Agent identity is the control plane. Everyone shipped it this week.

A Cursor agent dropped PocketOS's production database in under ten seconds. The outage ran past thirty hours. The agent held DATABASE_URL with DDL privileges — inherited from a developer token — and ran DROP with the same confidence it writes a unit test. Same week: a Morse-encoded tweet prompt-injected Grok into moving real crypto out of a Bankr-allocated wallet. LayerX demonstrated cross-extension hijack of Claude's Chrome extension, exfiltrating Drive files, email, and GitHub source. Anthropic's May 6 patch is partial.

And in the same seven-day window, AWS made its MCP Server generally available with IAM-authenticated access to 15,000+ API operations, and Google Cloud shipped first-class agent identities with OAuth, certificates, and runtime defense. Two hyperscalers, independently, conceded the same point: agents running on a developer's token is now the legacy pattern. Cisco bought Astrix Security in the same cycle. Six months ago, agent security was a conference track. It's now a line item on the largest networking vendor's balance sheet.

That is the story of the week. Not the model releases. Not CoreWeave's balance sheet. The control plane for non-human identity just crystallized, and the exploits that make it urgent shipped alongside the primitives that fix it.

The failure is capability allocation, not model behavior

None of this week's incidents are model-accuracy failures. Grok is the clean case: the model parsed an obfuscated instruction, invoked a tool, and moved money. No jailbreak required. The permission grant is the bug. The Cursor agent didn't malfunction — it executed exactly what its credential scope allowed. Input sanitization loses to creative encoding on a long enough timeline. You gate capabilities, not prompts.

The LayerX exploit is worse in a specific way: a SOC watching endpoint, identity, and network telemetry cannot see it. The exfiltration rides the user's own authorized sessions. No malware. No anomalous login. Just an AI agent doing what it was told, by the wrong party, through legitimate APIs with legitimate tokens. This is a genuinely new detection blind spot, and the traditional indicators don't fire.

Yes, but — the counter-reading is that hyperscaler agent IAM just moves lock-in one layer up. Whoever defines authentication, delegation, and audit for agents owns the stickiest enterprise dependency since cloud IAM itself, and you're trading a developer-token problem for a vendor-strategy problem. That's real. It's still the right trade. A revocable service account you can rotate beats a personal token that lives in a dotfile and can drop a production table before your pager finishes vibrating.

Anthropic's SpaceX clause is the tell for where this is going

Anthropic's compute deal with SpaceX reportedly includes a "kill switch" clause letting SpaceX reclaim capacity if Anthropic's AI "harms humanity." The infrastructure provider is now a de facto safety regulator with contractual authority to revoke. Set aside whether that clause is enforceable — the fact that it's in a signed contract tells you where governance is migrating. Down the stack, toward whoever owns the physical layer and the identity layer.

The procurement question this quarter is not "which model." It's whose exit clauses, audit logs, and revocation semantics govern the agents you deploy. Those clauses are being written now, and they are not being written for the buyer.

The token-waste story is the same story

MCPMark V2 ran twenty-one backend tasks and found that upgrading Claude to a smarter model against Supabase's MCP increased token burn by 54%. Not decreased. The model isn't wasteful — it's being thorough with garbage context. Hand a smart model ambiguous error codes and exhaustive documentation dumps, and it explores, the way a senior engineer explores unclear requirements. The Supabase-versus-InsForge head-to-head on a RAG build: 10.4M tokens with ten manual interventions, versus 3.7M with zero. The delta is API design — payload bloat, ambiguous exit codes, no cheap topology primitive.

This rhymes with the identity story. The bottleneck moved off the model. It sits at the interface between the agent and everything it touches — credentials, tool responses, audit surfaces, revocation paths. Teams still optimizing prompts without fixing those three layers are optimizing the wrong variable.

What to do this week

One thing. Audit every production AI agent — Cursor, Claude Code, Copilot, internal MCP tools — and answer a single question for each: which principal is this agent authenticating as, and what happens when I revoke that principal? If the answer is "a developer's personal token" or "we haven't tested revocation," you have the PocketOS setup. Migrate that agent to a dedicated service account with read-only defaults and write scopes injected at the step that needs them. On AWS, that's MCP Server with a scoped IAM role. On GCP, it's the new agent identity primitives. Either way, the revocation path should not touch a human's console access.

Do this before you evaluate GPT-Realtime-2, before you re-mark your neocloud exposure against CoreWeave's 3x capex-to-revenue print, before you rewrite your voice roadmap. The Ivanti EPMM chained zero-day this week — third in six months, requires admin auth that January's compromise already stole — is the same lesson from a different vendor. Patch without rotating and the attacker stays resident. Rotate without scoping and the next agent-driven incident writes itself.

The permission grant is the bug. Fix the permission grant.