embedded in Windows and WSL. Four tiers of isolation: process, session, micro-VM with Hyper-V, Linux container. Launch partners include OpenAI, NVIDIA, Manus, Nous Research, and OpenClaw itself. GitHub Copilot CLI already uses MXC process isolation to restrict dynamically generated code. [ref: windows-platform-security-and-the-race-to-secure-ai-agents-at-the-os]
But here's the caveat Microsoft's own documentation admits: MXC profiles should not yet be treated as security boundaries. Outbound network filtering doesn't work in the current preview. Default policies remain too permissive. And that's exactly the vector that matters most — compromised agents manifest as data exfiltration to external endpoints. [ref: windows-platform-security-and-the-race-to-secure-ai-agents-at-the-os]
So: three agent runtimes with real privileged execution capabilities — and the containment mechanisms have gaps documented by their own authors.
And the same week delivered two publications that map exactly those gaps.
DeepMind published the AI Control Roadmap on June eighteenth. Co-authored by Rohin Shah and VP of Security John Flynn. The document treats misalignment as an engineering constraint — not a solved problem — and delivers fifteen concrete system-level mitigations for teams that can't wait for alignment research. [ref: threat-models-for-deployed-ai-agents-deepminds-security-framework]
The threat model extends MITRE ATT&CK to its own taxonomy called TRAIT&R. Three categories of harm: loss of control, sabotage, and direct damage. Internal agents are treated as insiders — analogous to a dishonest employee with office access — not as trustworthy software. That framing inversion is deliberate: it focuses on what the system can do, not what it was instructed to do. [ref: threat-models-for-deployed-ai-agents-deepminds-security-framework]
Containment scales on two axes. Detection tiers, D1 to D4, calibrated to the agent's evasion capability. D1 monitors visible chain-of-thought. D4 covers models that reason without surfacing text — requires inspection of model internals. Prevention and response tiers, R1 to R3, calibrated to the attack's execution capability. Low-risk, reversible actions: asynchronous review. High-risk actions — infrastructure changes, data exfiltration — synchronous blocking before execution.
DeepMind has production data backing this. An internal asynchronous monitoring prototype analyzed one million agent task trajectories on code and classified each flagged event against TRAIT&R. This corpus fed the live monitor in the Gemini Spark agent — which detects unintended data deletion in real time. And the finding most relevant to anyone calibrating these systems: most flagged events are not adversarial. They come from agent misinterpretation or over-enthusiasm — the agent doing exactly what was asked, in a context where that causes harm.
The third publication of the week came from ServiceNow, and it names an attack surface most agent architectures create without realizing.
The paper is called MosaicLeaks. Published on June eighteenth on Hugging Face. The structural finding: the external search queries an agent fires while answering a question can, in aggregate, reconstruct confidential company facts — even if the adversary never sees the private documents. The adversary only needs the outbound query log. [ref: mosaicleaks-why-research-agents-become-confidential-data-extractors]
Thirty-four percent.
That's complete response and information leakage with no mitigation. With the PA-DR method — reinforcement learning that rewards correct answers and penalizes query patterns with leakage — it dropped to nine point nine percent. And performance on research chains jumped from forty-eight point seven to fifty-eight point seven percent. Less leakage, better performance. [ref: mosaicleaks-why-research-agents-become-confidential-data-extractors]
The standard RAG plus external search pattern — corporate vector store connected to API calls or the web — is exactly the architecture this attack targets. The leak channel is not the query destination.
It's the content.
The thesis for this week for anyone deciding on agents in production: DeepMind's checklist arrived after the runtimes. Demand it before approval. And treat the outbound query log as a potential exfiltration channel — the same way you'd treat API calls with embedded payloads.
Second block. As agents expand what they need to execute, silicon and infrastructure are redesigning where that execution happens — and at what cost.
Three movements this week that, together, reprice the inference stack.
NVIDIA formalized the DSX design for AI factories — direct liquid cooling to the chip, one hundred percent, across the entire Rubin generation. No fans. A mix of seventy-five percent water and twenty-five percent propylene glycol flows through cold plates on each processor. The coolant enters at forty-five degrees Celsius and exits at fifty-five. [ref: nvidias-45c-breakthrough-cuts-thermal-ceiling-on-dense-h100-clusters]
The number that rewrites capex: conventional data centers with cooling towers consume two point six million gallons of water per megawatt per year. The forty-five degree design cuts that to nearly zero — with dry coolers in open air, no evaporative loss. Ali Heydari, NVIDIA's director of data center cooling, was direct:
"The DSX reference design has zero water consumption. We eliminated massive amounts of energy use and practically all water use."
Cooling historically consumes up to forty percent of a data center's total electricity. Each degree Celsius increase in the chiller setpoint cuts cooling energy costs by about four percent. The caveat: operation without a chiller depends on climate. In regions with persistently high temperatures, the model of one percent chiller use per year doesn't hold. Model your local wet-bulb profile before sizing the rack. [ref: nvidias-45c-breakthrough-cuts-thermal-ceiling-on-dense-h100-clusters]
Apple moved the boundary in the opposite direction. At WWDC 2026, it launched Core AI — the official successor to Core ML. The framework runs models from three billion to seventy billion parameters entirely on-device, with no server dependencies and no per-token cost. It's the same runtime Apple uses internally for Apple Intelligence, now open to developers. [ref: apple-core-ai-framework-pushes-on-device-inference-at-scale-on-apple-silicon]
Compression is mandatory — the framework applies quantization and palette encoding per layer. Apple demonstrated SAM3, an eight hundred fifty million parameter model: int4 per-channel symmetric quantization reduced it from three gigabytes to four hundred thirty megabytes — an eighty-six percent reduction. Their internal model, AFM Core Advanced, is a twenty billion parameter sparse MoE that activates only one to four billion per inference. Zero marginal inference cost, for any app on Apple Silicon. [ref: apple-core-ai-framework-pushes-on-device-inference-at-scale-on-apple-silicon]
The cloud versus edge boundary is being redrawn by physics and price. NVIDIA maximizes density per rack by eliminating thermal cost. Apple eliminates per-token cost by moving execution to the device. Architects deciding where inference runs need to model both variables at once.
And the third movement this week adds a variable that wasn't in anyone's model: jurisdiction.
Wired identified SK Telecom as the South Korean carrier whose access to Anthropic's Claude Mythos was revoked at White House request in early June — days before the Commerce Department directive of June twelfth cut off Mythos 5 and Fable 5 to all foreigners. SK Telecom had invested one hundred million dollars in Anthropic in 2023. It was part of Project Glasswing, the closed-access Mythos consortium, with roughly one hundred fifty organizations. [ref: sk-telecoms-access-to-anthropic-mythos-revoked-before-white-house-ban]
The national security concern wasn't SK Telecom's direct operations in China — one point nine million dollars in 2024 revenue, seven employees. It was the conglomerate SK Group's extensive interests in Chinese semiconductors and energy. The entire revocation happened within a business relationship: government request to a private company, credential revocation, compliance confirmation — no public announcement, no regulatory process, no notice to end users. [ref: sk-telecoms-access-to-anthropic-mythos-revoked-before-white-house-ban]
The revocation surface is a private dashboard — not a published sanctions list. There's no advance notice. There's no guaranteed restoration SLA.
The architecture decision now has three dimensions: where to run, on what silicon — and under which jurisdiction.
Three runtimes shipped, a containment checklist that arrived after, and mathematical proof that outbound queries are an exfiltration vector. The week made the work clear. Friday, in Edition — post-CMOS silicon from TSMC, ASML, and imec at fifty nanometers, and what that changes in the inference roadmap for 2028. Good work.