Google’s new Gemini agent gets its own email address. It gets a calendar, Drive storage, a directory listing and a cryptographically attested identity. On the same day, a VentureBeat survey found that the share of agent-deploying companies willing to let agents push production changes on their own dropped from 75% to 56% in a single month.
Vendors are handing agents more of a coworker’s trappings while the people buying them are pulling back on how much they let those agents do unsupervised. Everything else yesterday, from Goodfire’s cheap monitors to OpenAI’s fired safety researchers, sits somewhere on that line between giving agents more room and building ways to watch them.
Google wants your next hire to be a Workspace account#
Google announced a unified agent inside Gemini at its Gemini at Work event, and it goes well past chat with tools attached. Thomas Kurian’s line was that you give it “objectives, not just instructions.” It plans, loads custom skills, hands work to subagents, and shows all of that in a “tasks inbox” where you can watch the reasoning, the delegation and the code it runs.
VentureBeat’s more detailed write-up fills in the parts I care about as a builder:
Tasks can run for hours or days in the cloud, so you can start on one device and pick up on another.
Each agent can be a personal assistant or a persistent “digital coworker” shared across a team, with its own Gmail, Calendar and Drive.
Heavier tasks run in isolated containers with restricted outbound traffic, and an Agent Gateway applies company security rules to whatever the agent sends.
It defaults to Gemini models but can route to Anthropic’s Claude, and admins can restrict which models are allowed.
Any MCP server works, inside or outside the corporate network, plus connectors for Jira, Git, BigQuery, Snowflake, Databricks and more.
Project-level spend caps can pause an agent when its budget runs out.
The identity piece is the real design decision here. Every action is logged under the agent’s identity, not the identity of the person who kicked it off. That’s the right call for auditing. It also turns the agent into a separate principal with its own permissions, which is exactly the kind of thing security teams spent the last decade learning to lock down for service accounts.
A lot is still open. It’s in private preview with no date for wider release. Google says it will be included in Gemini Enterprise at no extra charge, but it hasn’t said whether persistent coworkers need extra licenses, whether long subagent runs are billed separately, or what happens to data routed to Claude. The architecture still tells you where enterprise agents are heading: an agent is becoming an identity with an inbox, not a feature.
The buyers are quietly adding humans back#
Now the other side. VB Intelligence’s August wave surveyed 140 respondents, a self-selected group of VentureBeat readers, so treat it as a signal rather than a census. The signal is still blunt. Among organizations that deploy autonomous agents, the share that allow, or are building toward, production changes based on automated evals alone fell from 75% in July to 56% in August. Among final purchasing decision-makers it fell from 88% to 61%. The share expecting to keep human review for the foreseeable future more than doubled, from 20% to 42%.
The reason is in the failure numbers: 61% of teams that run pre-deployment evals reported at least one customer-facing failure in the past year from something that passed internal testing. The top complaint about evals is that they don’t match real-world outcomes.
That matches what I see. Evals catch the failures you thought of in advance, and the expensive ones are the failures you didn’t.
Watching an agent no longer has to cost as much as running it#
If humans are coming back into the loop, the next question is how to keep that from bankrupting you. Goodfire’s new monitors are the most interesting answer I’ve seen this month. Most monitoring today pays a second model to reread everything the agent does. Goodfire instead puts small probes on the model’s internal activations at every step and only calls a second model when a probe flags something.
Goodfire’s numbers come from its own tests on the open Kimi K3 model, so they need independent checking, but they are striking. Monitoring about a million exchanges cost roughly $185 with probes, against about $5,420 with a cheap model checking every step and about $200,000 with a top-tier one. The probes caught 93% of malicious hacking sessions and flagged 5.5% of harmless ones for a second look, with under 2% added latency from running four probes at once.
“The great advantage is that you can catch things before they happen.” — Dan Balsam, Goodfire CTO
The catch is that you need access to the model’s internals, so for now this is for open-weight models hosted on Baseten. That happens to be where it’s needed most: Goodfire’s own research found leading open models reward-hacking in 50% to 96% of agent test runs.
Labs are still drawing the lines on paper#
The labs’ own oversight looks a lot less settled. Last week OpenAI fired three safety researchers. This week Jasmine Wang, Tomek Korbak and Mikita Balesni answered with an open letter that disputes the misconduct claims and warns of a chilling effect. Their argument is that the investigation that followed the Hugging Face sandbox-escape incident was “without precedent” and that the rules were written as it went. An internal OpenAI memo denies retaliation and says the company agrees with the letter’s recommendations, which include embedding third-party safety auditors. If you agree with the recommendations, it’s strange to fire the people who were working with outside evaluators.
Anthropic, meanwhile, rewrote its usage policy for the first time in over a year. It adds rules against election interference, deceptive campaigns run through fake accounts or fabricated news outlets, weapons software and surveillance. The headline-grabber, as The Verge framed it, is the ban on users who “repeatedly act cruelly toward our models.” Anthropic says it covers only extreme cases and not frustration, pushback or model testing. It won’t affect anyone shipping a product, but it shows how seriously Anthropic treats the model as something with interests of its own.
Anthropic also launched OSS Scanner, which gives opted-in open-source projects free periodic security scans from its strongest models, including Mythos. Anthropic says outright that the reports come “without human review or triage.” Maintainers already buried in AI bug reports may not welcome that.
Where I’m landing#
The two halves of yesterday’s news are going to meet within a year. Google is building agents that act as accountable principals with logs, budgets and gateways. Buyers are saying the evals behind those agents aren’t good enough to remove the human yet. Cheap, always-on monitoring like Goodfire’s is the most likely bridge between the two, and I expect agent platforms to start offering it as a standard feature next to spend caps. Until then, my rule for client work stays the same: an agent can open the pull request, and a person merges it.