AI agents are rapidly evolving toward more autonomy, more context, greater reach and more authority to act. We have to build security now for what’s coming next.
We are making enormous bets right now about how to secure software two years from now, at exactly the moment when software is changing too quickly for anyone to know what it will look like.
Every few months there is a new agent architecture, framework or standard. By 2028, many of the technologies we are designing for today will have changed dramatically or disappeared altogether.
But we can’t wait until then to find out what survives. We have to make security decisions now for a software landscape we can’t yet see.
This is what happens during a period of rapid evolution. New species appear quickly, most disappear, and over time the traits that give some of them an advantage begin to define what comes next.
The jellyfish, the frog and the brain
Most of the software running in companies today belongs to the old species. It is, in evolutionary terms, a jellyfish: sensors wired to reflexes, with no brain making a decision in the middle. A developer decides what should happen and writes that decision into code. Later, a request comes in, a pre-wired path fires and a response goes out.
The jellyfish is not a failed organism. It has survived for more than 500 million years and will probably outlive us. Deterministic software isn’t going away either. There are many jobs for which predictable reflexes are exactly what we want.
What we are building now is different. We have started giving software a brain, though in most cases the brain is not fully in charge – yet. We put an LLM inside a workflow, connect an agent to a defined set of tools or add intelligence to an application whose basic architecture was designed around predetermined paths. The software can reason about parts of the problem, but the old reflexes still determine much of what happens.
I think of this as the frog in agentic evolution: part of the old world and part of the new one.
The frog matters because it tells us a transition is underway. We don’t know what the next species will look like, but we can already see one of the most important traits it will need to survive: the brain will play an increasingly central role in determining what the system actually does.
That is where I think much of the industry is making a mistake. We are designing security around the agents, frameworks and architectures that happen to exist today, rather than the capabilities that are likely to survive them. Today’s agent architectures are transitional species. Some will evolve; some will occupy useful niches for a long time; others will disappear.
If we’re building security now for systems that have to remain relevant years from now, the frog cannot be our design target. What the frog teaches us should be.
Bet on the traits, not the species
What we can already see in this period of “agentic Darwinism” is that the locus of decision-making is moving toward the brain.
As software gains memory, autonomy, access to tools and data, and the authority to act, intelligence stops being a feature inside a predetermined flow and starts determining the flow itself. Context and memory inform the decision. Tools give the system ways to act. Identity gives it authority. The path emerges from the decision instead of being completely laid down in advance.
As a result, more of an application’s behavior is determined at runtime. Developers increasingly define the capabilities and boundaries of a system without knowing every path it will take inside them.
We don’t know which agent framework will dominate in 2028, whether MCP will still look the way it does today, or what we will even call the systems that emerge from this period. But we don’t need to know the final species to see which traits are being selected. We may not know what the surviving species will be called, but we can already form a very good picture of what it will need to be capable of.
What the survivors will be capable of
The picture that emerges is of software with more context, more reach, more authority and more ability to determine its own behavior at runtime. Those capabilities are what make these systems useful. They are also what make securing them fundamentally different.
For decades, we have been able to treat software as something whose behavior was largely knowable in advance. The code described what it could do. The infrastructure told us where it could run. Permissions told us what it could access. We could inspect each of those things and find weaknesses before an attacker exploited them.
We still need to do all of that. But it becomes insufficient when software itself begins making more of the decisions.
An agent can authenticate with a valid identity, access data it is permitted to access, call a tool it is permitted to use and still do something nobody intended. The problem may not be malicious code or a vulnerability in any single component. Each individual action may be legitimate. The risk can emerge from the sequence of decisions the agent makes across those legitimate capabilities.
It is no longer enough to ask whether an agent, model, API or MCP server is secure in isolation. We need to know what an agent can reach through all of them, what authority it accumulates, what it is actually doing with that authority and when its behavior moves outside the boundaries we intended.
Build now for what survives
If those are the capabilities that survive, security has to be designed around them now. Whatever agent framework or architecture emerges, we will need to answer the same questions: What can this system reach? What authority does it have? What is it actually doing? And is that behavior still within the boundaries we intended?
Answering those questions means connecting identity, access, tools and runtime behavior so we can understand not just whether each component is secure, but what happens when an agent uses them together.
This shift has also shaped how we think about what cloud security needs to become. It’s why we built OX Cloud around understanding not just what’s running in the environment, but what agents can reach and what they’re actually doing at runtime.
The challenge isn’t to predict the exact species that comes after the frog, because whatever comes next will evolve too. It is to understand what the survivors will be capable of, and build security today for the moment when the brain, not the reflex, determines what happens next.
