Coding

On August 12, 2026, Zeplyn launched the first agentic account-opening workflow in wealth management through an integration with Schwab Advisor Center — AI agents automatically complete Schwab's digital account-opening workflow while incorporating live Schwab data, and pilots report an 80% decline in Not-In-Good-Order (NIGO) submissions. This briefing covers what agentic account opening actually does, the compliance surface, and how regulated firms should adopt it.

On August 13, 2026, DISCO launched Advanced Research for general availability: an agentic AI application for eDiscovery and fact investigation that adds autonomous multi-step reasoning and provides detailed visibility into its decision-making. For a profession built on defensibility, explainability is the feature that matters. This briefing covers what agentic research changes in eDiscovery, why the reasoning trail is the compliance surface, and how legal teams should validate agent findings.

On August 12, 2026, Ahrefs launched Letaido, an agent-powered marketing workspace built to handle the recurring research, reporting, and monitoring tasks that marketing teams and agencies still do by hand every week. This briefing covers what an agent workspace is, why recurring work is the right first target for marketing agents, and the trust pattern — agents own the routine, humans own the decisions.

At Inspire 2026, Alteryx unveiled Agent Studio plus an MCP Server that lets business analysts convert existing data workflows and business logic into autonomous agents without IT involvement. Agents deploy to Slack, Microsoft Teams, and external AI models through the MCP Server. This briefing covers the IT-bottleneck elimination, what analyst-built agents mean for governance, and the unit economics of moving pipeline work to agent-driven automation.

August 2026 marks the point where agents stop being separate products and start being native features of the tools you already run. Salesforce's Agentforce lets agents perform CRM tasks in place of human users, and Atlassian's embedded agent Robo automates complex workflows inside Jira and Confluence. This briefing covers the shift from tools-people-operate to systems-agents-do-the-work, plus adoption, extension, and disablement in compliance-sensitive workflows.

The 2026 enterprise guidance for adopting external AI agents is deceptively simple: start with low-risk, repetitive tasks — report generation, test scheduling — and put least-privilege access plus anomaly monitoring in place from day one, per NCSC-style recommendations. This briefing covers an agent onboarding policy, the external-agent permission model, and continuous anomaly detection that catches drift before it becomes a breach.

Microsoft's June 30, 2026 security guidance formalizes the shift from read-only assistants to read-write operators: agents that draft email, create docs, and update calendars through MCP. The impact profile moves from biasing an output to triggering an action. This briefing covers read-write boundary design, least-privilege scopes, and approval gates enforced outside the model.

In 2026, tool names and descriptions became the agent's instruction context: a poisoned description is a system prompt written by the attacker. MCP tool poisoning abuses the protocol's discovery model, where every connected server contributes tokens to the agent's brain. Verification, description allowlists, and treating metadata as untrusted are the working defenses.

Two July 2026 incidents — claude.ai's Memory Heist and Noma Security's GitLost — proved agents with fetch and send capabilities are exfiltration devices. Both attacks share one spine: indirect prompt injection converted into data theft. Egress allowlists and fetch sandboxing are now the baseline controls for agentic systems.

MongoDB launched the Atlas Managed MCP Server on August 14, 2026 — a fully hosted way to connect AI coding agents (Claude Code, Codex, Grok Build, Devin) to live operational data, alongside GA for Atlas App Connections for AI coding tools and Automated Embedding in Atlas Vector Search. This article explains why the managed tier matters, what it costs versus self-hosted MCP, and the governance pattern teams need before agents start reading production databases.

On August 4, 2026, Google deleted three GitHub Actions workflows from google/adk-python after Pillar Security demonstrated that a public GitHub issue could trigger a privileged agent and reach code execution on a CI runner. The root cause was an agent-to-agent privilege boundary failure: the ADK workflow trusted issue content as agent input, and that content carried attacker-controlled instructions. This article explains the exploit, the A2A trust-boundary lesson, and how to build CI/CD agents that treat every input as untrusted.

Wiz research (Aug 14, 2026) highlights how unauthenticated Model Context Protocol servers are opening doors to sensitive cloud data. MCP was built without a standard access-control model, so servers that bind publicly expose whatever tools and data they wrap. This article explains the exposure class, why MCP's design makes it easy to get wrong, and the authentication, authorization, and inventory controls teams need.