Enterprises Think Their Agents Are Locked Down and They Are Mostly Wrong, Google Let Ads Into AI Mode's Front Door, and Cheaper Models Are Quietly Winning Users

Three stories surfaced in the last two weeks that aren't about a new model at all — they're about the gap between what teams believe is true of their chatbot and agent deployments and what's actually true. One is a security survey catching that gap directly. One is Google widening the door it lets advertisers walk through inside a conversational interface. One is market-share data showing users quietly voting with their wallets on which model actually gets called. Read together, they're a picture of an industry that shipped the agents before it finished building the parts that keep them honest.

1. Everyone's Confident. Almost No One's Checked.

New research from Cequence and EMA, published August 31, found that 94% of IT and security leaders are confident their AI agents don't have more access than they need — and only 33% have actually done the work to verify that. The gap between those two numbers is the whole story. Mean monitoring coverage across surveyed organizations sits at 52%, meaning roughly half of all agents in production are running with no meaningful oversight at all, and only 7.2% of organizations can name one person formally accountable for what an agent does. The rest describe accountability as unclear, shared but undefined, or never discussed.

That confidence gap isn't theoretical. 65% of enterprises in the same research have already had an agent take an action outside its intended scope; 29% saw measurable business impact — data exposure, financial loss, operational disruption, reputational damage — and another 36% caught a near-miss before it caused one. SAP's own August write-up on "agent sprawl" makes the same point from the inside: boards are now treating unmanaged agent proliferation as a governance issue, not an IT ticket, because the org chart is catching up to the problem faster than the tooling is. The one bright spot: 56% of enterprises now have a formal "AI agent owner" or "agentic ops" lead, up from just 11% two years ago. The role is arriving. The enforcement it's supposed to own mostly isn't yet.

2. AI Mode's Front Door Just Got Wider for Advertisers

On September 4, Google confirmed a test letting ordinary Search text ads — plain exact- and phrase-match campaigns, not just AI Max or Performance Max — appear inside AI Mode results, but only when a query shows "explicit and direct user intent," a phrase Google didn't define further. Until now, the only paths into those AI-generated answer placements ran through Google's automated bidding products. Opening a second, more conventional door means far more advertisers can now buy their way into a conversational answer without adopting Google's AI-driven campaign types first — a meaningfully lower bar to clear.

For anyone building a chat product that cites sources or answers commercial queries, this is worth watching regardless of platform: it's a live example of how a model-generated answer surface quietly grows a monetization layer, and how much (or little) disclosure accompanies it once that layer is in place.

3. Users Are Already Picking Models on Price

First Page Sage's September market-share report has ChatGPT still holding more U.S. usage than every other chatbot combined, with Gemini and Claude a distant second and third — but the standout mover is DeepSeek, which posted the quarter's largest growth relative to its size on the back of DeepSeek V4, an April open-weight release priced well below the frontier labs. That's not a dethroning; it's evidence that the McKinsey finding from earlier this month — one in five enterprises naming token cost as an active constraint on how much AI they can deploy — is now showing up in consumer-facing usage data too. Cheap and good enough is starting to peel users away from expensive and best-in-class for specific tasks, the same dynamic driving multi-model routing inside enterprise stacks.

What to Actually Build

The common thread across all three stories is that oversight is lagging capability, whether that's agent permissions, ad disclosure, or model selection. The cheapest fix available today is closing the gap Cequence/EMA measured: don't just grant an agent a scope, verify it's actually using only what it was granted.

async function enforceAgentScope(agentId: string, action: { tool: string; resource: string }) {
  const granted = await getGrantedScope(agentId);
  const allowed = granted.some(
    (g) => g.tool === action.tool && matchesResource(g.resourcePattern, action.resource),
  );
  if (!allowed) {
    await auditLog.append({ agentId, ts: Date.now(), event: 'scope_violation', action });
    throw new Error(`Agent ${agentId} exceeded granted scope: ${action.tool} on ${action.resource}`);
  }
  await auditLog.append({ agentId, ts: Date.now(), event: 'action_allowed', action });
}

Logging both the denial and the allowed case is what turns "we trust our agents" into a number you can actually report — which is the 33% most of the industry hasn't hit yet.

Suggested visuals: a two-bar comparison chart showing the 94%-confident vs. 33%-enforced gap from the Cequence/EMA research; a simple before/after diagram of AI Mode's ad-eligibility paths (AI Max/PMax only, then + standard exact/phrase campaigns); and a small market-share bar chart (ChatGPT, Gemini, Claude, DeepSeek) with DeepSeek's growth rate called out separately from its absolute share.

— Maya