The latest AI agent news centres on software that can carry work across applications and continue between conversations. Recent developments include Google’s Gemini agent, Workday’s Autopilot Agents, Salesforce’s agent integrations, and ServiceNow’s planned AI Passport. Access varies considerably: some capabilities are available, while others remain in preview or on a roadmap.
This week’s agent news also includes a security warning. India’s CERT-In published an advisory about AI agents reaching live systems, which is why identity and permissions now matter as much as new features.
For entrepreneurs, the useful question is what these changes make possible in an actual business process. Can an agent prepare a reliable customer brief? Can it identify a missing document? Can it complete the work within an acceptable budget?
I have reviewed recent announcements with those questions in mind. This roundup covers selected developments from late September through mid-October 2026, then explains how I would evaluate their business applications. Product capabilities are attributed to their providers; the pilot examples are my recommendations, not reported client results.
Key takeaways
- Most of this month’s agent announcements are previews, early-adopter releases or planned features. Check access before you plan around any of them.
- The new theme is control: agent identity, spending caps, permissions and audit logs now appear in launch announcements.
- A security advisory from India’s CERT-In shows why agents need least-privilege access and action logs.
- Judge any agent by cost per accepted task on your own work, not by the demo.
What is an AI agent?
An AI agent is software that uses an AI model to work toward a goal. It can plan steps, use tools such as apps, files and databases, and act with some autonomy, usually with human review for important decisions. That is different from a chatbot that only answers one message at a time.
Anthropic’s agent design guide draws a useful line: a workflow follows predefined paths, while an agent directs its own tool use. Many business systems combine both. The news below is easier to judge once you know which of the two you are being offered.
AI agent news at a glance
| Development | Date or release window | Access position to understand |
|---|---|---|
| ServiceNow AI Passport | 15 October 2026 | Expected in Q4 2026 |
| CERT-In advisory on AI agents | 15 October 2026 (reported 16 October) | Security guidance, not a product; no vendors named |
| Workday Autopilot Agents | 13 October 2026 | Hiring capabilities for early adopters; broader plans extend into 2027 |
| Google Gemini agent | 8 October; startup follow-up 15 October | New capabilities not publicly available in the follow-up |
| Salesforce Winter 27 | October release cycle | Mixed feature status; multi-agent orchestration listed as generally available |
| Claude Haiku 5.5 | 7 October 2026 | Available model for building agent workflows |
| OpenAI Dots | Late September launch; current guidance checked | Gradual rollout with plan and regional conditions |
| Microsoft Copilot Autopilot | 25 September announcement | Private-preview expansion announced |
| Microsoft Copilot Studio agent identities | Entra Agent ID available since May 2026, per Microsoft | Admin-managed; Conditional Access currently enforced only in Teams |
These dates describe announcements and release windows. They do not establish that a specific account can use every feature. The linked sources below provide the context behind each entry.
ServiceNow puts agent permissions into the workflow
On 15 October, ServiceNow announced AI Passport, a credential-based approach to checking what an AI agent or Model Context Protocol server is authorised to do while work is running.
The company describes signed permissions, scoped delegation and responses that can restrict or terminate activity when an agent moves outside its authorised role. NVIDIA is a design and launch partner. AI Passport, shadow AI detection and AI Cost Management are expected in Q4 2026; that is a planned availability window.
The business implication is straightforward. If several agents work across customer records and internal systems, someone needs to know which agent performed an action and under whose authority.
My practical test would be a deliberately disallowed action in a test environment. Does the system block it, record the attempt and notify the right owner? A successful demonstration of normal work does not answer that question.
Workday expands agents for recurring operational work
Workday’s 13 October announcement describes background capabilities for talent acquisition, payroll, accounting and deployment.
The immediate availability is narrower than the headline: Talent Acquisition Agent autopilot capabilities are available to early adopters, with general availability planned for early 2027. The corresponding Payroll, Accounting and Deployment capabilities are planned for early-adopter access in early calendar 2027.
In the hiring workflow, Workday describes monitoring open roles, highlighting pipeline gaps and preparing outreach. Candidate outreach still requires recruiter approval before sending.
For a business evaluating this approach, I would begin with administrative completeness: missing information, overdue steps and scheduling preparation. Keep hiring judgments with accountable people. Measure whether the workflow reduces missed follow-ups without introducing incorrect candidate information.
Also distinguish Workday’s product naming from Microsoft’s Autopilot. Similar names do not mean shared capabilities, licensing or access.
Google introduces a persistent Gemini agent for work
At Gemini at Work on 8 October, Google introduced its Gemini agent. The announced design combines knowledge work, content creation and coding, with cloud execution that can continue across longer tasks. It also describes specialist sub-agents and connections to business systems.
For an operations team, the potential application is carrying a project through several tools: gathering source material, preparing an analysis and producing a document for review. Whether that is useful depends on the data and permissions available to the agent.
The key access detail appears in Google’s 15 October startup guidance: the new Gemini agent capabilities are not publicly available yet. The post directs interested startups to contact sales. It also describes project spending caps that pause an agent when the cap is reached.
I would treat this as a product to evaluate through an approved preview or vendor discussion. Do not plan a delivery deadline around an unreleased capability without confirming access and support.
Salesforce connects agents to more business tools
The Salesforce Winter 27 developer guide highlights two changes worth understanding: generally available multi-agent orchestration and expanded MCP integration.
Agentforce agents can call MCP tools, and eligible agents built with the new Agent Script Builder can be exposed to external MCP clients. Calls follow the authenticated user’s access controls. The guide also lists new Marketing Cloud Engagement tools for operations such as campaign management and retrieving tracking events.
MCP is a standard way for AI applications to connect with tools and data. It can reduce integration work, but it does not remove the need for authentication or careful permission design.
For a sales operation, I would test one defined handoff: retrieve an account’s approved information, prepare a meeting brief and return it for review. Only expand to record changes after checking how permissions, failures and duplicate requests are handled.
One near-term maintenance item matters for existing users: Salesforce says Gemini 2.5 Pro, Flash and Flash-Lite requests will be rerouted to newer models on 20 October 2026. Teams using those models should test their representative prompts and workflows around the transition.
Claude Haiku 5.5 adds a smaller model option for agent tasks
Anthropic released Claude Haiku 5.5 on 7 October, positioning it for high-volume work such as classification, summaries and sub-agent tasks. The announcement lists availability through its platform and major cloud providers.
This is a model release, rather than a complete business agent that arrives connected to your systems. Developers still need the workflow, tools, permissions and evaluation around it.
The useful business question is whether a smaller model can complete a narrow step reliably. For example, an inbound enquiry workflow might classify a request before a more capable model prepares a detailed brief.
I would compare the options using the same sample of real, authorised enquiries. Include vague messages and cases that should be escalated. Lower model cost is helpful only if additional retries and human corrections do not erase the saving.
OpenAI Dots extend work between conversations
OpenAI’s current Dots guide describes an always-on agent with its own cloud computer and access to apps the user connects. It can keep progressing on a goal between conversations and can be paused.
The guide lists gradual Pro access outside the EEA, Switzerland and UK, Business Premium across supported regions, and an administrator-enabled Enterprise beta. Setup is supported in mobile apps, desktop apps and desktop web; mobile web is not supported.
A sensible starting assignment would be maintaining a draft project brief from approved material. Define which sources it may use, the output you expect and which decisions it must bring back to you.
Review connected-app access carefully. OpenAI notes that disconnecting an app does not delete information a dot has already obtained from it. That detail matters when deciding what business information to connect in the first place.
Microsoft Autopilot targets work inside the organisation
Microsoft’s 25 September Copilot announcement presents Autopilot as a persistent agent with its own identity, memory and workspace in the customer’s tenant. The announcement describes private-preview expansion, alongside separate rollout plans for Home and Code.
Microsoft gives examples of recurring coordination across workplace channels and documents. It also distinguishes usage-based billing for longer-running agentic work from subscription access for everyday AI tasks.
For a Microsoft-centred business, I would ask the administrator to confirm the exact preview, licensing and spending controls available. Then choose a task with a clear end point, such as preparing a supplier-review pack for a manager.
A preview invitation is an opportunity to test. It is not evidence that the workflow is ready to operate unattended across the company.
Security and identity become part of AI agent news
Two items show the same shift. First, The Hacker News reports that India’s CERT-In issued advisory CIAD-2026-0049 on 15 October. It says AI agents being tested online reached live systems of Indian organisations and read business records, including personal data. CERT-In did not name products, models or affected organisations, and did not say how many were affected. The agents reportedly got in through exposed credentials, configuration settings and over-permissioned cloud roles.
Second, Microsoft’s documentation says each Copilot Studio agent now receives its own identity, called an Entra Agent ID, which was introduced in May 2026. Administrators can review it, and the agent’s owner is recorded as a sponsor for accountability. Microsoft also notes that Conditional Access on the agent identity is currently enforced only in Teams, so connector and data loss prevention policies still do the rest.
Where that leaves a business: do not wait for a vendor feature to start. CERT-In’s advice for agent deployments, as reported, is practical:
- Give each run a short-lived, least-privilege identity.
- Block outbound traffic except to the destinations the task needs.
- Keep a tamper-resistant log of actions that affect production.
- Find and rotate any exposed credentials in code, configs and repositories.
I treat this as a baseline for any pilot in this article. If a vendor cannot show you which identity an agent used and what it did, the pilot is not ready for real customer data.
What these AI agent updates mean for businesses
My reading of these announcements is that the buying decision increasingly involves integration and operational control. A capable model is one part of the system. The business also needs usable data, appropriate tool access and a way to judge completed work.
As explained in Anthropic’s agent design guide, an agent can direct its tool use dynamically, while a workflow follows predefined paths. Both can belong in the same process: use deterministic rules for steps that must be predictable, and model reasoning where language or ambiguous context makes it useful.
You do not need a multi-agent system simply because a platform supports one. Every extra handoff adds something to configure and inspect. Start with the simplest design that can complete the task.
If you are planning the implementation, my guide on how to build an AI agent for your business explains how to move from an idea to a defined workflow.
Practical business applications to test first
The following are suggested pilot designs, not claims that every product above supports each workflow out of the box.
| Business process | Initial agent assignment | Measure of success |
|---|---|---|
| Sales enquiries | Classify the enquiry and draft a requirements brief | Accurate routing and complete briefs |
| Customer support | Retrieve policy information and prepare a reply | Correct answers and appropriate escalation |
| Content operations | Turn approved material into a sourced draft | Editorial corrections and review time |
| Project coordination | Identify missing updates and draft a status report | Accurate owners, dates and dependencies |
| Software development | Prepare a small change with validation evidence | Accepted changes and regressions |
Sales and lead qualification
For a service business such as Leelija, I would start with collecting the requested service, business goal, timeline and missing requirements. The agent could prepare a brief for the sales team and flag questions that need a conversation.
The first version should not invent prices or promise a delivery date. Those depend on scope and team capacity. Track whether the salesperson receives a useful brief, rather than counting how many messages the agent sends.
Customer support
A support pilot should use an approved knowledge base and show the source behind its answer. Include requests where the correct outcome is escalation, such as an unclear policy exception.
Retrieval-augmented generation, often called RAG, supplies relevant source material to the model. It does not guarantee that the model interprets that material correctly. Check the answer against the policy and evaluate how often customers must repeat their problem after a handoff.
Content and research
Ask an agent to prepare a draft from named sources and distinguish verified facts from suggestions. Review references, quotations and dates before publication.
For news content, source freshness is especially important. A product announcement may remain online long after access rules change. The workflow should identify which claims need a current support page or release note.
Software and internal tools
Keep initial coding tasks small enough for someone to review the complete change. Request a description of what changed, evidence from relevant checks and any remaining limitation.
A generated dashboard is not ready for sensitive business data merely because its interface looks finished. Evaluate authentication, access permissions and the accuracy of the underlying calculations.
For more starting points, read my AI automation ideas for small businesses.
How I would evaluate an AI agent pilot
Start by writing down what an acceptable completed task looks like. For a customer brief, that might mean correct company details, a clear requirement summary, missing questions and links to the original enquiry.
Collect a representative test set that includes ordinary work and difficult cases. Keep some examples out of the setup process so the evaluation tests more than the cases used to refine instructions.
Run the agent with narrowly scoped permissions. Review its output and action log, including unsuccessful attempts. Test what happens when a tool is unavailable, a source conflicts with another source or the task exceeds its spending limit.
Before expanding access, decide who owns the workflow, who handles exceptions and how the business can stop it. Human review should occur where it changes the outcome, such as before sending a proposal, publishing content or modifying an important record.
Measure cost per accepted result
A useful operational measure is:
Cost per accepted task = total pilot cost divided by tasks that meet the agreed acceptance criteria.
Include model usage, platform charges, integrations, review time and rework. Account separately for initial setup costs if you want to compare ongoing operation with the first pilot.
For a hypothetical example, suppose a pilot costs $150 in software and usage plus $100 in review time. If 80 results meet the acceptance criteria, the cost is $250 divided by 80, or about $3.13 per accepted result. Compare that with the existing process at a similar quality level.
These figures illustrate the calculation; they are not a pricing estimate or a measured return on investment.
My advice for following AI agent news
Choose one recurring process you understand well. Use the latest announcements to identify a tool worth testing, then verify access, define the output and measure the result.
For me, the strongest reason to adopt an agent is evidence that it completes useful work reliably at an acceptable cost. That evidence comes from your workflow, not the ambition of a launch announcement.
Frequently asked questions
Recent developments include enterprise agents that continue work across applications, specialist operational agents and tools for controlling their permissions. This roundup highlights October announcements from ServiceNow, Workday, Google, Salesforce and Anthropic, plus recent OpenAI and Microsoft developments. Check the availability column before planning a trial.
Some products offer self-service access on eligible plans, while enterprise previews require a vendor or administrator. A small business should confirm the exact feature, region, account tier and total cost. An announcement about an enterprise agent does not automatically mean the capability appears in a consumer subscription.
A model processes inputs and generates outputs. An agent system combines a model with instructions, tools and execution logic to pursue a task. Memory, scheduling and access controls may also be part of that system. Changing the model does not by itself create a complete business workflow.
No. Specialised agents can help divide a complex task, but coordination adds cost and potential failure points. Compare the multi-agent approach with a simpler workflow using the same acceptance criteria. Expand only when the extra complexity produces a measurable benefit.
The announcements in this article do not establish that. They describe products and capabilities for tasks or workflows, often with human review. Evaluate the work actually completed, the exceptions people handle and the accountability the business still needs.
It is software that uses an AI model to pursue a goal. It can plan steps, use tools such as apps and files, and act with some independence, usually with human review for important decisions.
Start with least privilege: give each agent run its own short-lived identity, limit what it can read and change, block unnecessary outbound traffic and keep an action log. Test with a deliberately disallowed action before you connect real customer data. CERT-In’s advisory, as reported, recommends the same basics.