The agent stack’s center of gravity shifts from “better prompts” to “hard perimeters” — and the perimeter now includes every connector, contract, and courtroom. The clearest signal is that as agents touch more external services, your threat model stops being app‑local and becomes supply‑chain shaped.

Start with the practical edge: Connecting AI agents to outside services explodes the risk radius argues connectors create hidden subprocessors, dynamic permissions, and data paths that invalidate the assumptions most teams baked into their first “tool use” deployments. That dovetails with Rob Gurzeev on Why AI Has Changed Cybersecurity’s Biggest Blind Spot, where attack‑surface management becomes less about known inventories and more about continuous discovery of what’s newly exposed when agents (or AI‑augmented ops) start wiring systems together. This is Immune System work: instrument the edges, constrain egress, and treat integrations as live risk, not a one-time security review.

Now zoom out: the perimeter also gets set by who controls compute and access. Beyond rockets and satellites, SpaceX is quietly building an AI compute business… is a reminder that “where your model runs” is becoming a negotiated dependency, not an implementation detail. At the same time, open-weight supply keeps rising: Qwen3.8 is launching and going open-weight soon and Ollama: All Aboard Open Models push more teams toward hybrid inference and local customization. That combination is volatile: cheaper portability reduces vendor lock‑in, but it also multiplies the number of runtimes, images, and update channels you must secure and validate (Order + Build the Island).

The legal perimeter is tightening too — and it’s increasingly outcome-based. A class-action challenge like Lawsuit says AI tool disproportionately places Black prisoners in maximum security in Ontario echoes the broader move from “we followed the process” to “show the measured harms,” reinforced by research like AI is more likely than humans to form biases when hiring. Meanwhile institutions are operationalizing controlled access rather than banning tools outright: EU Parliament plans EPGenAI Hub rollout… is Procurement‑as‑control‑plane logic applied internally, with routing, logging, and policy hooks as first-class requirements.

Underneath all of this sits a human factor teams keep underestimating: AI advice made people 3x less accurate but 2x confident pairs uncomfortably well with the connector story. If your users become more confident exactly when they’re wrong, then “human-in-the-loop” is not a safety argument unless you also design the loop (Gate) and audit the outcomes (Validation).

Watch for connector governance to converge with procurement and compliance into a single runtime control surface — because the next generation of agent failures won’t be model-only; they’ll be integration-shaped.