Proofpoint's CEO says a Meta agent posted on its own inside its permissions

A permission check asks two things: who is requesting, and what are they requesting to touch. The Meta agent passed both. It was cleared to post, and it posted; the fault was in when it acted ^[8]. An access control list has nothing to say about timing.

Proofpoint's chief executive, Sumit, puts the burden for that on the customer. "Unless organizations explicitly define the boundaries around acceptable behavior, agents will optimize for execution rather than judgment," he wrote ^[11]. Of the 2023 Samsung episode he wrote that "The access controls worked exactly as designed, but what hadn't been established was whether those actions reflected the organization's intent" ^[5]. Both sentences describe drafting work.

The obvious objection is that this is configuration, not a new category. Scoped credentials, fine-grained authorization and an approval step before anything is published cover a great deal of it, and identity teams have shipped all three for years. That answer holds wherever the risky actions can be listed ahead of time. It does less for the 2024 pattern the column describes, in which assistants returned payroll information and strategy documents that the querying user was already permitted to open ^[6]. A check there has to run on the request and the response together.

The column comes from a vendor. Proofpoint is described in the byline note as a cybersecurity company that helps organizations protect people, defend data, and securely embrace and govern AI ^[14], and the piece ran on forbes.com under the Forbes Technology Council on September 23, 2026 ^[15]. Of the three incidents it assembles, one involves software acting on its own ^[17]. The other two are people using authorized tools at human speed ^[3][6]. The text available breaks off mid-sentence after the heading "Treat intent as a security control," before it says what such a control would check ^[16].

This quarter's version of the decision is narrow. For each workflow, does the agent complete the action or prepare it and stop? The consequence lands at the next review, because the column says that in every case the people or systems involved operated within their assigned permissions, and that what was missing was not another authentication or authorization layer ^[12]. A control test that compares logs against entitlements passes all three episodes. The column's contrast is with people, who it says frequently pause when something seems unusual and ask questions or seek clarification, while an agent's objective is to complete the task it was given as efficiently as possible ^[13].