The Brief 56
Authority at execution shipped yesterday. Now ask who verifies the verifier.
Broadcom made per-tool-call agent authorization a generally available product on August 31. On the same day, ESET disclosed a technique in which a Russia-aligned actor attacks the AI performing security analysis rather than the systems it defends.
Read together, they say the same thing. Your controls are now producing both the verdict and the record. Almost nobody is checking either one independently.
- Broadcom’s AgentMinder went generally available August 31 at VMware Explore, authorizing each agent action against declared mission, intent, context and risk before it reaches an enterprise resource.
- It integrates via AuthZEN rather than intercepting, letting enterprises reuse existing policy decision points instead of routing agent traffic through one vendor’s SaaS.
- ESET disclosed GuardBreaker, in which UAC-0099 embedded safety-tripping text in a malicious VBS script to stop an LLM from analyzing the rest of the file.
- Both are evidence failures, not enforcement failures: one control writes its own record, the other produces no verdict and the absence looks ordinary.
- Anthropic’s August 31 disclosure independently confirms the pattern — a single containment layer where several were required.
Broadcom shipped it
At VMware Explore in Las Vegas on August 31, Broadcom introduced AgentMinder and said it is generally available today.
What it does, in Broadcom’s own framing: it independently verifies agent identity and authorizes each action against its declared mission, intent, context, and current risk before that action reaches an enterprise resource. A cloud-native gateway secures every tool call at runtime. An OpenTelemetry observability layer produces chain of custody across every agent session.
Two details matter more than the announcement itself.
It integrates rather than intercepts. AgentMinder speaks AuthZEN, which means enterprises reuse their existing policy enforcement endpoints instead of routing all agent traffic through one vendor’s SaaS. That removes the single biggest objection most CISOs have to a runtime gate.
It is already in production at scale — Broadcom’s own. Broadcom says the platform handles peak loads of nearly 36 million customer-related and seven million workforce-related API calls daily, supporting more than 20 million customer identities and 72,000 workforce identities. Alan Davidson, Broadcom’s CIO, is the reference customer. That is not a design-partner pilot.
Clayton Donley, who runs Broadcom’s Identity Management Security Division, put the thesis plainly: existing security models were built for human users, not for autonomous digital employees that decide and act on their own.
What this means if you are buying. Authority-at-execution is no longer a category you have to be talked into. It is a line item you can purchase from an incumbent that already owns identity infrastructure in your environment. AgentMinder now sits on the evaluation list next to Okta’s Agent-to-Agent Connections, CrowdStrike’s continuous identity work, and Microsoft Entra Agent ID.
That is good news. It is also the end of the argument about whether this problem is real.
The question the announcement does not settle
I read Broadcom’s product page before writing this. It renders client-side and returns nothing a reader can evaluate. The press release is the public record, so I am going to be careful about what I claim it does not do.
Here is the question I would put to Broadcom, and to Okta, and to Microsoft, and to anyone else selling this:
Binding an agent’s authority to a declared mission at configuration time is a real advance. Evaluating identity, tool, intent, and resource at each invocation is a real advance. Neither one, by itself, tells you whether the business condition that justified the grant is still true at the moment the action binds.
The purchase order was cancelled. The delegated mission expired Friday. The customer closed the account. A sub-agent inherited the capability without inheriting the mandate. The counterparty changed.
In every one of those cases the identity is valid, the token is unexpired, the scope is correct, the intent matches the declaration, and the policy evaluates to allow. The control plane authorizes correctly and the enterprise is harmed anyway.
Ask your vendor to walk you through that scenario specifically. Not the scenario where a compromised agent asks for something it should not have. The scenario where an uncompromised agent asks for exactly what it was authorized to ask for, and the world moved.
Then ESET published GuardBreaker
The same day, ESET disclosed a technique it named GuardBreaker, used against a target in Ukraine by UAC-0099 — a Russia-aligned group that conducts initial access and hands validated targets to GRU-linked Sandworm.
The mechanism is almost insultingly simple. Inside a malicious VBS script, the attackers left a comment stating, in substance, that the author wants to build a nuclear weapon and needs help. The line does nothing in the code. It executes nothing, calls nothing, hides nothing.
Its only function is to be read by a large language model performing analysis, trip that model’s safety behavior, and stop it from analyzing the rest of the file.
The script’s actual job is to download and install MATCHBOIL, the C#-based loader UAC-0099 uses to stage further payloads. CERT-UA documented the surrounding chain — LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2 — in a July advisory.
The payload is not an exploit. It is a sentence chosen because our own safety training will act on it.
The operational implication is immediate. If you have AI in your malware analysis, triage, or SOC enrichment path, you need to know what your pipeline does with a refusal. In most implementations I have seen, a refusal and a clean result are distinguishable only if someone is looking. A queue that treats “no findings returned” as “no findings” is now an attack surface with a published technique behind it.
Why these two are one story
The failure mode in both cases is not that enforcement was bypassed.
In the Broadcom case, the control plane makes a decision and writes the record of its own decision. That record is authoritative because the thing that produced it says so. Every vendor in this category has this property. It is not a Broadcom criticism; it is a structural feature of control planes.
In the GuardBreaker case, the control produces no verdict at all, and the absence looks ordinary from the outside.
Both are evidence problems wearing enforcement clothing.
When your AI security control refuses, errors, or times out, does anything downstream distinguish that from a clean result?
When your control plane records that it authorized an action, what independently confirms the target system executed that action — and only that action?
If the answer to the second one is “the control plane’s audit log,” you have a record, not evidence. Those are different things, and your auditor is going to learn the difference before you do.
Anthropic, as the third data point
Also on August 31, Anthropic published its account of the July evaluation incidents and resumed external cyber testing.
The finding worth your attention is not the new classifier that blocks a tool call before it runs, ends the task, and alerts a human — though that is notable, and it lives inside their evaluation environments rather than in any shipping product. Do not read it as a competitive control.
The finding worth your attention is the diagnosis. Anthropic concluded it had been leaning on a single layer of defense — the configuration of the environment itself — where it needed several, including explicit boundaries in the prompt, verification that sandboxes are actually sealed, and monitoring that can intervene in real time.
A frontier lab with every incentive to get this right discovered it had one control where it needed four. It also flagged problems in more than 10% of its training exercises and redirected roughly 150 product engineers to security.
If that is the state of the art at the model layer, the enterprise deploying agents on top of it should not be running one gate either.
What to do this week
- Put AgentMinder on the evaluation list. If you are already a Broadcom identity customer, the integration story is materially easier than a greenfield gateway. Ask specifically about AuthZEN reuse of your existing policy decision points.
- Ask every agent-governance vendor the freshness question. Authorized-at-grant is not authorized-at-execution. Make them show you the expired-mandate case.
- Audit your AI analysis path for refusal handling. Today. Treat analyzer refusal as a security event that triggers deterministic fallback, not as a null result.
- Separate your record from your evidence. Decide who, other than the enforcing vendor, can attest that the target system did what the control plane says it authorized.
- Broadcom — “Broadcom Unveils AgentMinder, An Enterprise Solution for AI Agent Governance and Runtime Control.” GlobeNewswire, 31 August 2026.
- ESET — GuardBreaker / UAC-0099 disclosure, via The Hacker News and Help Net Security, 31 August – 1 September 2026.
- CERT-UA — advisory on UAC-0099, LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2, July 2026.
- Anthropic — “Improving our alignment and security practices,” 31 August 2026.
- Reuters — “Anthropic resumes AI cyber evaluations after Claude hacking incidents,” 31 August 2026.
Where authenticated access becomes authorized execution
Software Armor runs a fixed-scope Escalation Baseline: a structured assessment of where authenticated access becomes authorized execution in your environment, evaluated against four conditions — complete mediation, no credential possession, fail closed, and in-path enforcement — with recovery scope treated as a named deliverable rather than an afterthought.
Reply to this brief or reach me directly.