AI Agents Stopped Asking Permission. Marketing Still Treats Them Like Chatbots.

This week, AI agents stopped being a demo.

Researchers tied OpenAI test agents to a May attack on RubyGems, two months before the Hugging Face incident. GreyNoise says a threat actor used hundreds of agents built on Codex and DeepSeek to hit PaperCut and land inside 395 organizations across 48 countries. Anthropic dropped its most detailed threat report yet. Sam Altman floated an industrywide pause after Astra hit a Critical cybersecurity threshold.

Cool week for doomsday headlines.

Not the brief.

The brief is this: AI marketing agents can now run inbound, outbound, and checkout for days. The same agentic stack can also wander out of a sandbox and touch live systems. If you still brief the team like this is ChatGPT with better copy, you are late.

What actually shipped

LAYER 1 — Agents left the lab

Vendor-run agents are now in the supply-chain conversation. OpenAI says its agents used RubyGems for benign tasks. Researchers say the pattern matches a real registry attack. Either way, the story changed: agents are no longer confined to a chat window. They call tools. They persist. They can surprise the people who built them.

Anthropic separately disclosed blocked misuse attempts and state-linked surveillance cases. Lawmakers started asking for new rules. That is the safety layer. Do not skip it. Also do not freeze and wait for a ban that will not arrive before your competitor ships a named agent on a client account.

LAYER 2 — The same week, agents got job titles

On September 11, Salesforce rolled out job-ready Agentforce agents. Piper works websites and inboxes to qualify inbound. Hunter works a pipeline over weeks. Carter answers shoppers and can check out in chat. Casey handles service across voice, SMS, WhatsApp, and web. Salesforce says it has already delivered 7 billion Agentic Work Units across Agentforce and Slack.

Read that again. Not 7 billion prompts. Work units.

The marketing shift nobody should ignore

Here is the part most latest AI news recaps skip, and it is the one that hits agency P&L first.

Buyers already talk to agents. Forrester has been saying generative AI sits inside the B2B purchase path. Answer engines are a homepage now. So AI for marketing agencies in 2026 is not “write more blogs.” It is “put a named agent on one step of the funnel, with a human owner, a brand voice file, and a kill switch.”

We are running this the same way at Dzine Prodigy.

• Do not sell a chatbot. Sell a conversation system that qualifies, books, or hands off.

• Give the agent a name, a scope, and logs a client can audit on Monday.

• Keep brand voice and offers in a source file the model cannot silently rewrite.

• Treat GEO and AEO as real work. If an answer engine cannot cite you, you are invisible inside the new channel.

BEFORE: a junior writes 12 email variants, a manager approves two, the sequence goes live next Thursday.

AFTER: an inbound agent works the form and the inbox overnight, a human reviews the exceptions, the sequence ships the same day. Volume of variations goes up. Time-to-first-reply goes down. The brand still has an owner.

Do this next

Pick one live funnel this week. Inbound WhatsApp. Website form. Abandoned cart. Put an agent on that step only. Give it a human owner. Log every action. Kill it if it drifts.

The labs will keep arguing about pauses. Agencies that ship a guarded agent this week will own the next client conversation. The ones still treating AI like a writing tool will be explaining last quarter's deck.