The Agentic Index Brief

The week in one line

Claude in Chrome reached general availability able to act without asking each time, Fiddler's gateway stopped rejecting risky calls and started editing them in flight, and Harness shipped a review layer for the volume of code agents now write. In seven days the human moved from the gate to the review queue.

Theme 1: Approval stopped meaning stop

Claude in Chrome reached general availability on every paid Claude plan, and the part of the release that matters is what it no longer does. The extension now takes actions in the browser without asking permission for each step, with a safety classifier validating each action before it runs. A human click was replaced by a model's judgment, deliberately, because the click does not survive contact with volume. Nobody has ever carefully read the fourteenth approval prompt of the morning.

Fiddler made the same move down in the plumbing and described it more precisely. Version 26.17 puts guardrails inside AgentGateway that redact personally identifiable information and secrets in real time, on the request path and the response path. The change from the previous release is the whole story: the gateway used to block or allow, and now it can mask in place, so a sanitized call proceeds instead of being rejected. A guardrail that refuses is a gate. A guardrail that edits is a filter, and filters scale.

The rest of the week fills in the pattern. Yellow.ai shipped message redaction that masks sensitive customer data across chat views, transcripts and logs. LiteLLM's August release added PII and PCI masking in logs alongside strict caller credential enforcement for MCP tool calls. OpenHands 1.16.0 replaced its default all on skill catalog with an explicit allow list, the same instinct pointed at defaults rather than traffic. Base44 added per app exceptions to its channel usage policies and enforces them on its own servers, on the stated grounds that an agent can be talked into ignoring a rule it has merely been told about. And xpander went the other way with more precision rather than less, adding human approval on individual tool calls and moving credentials into external vaults.

Then the consequence, which arrived in the same seven days. Harness released an agent ready code repository and an AI code review layer built explicitly for the volume of code agents now produce, evaluating agent authored pull requests for risk and handing human reviewers context rather than a raw diff. When approval per action goes away, review of aggregate output is what takes its place. Meanwhile CalypsoAI, now shipping as F5 AI Security, added a September attack pack that tests whether a model will comply when a harmful request arrives dressed as poetry or a folktale. Somewhere a red teamer is workshopping a sonnet, and the genuinely unsettling part is that it works.

Theme 2: The product grew a second front door

Nine MCP releases landed in seven days and almost none came from infrastructure vendors. This was the week application companies published themselves as something another company's assistant can call.

Paragon launched a managed MCP server fronting more than 130 third party integrations, with authentication embedded in the chat itself, isolation between tenants and native support for OpenAI function calling. Actively AI exposed its per account sales agents to ChatGPT, Claude and Cowork, carrying live account research and persistent memory across the boundary. Brev put business goals and metrics behind a server so a check in can be submitted from a terminal. Thread connected Liongard asset data through its own server so a technician can query it from Claude or ChatGPT with no separate login. Arcade went a level up and now accepts any third party MCP server onto its platform.

The most telling one changed its name in the process. Forest Admin became Forest, launching an MCP server that lets agents such as Claude call it under governance, alongside multi step workflow automation and a Zendesk application. A company that sold an admin panel dropped the word describing the panel in the same release that made the panel optional.

The command line half kept pace. Cresta shipped a CLI so builders and coding agents can inspect conversations, agent configurations, knowledge bases and evaluation histories through one surface. DBOS released a Go v1.0 with database backed queues, a public OpenAPI specification and a dbosctl CLI. Langfuse made evaluator management fully programmatic with stable public APIs. Kiro's IDE picked up the latest MCP revision for more reliable sign in, and Trigger.dev 4.5.14 added cursor resumption to realtime streams so a dropped connection resumes where it stopped rather than where it started.

What is worth noticing is what shipped alongside the doors: authentication inside the chat, tenant isolation, caller credential enforcement, governance named in the launch copy. Two months ago an MCP announcement was a protocol demo. This week it came with an identity story attached, because the vendors have worked out what they are actually publishing.

Theme 3: You configure the agent by talking to the agent

In last week's issue agent configuration got a release process: drafts, version snapshots, rollback. This week the interface to that process became a conversation.

careCycle launched Assembly, a workspace where you configure an AI employee by talking to something about it. You ask what the current configuration is, review how the calls have been going, and prepare changes through a guided conversation, with version control tracking each setup and restoring the previous one. Both halves shipped in the same release, which is the only reason the first half is safe.

FurtherAI did it for insurance operations: describe the workflow in plain language, get back visible and inspectable steps, then test the result against real submissions in an evaluation studio before anything reaches production. Token Security introduced Enzo, which builds live identity security applications, dashboards and automations from natural language inside the platform with no additional infrastructure. Hostinger merged two builders into one product with agentic and manual modes, and merged two assistants into a single agent that holds business context across conversations. Dify released New Agent, which lets an agent run as a standalone application and be reused as a component inside larger workflows, after adding sandboxed code execution and skill management earlier in the week. Qodo handed teams control over how AI review findings are grouped, ordered, labeled and routed. And hireEZ rebuilt its platform on an agent native architecture, with every action logged to support compliance audits.

Market notes

The hyperscaler marketplaces became a distribution channel for finished agents rather than for models. FlowX.AI put its industry agents and orchestration layer on Gemini Enterprise through the Google Cloud Marketplace, and Obin AI made its financial agent available directly to Gemini Enterprise customers, in both cases so the agent runs on a stack the buyer already operates. MarvelX listed its claims agents on the Azure Marketplace. On the gateway side, Netlify added Gemini 3 Pro Preview and then Claude Opus 5 with no key management on either, TrueFoundry added governance and portability for Claude Sonnet 4.5 and GPT-5 workloads and wired DeepKeep's AI firewall in as a custom guardrail, and Windmill turned on Anthropic prompt caching for its Vertex AI agent. Procurement and inference are converging on the same three logos.

Two vendors moved the agent in opposite directions on the same day. Perplexity launched Portable Computer, a version of its agent platform that runs entirely on the machine in front of you, co designed with Nvidia for RTX GPUs and DGX Spark, reaching out to remote capabilities only on demand. Kiro's CLI 2.20.0 introduced managed cloud sessions, where you attach a repository, disconnect, and the agent carries on working without you. Gnani.ai took the sovereignty route with Artha, pairing a new 30 billion parameter open weight model with its agent platform for enterprises that want the whole stack inside their own borders. Where the agent runs is now a product decision with three defensible answers, which is good news for buyers and awkward for anyone drawing a single architecture diagram.

Voice agents were handed the till. Consio's agents can create a Shopify draft order during the call, select the product, apply the discount code and leave it ready for the customer to complete, and the same vendor shipped unified call history with transcript exports two days later. Haptik introduced a parameter store, a deterministic place to keep customer identifiers, verification flags and preferences with cross channel persistence and expiry rules, which is the unglamorous state layer that makes the rest of it safe to run. Cartesia's Sonic 3.6 adapts intonation and pacing to the transcript with no markup tags and adds Odia and Urdu for 44 languages, and Smallest AI's Lightning V3 detects the language automatically and can switch mid sentence, which is closer to how bilingual customers actually speak than anything with a language selector.

In the regulated verticals the shipped feature was the explanation rather than the output. Ambience Healthcare introduced Chorus, a shared system of context underneath its whole suite that reconciles notes, medications, labs and diagnostic reports into a source linked view of a patient's history. Abridge added pre visit summaries and level of service coding recommendations that show the reasoning behind the calculation. RegASK's updated workspace keeps a connected trail of sources through research and analysis and generates cited briefings from it. ComplianceQuest lets an employee describe a safety incident in plain language, then classifies the event and pre populates the record. Luma Health wired outstanding balances and mobile payment into the appointment reminder, and Suki unbundled its dictation into a standalone product for Epic and MEDITECH. In work that gets audited, the citation is the product.

Elsewhere, the workhorse releases. Rootly put its incident agent on mobile, so a responder can pull a catch up briefing, draft a customer ready status update and change severity from a phone. ControlUp launched Pulse, a conversational surface for IT operations that executes governed actions in place. AlertD taught its agents to run the full AWS Security Health Improvement Program assessment natively, all 319 questions of it. Equixly added Attack Trace so you can watch how its agent executes an attack. Blue Yonder pointed agentic capability at stockouts and returns across forecasting, inventory, fulfillment and service. OpenAI gave the Codex app direct markdown and code editing, inline annotations, cross repository projects and GitHub pull request reviews in the sidebar. W&B Weave started capturing user feedback on agent interactions alongside the cost of each model call. Lumi AI 3.0 took on open ended questions with multi step analysis a user can edit in place, Hex added generative chart controls, Oracle gave its natural language to SQL toolset model selection and scheduled enrichment, and Tines put autonomous agents inside its automation platform while shipping a self hosted 43.0.0 in the same week.

And one pricing note worth the space. Bardeen removed per seat licensing outright, allowing unlimited team members on every plan, and announced a $3 million strategic investment from Dropbox and HubSpot alongside an agent aimed at business users. Per seat pricing for agent software has an awkward question at its center, which is whose seat. Every meter covered in these pages this month has been a vendor trying to price the work an agent does. This is the same problem answered from the other end: stop charging for the people, since the people are not the ones doing it.

Index Answer

Which AI agent platforms require human approval before an agent takes action?

Fewer than one in five, and the question cannot be answered honestly on its own, because an approval step is only a control if the agent can act without you. Of the 566 platforms the Agentic Index grades across its four horizontal lanes, 281 document a human approval step or guardrail in full. Only 104, or 18.4 percent, document all three of the capabilities that make that answer mean anything: the agent can start work on its own, it will hold for a human, and what it did can be reconstructed afterwards.

The gap between those two numbers is the finding. 141 of the 281 platforms documenting human oversight in full do not document autonomous triggers at all. On a platform that only moves when a person tells it to, requiring human approval describes using software rather than governing an agent. Half the human in the loop claims in this market are a description of a button.

Read from the risk side it inverts. 91 of the 231 platforms that can start work on their own document no human approval step at all, so the products most in need of a brake are among the least likely to publish one. A further 175 platforms sit exactly one capability short of the bar, which is a roadmap gap rather than a design position.

That matters more this month than last, because the approval step is being traded away for throughput. When the click goes, the third capability carries the weight: 319 of 566 platforms document tracing and an audit record in full. If an agent can act on its own and you cannot reconstruct what it did, no approval policy you write is testable.

The bar, the method and the 104 platforms that clear it are on the Agentic Index human approval page.