The Agentic Index Brief
October 3 to October 21, 2026 · Published October 21, 2026
This issue in 4 minutes. Watch on YouTube or see the channel.
The week in one line
The agent moved into a sandbox, and the approval prompt shrank to fit. GitHub Copilot, Kiro and Google Antigravity fenced their coding agents in at the operating system level, and two of them used the fence to stop asking about routine commands. Microsoft, meanwhile, gave agents Microsoft 365 accounts of their own, so the newest coworker on the team has a login, takes assignments in Outlook and will one day need offboarding.
This issue covers October 3 to October 21, three weeks of changes in one sitting. The log recorded 316 entries across 316 vendors, 231 of them Verified against a primary source and 85 Partially Verified. Plain agent capability led with 104 entries, then human approval and guardrails with 47, MCP and tool calling with 44, integrations with 28 and workflow orchestration with 24. Most of them circle one question from different sides. How much can an agent do without asking, and what has to be true first?
The agent got its own room
For most of the category's short life, the main safety feature on a coding agent was a prompt asking permission to run a command. This period the biggest names moved the safety into the walls instead.
GitHub Copilot made local sandboxing generally available in Copilot CLI, the Copilot app and VS Code sessions that use Agent Host. Whatever the agent runs, including local MCP and language servers where supported, is limited in which files, networks and credentials it can reach, set by developer or organization policy on Windows, macOS and Linux.
Kiro CLI 2.31.0 made the trade explicit. It runs the agent's shell commands inside an operating system sandbox, with outbound network blocked or limited to common development hosts. Once the sandbox is on, autonomous mode lets Kiro work through a task without asking about each command.
Google Antigravity CLI added an Auto mode that approves file edits and safe commands by itself and still stops before irreversible ones. A command that would leave the terminal sandbox is first reviewed by a separate agent, and from the next day's release that reviewer blocks commands that would upload sensitive data. AutoGPT drew the same line in v0.8.3. Ordinary work inside its sandbox now runs without asking, while outward commands and unrequested deletes of the user's files still need a yes.
Cursor 3.24 lets companies move the agent off the laptop altogether. A new admin policy switches the agent off in local windows and allows it only in approved remote workspaces.
The credential is the last thing leaving the agent's hands. E2B made Secrets generally available. A team stores a credential from its backend and refers to it by name, and E2B adds the value to outgoing requests only after they leave the sandbox. Coral 1.0 has agents write short programs that Coral runs in an isolated sandbox, adding the credentials itself so the agent never holds them, with each operation set to allowed, approval required or disabled. When MindStudio's app building agent needs a third party API key, it now asks through a masked prompt and writes the value straight into the app without ever showing it to the agent.
And the room became something you rent. Inngest put isolated microVMs that start in under a second into public beta, billed per second while they run. Metorial launched sandboxes with their own CPU, memory, disk and outbound firewall. Factory made Environments generally available, prebuilt sandbox images it rebuilds every few hours and promotes only when they pass validation.
Cline and Langbase both moved coding tasks onto hosted machines that keep working after the laptop closes. Langbase's version blocks pushes to the base branch and ends each headless task with a draft pull request. The agent is now the only member of the team who prefers the laptop closed.
Our read: the approval prompt was always a stand in for a boundary. Once the operating system enforces the boundary, the vendor can afford to ask less, and the useful question changes from how often the agent asks to what it can reach when it doesn't. Expect autonomy settings to arrive bundled with a sandbox requirement, the way Kiro's already do. A coding agent that offers an autonomous mode with no sandbox under it is asking for trust without offering walls.
Every tool got a label
Last issue the agent got a job description. This period its individual tools did.
NeuBird's MCP server 5.0.0 switched off, by default, the nine tools that create, change or delete a customer's configuration. Every tool now carries a standard MCP annotation marking it read only or destructive, so a client can run the read only ones freely and ask before the destructive ones. incident.io made Extensions generally available, bringing teams' own tools and internal MCP servers into its investigations, with every tool classed as read, write or destructive and the team deciding where each may run. Pigment's new Slack connector lets admins set each tool to Always allow, Needs approval or Blocked.
Defaults drifted toward off. A tool added to a public Taskade agent now stays off for visitors until the owner turns it on. Vybe gates each MCP connection by agent, so an agent that needs one has to ask a person for it. Forest lets builders limit a workflow's MCP steps to an approved set of tools, which matters because those steps call their tools without asking first.
The approver got defined too. ContraForce now requires approvers to be people from the workspace or the managing organization, and AI agents and service accounts can no longer approve. Bernstein 3.21.0 closed two advisories, one of them a case where an empty approval file passed as an operator's decision, and now accepts only signed approvals that can be used once. It is a useful reminder for anyone building these systems that silence should never count as a yes.
goose 1.55.0 binds subagents to their parent's hooks and approvals, so delegated work runs under the same checks. Roomote now asks again when tool policies tighten after a task starts, instead of letting it carry on with the old access. And the approval request went looking for the approver. Paused Elastic workflows can now reach people in Slack, email, Microsoft Teams and ServiceNow comments, and AutoGPT posts its approval cards into Discord, Slack, Teams and Telegram as native buttons.
Our read: the tool, not the agent, is becoming the unit of permission, and the vocabulary is settling on three words, read, write and destructive. That turns a vague question about what an agent can do into a table a security reviewer can fill in. The quieter change is on the other side of the prompt. An approval that another agent can grant, or that an empty file can satisfy, is a formality, and vendors are starting to require a named person and a signature.
Whose name is on it
As agents took on more work, products had to decide whose identity that work runs under. Two answers shipped side by side.
The first treats the agent as a colleague with an account of its own. Microsoft launched agent accounts in Copilot Studio, so agents work in Microsoft 365 under their own credentials. People can assign them work in Teams and Outlook, mention them in Word, Excel and PowerPoint comments, and hand off tasks the agent carries on between conversations. Tools run under the agent's own approved credentials and scoped permissions, not the user's or the maker's.
Idira's Secure Workload Access now gives each agent on Google's Gemini Enterprise Agent Platform its own SPIFFE identity. Grok Bot can claim an email address of its own, though anything it sends from there waits on a draft card for the user's approval.
The second has the agent borrow the person's identity, one call at a time. Salesforce Agentforce agents can now sign in to outside MCP servers with per user credentials, so each call carries the individual's identity instead of one shared integration login. Workato added OAuth to its proxy MCP servers, so requests reach the upstream server as the end user. Celigo made MCP Management generally available, one gateway in front of every MCP server, with access set tool by tool and every call mapped to a verified user.
Okta shipped a piece that serves both. Tokens from its token exchange now carry an actor claim naming the service that asked, and each further exchange nests inside the last, so the token holds a verifiable chain of who acted on whose behalf.
Systems of record, meanwhile, opened the door on their own terms. Workday made its agent platform headless, with its MCP tools generally available so any MCP capable agent can read Workday data and act under Workday's own permissions, approvals and audit trails. Sana became the Workday Home, where an employee asks in plain language and Sana runs Workday agents to approve an expense or process a leave request. OutSystems made its remote MCP server generally available on every tenant, so coding agents such as Claude Code, Codex, Cursor and Kiro can query apps, publish between stages and roll back.
Our read: whether an agent runs as the user or as itself has become a product decision, with consequences for licensing, audit and offboarding. An agent with its own account is easy to inventory and harder to scope. An agent borrowing a person's identity inherits exactly that person's access and leaves an audit log that says the person did it. Okta's nested claims point to where this probably lands, with every action naming both the person who asked and the software that acted. Expect “which one is it” to become a standard line on every security questionnaire.
The agent started taking notes
Memory had a busy three weeks, and it split into two kinds.
The first is remembering people. Cognition's Devin now keeps memory that is personal to each user and not shared with the organization. Each night it reviews recent sessions to refine what it knows, and users can read the memory files or switch memory off. Retell's contact memory has a model rewrite a running brief on each contact after every call or text, ready for the next conversation with the same number.
Twilio made its Segment integration generally available, syncing customer profiles into Conversation Memory in real time. Outreach gave admins a curated set of facts about the company, its competitors and its products that every AI agent reads before it writes.
The second, newer kind is remembering how. Anchor Browser's Action Index stores web workflows that already succeeded and replays them as fixed code, calling the model only where a page has changed. On Anchor's own run of 300 tasks, success with gpt-5.6-luna rose from 62.7% to 93.3%, at $0.016 per task. Lindy learns a routine from a screen recording of up to an hour. Extend's document agent keeps the code and approach that worked for each document type as runbooks.
The products disagree on one thing, whether learning needs a sign off. OpenClaw's Skill Workshop 2.0 saves what the assistant learns straight into skills, with version history and an Undo option, and retires the old modes in which learned skills waited for review. Glean's Skill reflection goes the other way, proposing edits to a skill from feedback people give in chat and applying them only after someone approves.
Our read: remembered facts make an agent more pleasant, but remembered procedures change what it does next time. That makes a learned skill closer to code than to a note, and the design choice to watch is whether it ships like code, with review, or like autocorrect, with undo. Anchor's numbers suggest the cheapest way to make an agent better is to let it remember what worked, which is also how most of us got good at our jobs.
Both ends of the phone
Last issue the customer turned out to be a bot. This period the bot started bringing paperwork.
Decagon open sourced PACT with Instinct, a protocol built on Agent2Agent and OAuth 2.0 that lets a business check which personal agent is calling and what the customer has authorized. The customer signs in with the business and approves named scopes such as orders:cancel, and every reply carries a signed receipt of what was used and done.
Lorikeet added the Personal Agent Protocol, a draft open protocol from Sierra and Meta. A personal agent finds the business at a known address, and the customer decides on the company's own consent page whether the agent may read the account, act on it, or neither.
Not every agent will arrive with paperwork, so detection kept pace. Sierra launched fleming-1, its own model for judging whether a voice on a live call is synthetic, tuned to be conservative so real people are not flagged. Fini's Agent Handshake spots likely agents in support conversations from message patterns and request speed, applies the same rules however a request is reworded, and can send anything that moves money to a person.
Agents also kept dialing out. Quo's MCP server lets an AI client have Sona, its agent, place a real call to book an appointment or confirm an order, once the user has confirmed the number, the person and the task. Ada's voice agents can now place outbound calls, and Equal's iPhone assistant now makes calls for its user instead of only screening them. At this rate the first fully automated service call will be one agent booking a table with another, both politely asking to speak to a human.
Checkout kept opening up. Shopify launched Shop MCP, a public server that lets any MCP agent search Shopify stores, build carts and create checkouts, then complete a Shop Pay purchase once a signed in shopper confirms the total. Composio Instant gives agents a wallet for more than 100 paid tools, charged per call, with no provider accounts to set up. AIsa now sells selected data endpoints per request through the Machine Payments Protocol, no API key needed. On the defense side, Operant checks each agent payment over x402, MPP and AP2 against the agent's task, the amount, the destination and the company's policy before it goes through.
Our read: agent commerce is laying its plumbing in a sensible order, identity and consent first, then payment. The protocols are early and overlap, but they agree on the shape. The customer authorizes specific actions on the business's own page, the business gets proof, and money moves only inside that scope. A business now has three kinds of visitors, people, agents with paperwork and agents without, and it will want to tell them apart before its competitors can.
Market notes
Builders learned to show their work first. Make's Maia, Dataiku's Cobuild and Rasa's copilot all gained a plan step that lays out the approach and builds nothing until a person approves. Zite's Plan mode now reads the real tables in Airtable or Notion before it writes a plan.
The new Modeler from Abacum shows a financial model variable by variable before anything is saved and leaves every calculation to a deterministic engine. Docyt will not save an AI written dashboard whose totals do not match the P&L. The review point is moving from the finished build to the plan, where mistakes are cheaper.
Agents now review agents. Claude Code's Code Review left research preview and is generally available to Team and Enterprise organizations, with most reviews now finishing in 6 to 10 minutes rather than about 20, Anthropic says. Greptile's TREX starts the app in a sandbox on every pull request, clicks through the affected flows and posts a captioned video of each.
Baz and Sonar both added reviewers aimed at agent code itself, the skills, hooks and MCP servers, watching for risks such as a removed approval step. LangSmith's Engine now fixes failing checks on its own pull requests, up to three revisions or 90 minutes, a time box many engineering managers would happily apply to people.
The category also rearranged some furniture. Augment Code agreed to sell Cosmos, the Auggie CLI and its Code Context Engine to Harness, with the team moving too, and Harness Cosmos is already available. Databricks moved its Agent Bricks Knowledge Assistant and Supervisor Agent to legacy status, pointing new work to the Agent Bricks CLI or Genie Agents.
Galileo is now sold as Splunk Agent Observability. Qodo retires its IDE plugin on October 30, and Bland gave customers until November 15 to move every production pathway to its rebuilt, agent centered builder.
Pricing drifted from seats toward credits. HubSpot customers can now move spend from unassigned seats to credits on their own, without waiting for a renewal. Hostinger put its AI products on one shared credit balance, and Telnyx will charge $0.08 a minute for its new video avatars from November 1.
Scaled Cognition priced its new voice model at $1 per million characters self hosted or $9 hosted. DBOS moved its Conductor client out of the open source library into a separate Enterprise package.
Spend control moved inside the run. Airia now checks budget limits before every model call in an agent run, not only at the start, and stops the run when a limit is hit. Wonderful made its AI Gateway generally available, reporting spend by department, team and user and enforcing limits before a request reaches the model. Braintrust began breaking down coding agent cost by developer, model and branch.
What the period says about the category
Three hundred and sixteen entries, and one bargain struck over and over. Agents got more room to act alone, and in exchange they accepted walls.
The coding agent got a sandbox and asked less. Tools got labels. Approvers had to be people. Agents got names of their own, or borrowed a person's along with a receipt.
None of that makes agents less capable. It makes them easier to say yes to, which in enterprise software is usually what growth looks like.
Last issue the category filled in forms about who agents are. This period it built the rooms they work in and started deciding who holds the keys.
Which AI agent platforms can be self hosted or run in a private VPC?
Fewer than a third of them, once the model is counted. Of the 612 platforms the Agentic Index grades across its four horizontal lanes, 188 document both halves of containment in full. They run inside the customer's own boundary, and they let the customer bring or route its own model. That is 30.7 percent of the field.
Running inside the boundary is the easier half. 314 platforms document self hosting, on premises, air gapped or private VPC deployment, or state where the data physically sits when they cannot. Only 240 document bringing your own model or routing between providers.
That gap is the finding. 126 of the 314 platforms that document deployment inside the customer's boundary do not document bringing your own model. On those, the runtime sits in your VPC and the model call still leaves it, which is the opposite of what a buyer asking this question usually wants. Going the other way, 52 let you point them at your own model while the software stays in the vendor's cloud.
This period's releases went after the harder half. PolyAI put its live call model inside the customer's own AWS account as a SageMaker endpoint. Junie Local from JetBrains runs the coding agent entirely on device, with an open model and a context window sized to the GPU. H added a local mode that can use the customer's own model server. Gnani.ai now runs its full stack in the US, Singapore, Japan and the UAE, with inference kept in country along with everything else. And Crogl shipped an air gapped image whose agents can reach little beyond private ranges and an allow list.
So the useful test for a self hosting claim is not where the software runs. It is where the model call goes. The method and the cleared list are on the Agentic Index self hosted platforms page.
The Agentic Index Brief is published weekly by Agentic Index, the verified directory of 1,081 agentic AI vendors. Compare platforms by capability at agenticindex.io/compare. Methodology at agenticindex.io/methodology.