"Where do we enforce who can call which tool?" A customer's security team asked me that recently, before approving a wider rollout of their agents. Several of their teams were building agents, each with its own rules for its agents, and those agents called the same internal MCP servers.
About a week back, I was talking with a customer, and they started sharing about their AI initiatives. During the conversation, they mentioned that their token budget for the year was already gone. It lasted only four months. They did estimates and pilot runs, and still could not get it right.
And to my surprise, I found they are not alone. In April, Uber's CTO said the company had already used up its planned 2026 AI budget, only months into the year, after a surge in the use of AI coding tools.
Different industries, use cases, and even usage patterns. But the same problem: token consumption was way more than anyone had budgeted for.
An agent can cause damage before the model makes its first decision.
On September 1, 2026, Manifold described coding agents that invoked Git while gathering workspace context, allowing repository-local Git configuration to run a program on the host. Some affected agents performed that work before a user typed a prompt or approved workspace trust.
In Manifold's GitSpawn research, the relevant path was a repository received as files, with a .git directory inside a ZIP archive. Git read repository-local configuration while the agent gathered context. An ordinary Git clone, fetch, or pull does not transfer repository-local .git/config from the remote.
The model did not choose a harmful tool call. The runtime acted while preparing to use the model. That is why an agent review needs three boundaries: the runtime that starts processes, the gateway that holds credentials and routes requests, and the tool that makes a sensitive change.