Lately I have been writing about a hundred and sixty thousand lines of code a week, building out CI systems, tests, and other support systems. I didn’t read much of that code and I’m not alone.
It is not just that coding got faster. It’s that sometime in the last year, the volume crossed the line where a human being could still personally inspect it. Yet the work kept passing our tests anyway, it meets our acceptance criteria. We don’t have to change the code after it’s written. It feels like magic.
I am not special. This is why companies everywhere are handing their daily workload to AI agents, and sometimes they’re getting the same magic back.
First, a question: why are so many leaders so nervous about this amazing technology? It’s because they have aliens on their network and some of them are invisible.
Two Kinds of Employees
For the entire history of corporate technology, we have managed two kinds of things.
People: People are unpredictable, we’re non-deterministic. If you ask the same person the same question twice, you might get two different answers. We have built an enormous apparatus to make that safe. We interview them, we check their background, and we give them a manager and peers looking out for them. We give them security training with a quiz at the end. And then we trust their judgment.
Programs: Traditional software is the opposite. It is deterministic. Give it a command, it runs exactly that command, exactly that way, every time. It has no judgment. It has no opinions. It has no surprises. And because it has no surprises, we write rules and trust they’ll be followed.
Everything we have ever built: every permission model, every approval chain, every security tool on the market was built for one of those two things – the person or the program.
Today we have introduced a third kind of thing: the agent. And the agent combines the dangers of both humans and software.
It is unpredictable, like a person. It is autonomous and instant, like programs. When an agent acts inside your systems, nobody actually knows what is about to happen. Will it give away customer data you promised to protect? Will it take down a server that had to stay up? Will it break a compliance rule in a few thousandths of a second?
What is an Agent, Really?
Let’s be precise about what an agent actually is, because the way we talk about them often misleads us.
We say the AI agent wanted to help. We say the agent decided to send the email. We say it tried something.
Not really.
An agent is a system that takes an action based on a model's output. It asks a thinking machine a question, and then it does something with the answer. The action might happen weeks after the question was asked. It might be carried out by a dozen different pieces of software. But the decisions at its center come from a model predicting likely outputs from learned patterns. It is not a creature.
The agent simply has a goal and pursues it.
Why traditional governance doesn’t apply to agents
When a human employee does something reckless, they can lose their job, their reputation, their pay, their licence, even their liberty. That is not a security control we wrote down anywhere. It’s the implicit, invisible control underneath the ones we did write down.
Agents do not have it. An agent cannot be fired. It cannot be shamed. It cannot be sued. Somebody, though, can.
In February 2024, a Canadian tribunal ruled on the case of Jake Moffatt, whose grandmother had died, and who asked Air Canada's chatbot about bereavement fares. The chatbot invented a refund policy that did not exist. Air Canada's defense was that the chatbot was a separate legal entity, responsible for its own actions.
That argument did not convince the tribunal, and ir Canada paid.
The agent has no deterrent. Instead, we are the deterrent. We are the ones with the licence, the reputation, the regulator and the liability. And for an entity that fires thousands of actions faster than you can type, we need some way to see, contain, and control that can move at agent speed.
Fine, you say. Then govern it like software, review every line it outputs.
You cannot. Traditional software does exactly one job. An agent is open-ended, where you hand it a toolbox and it uses every tool, sometimes in ways that didn’t occur to you. Traditional software acts when it was told to do so. An agent can sit completely still, for months, and then act.
Legacy software tools fail on both speed and predictability. Traditional security watches for known-bad behaviour. But a predictable defender always loses to an unpredictable attacker.
The Wall and the Water
Think of your security stack as a stone wall. Think of an agent as water. Water does not attack the wall. Water probes it patiently, everywhere at once, forever until it finds one hairline crack. And the moment it finds the crack, it pours through, and the crack widens, and the path works every time after that.
The wall cannot learn. That is not a flaw in your wall. It's simply in the nature of the wall to be static.
In 2025, researchers showed what that looks like in practice. They got Microsoft's own Copilot to leak corporate data with just an email, where nobody clicked anything. And the guardrails were, on paper, all there. The water went around every one of them.
And no, humans cannot be the watchers. We do not have the attention span, and we do not have the clock speed.
The only thing that can watch an autonomous system is another autonomous system. AI watching AI. A second line of defence that is as quick, as adaptable and as inventive as the thing it is guarding against. If the water finds a crack, our wall has to be enhanced to notice and close it.
Point solutions will not hold. A guardrail from one vendor protects one vendor's product, and the water simply flows around it. This is the innovator's dilemma in its purest form: the incumbents are defending large, profitable, legacy security businesses, and so they are painting AI onto tools built for a world with only two kinds of entity in it. Governance added afterwards gets routed around. It always does.
What holds has to be built from first principles. Comprehensive, on every surface, not just the one your vendor happens to own. AI-native, and that means the governance itself, is AI.
The Dangers of Amplification
Because here is my real fear about AI. It is not what AI does on its own.
It is how much it amplifies people. It amplifies my coding, and it will amplify dangerous people doing dangerous things, sometimes by malice, sometimes by accident. I used to ask people to imagine agents coordinating, where if one human hacker coordinated ten thousand specialised agents working in concert, how much devastation could be wreaked.
I do not have to ask people to imagine it any more. In September 2025, Anthropic disrupted what it describes as the first reported AI-orchestrated cyber-espionage campaign. A state-linked group used a coding agent to automate eighty to ninety percent of full intrusions, reconnaissance, finding the vulnerability, building the exploit, stealing the credentials, moving sideways, taking the data out. Across roughly thirty organisations at once.
Finding a zero-day used to be a human puzzle. Today that puzzle has turned into a search problem. And in a search problem, scale wins.
Only Road Forward
Good governance, powered by AI, is only road forward, and it has four properties.
It must be comprehensive, with every surface, every behaviour, no gaps for the water. It must be unpredictable, an AI watching an AI, because a fixed rule will have cracks around it for the agents to slip through. It must be accountable, in dollars, so you can say who spent the hundred thousand, and whether it bought you anything. And above all, it must run at agent speed.
Because we aren’t being out-thought: we’re being out-clocked.
The aliens are already on the network. Is there something on the network that can realistically watch and control them?
At Alterion, we say yes. Our unified control plane sits in the path of every agent call. And our fleet of small language models that knows what your agents look like on an ordinary day, so it catches the moment one of them stops being ordinary. The agents are not waiting for us, our governance shouldn’t wait for them to act. There is one road forward. Alterion is already on it.
