I think one of the most important security questions facing enterprises right now is how much authority they are prepared to give AI agents, especially when those agents can interact with customer data and business critical applications. While U.S. bank JPMorgan Chase’s Q3 profit miss got the mainstream headline, it was CEO Jamie Dimon’s comments on the earnings call drawing a line on the risk of external AI agents that caught my attention.
Speaking during the bank’s earnings call, Dimon said JPMorgan already uses agents internally and intends to deploy them for customers where they improve service. But he was clear that the bank would not allow external agents within its environment, citing the risks to customers and the institution.
"There is a defensive side, which is you gotta make sure our customers are not hurt by it… think of that as an AI agenda concern, which is heightened because you do not want rogue agents, and there could be thousands of them.”
“We have to make sure we protect our customer in the right kind of way… We are building tools to do that too. In the meantime, we are not gonna allow just any… outside agent to come inside the company because it is just too risky for clients and for JPMorgan.”
Dimon’s comments offer a useful reality check: organizations may see considerable value in agentic AI, but that does not mean they should allow every agent through the door. It’s an increasingly relevant concerns as consumers and businesses experiment with personal AI assistants capable of taking actions on their behalf, potentially across multiple providers and platforms.
Even without AI agents in the mix, there have been multiple incidents in recent days emphasizing the ever-present risks to enterprises and customers.
Retail Breach Watch: ASOS, TFG and H&M
Retail cybersecurity risk remains in focus following recent incidents involving ASOS, The Foschini Group (TFG) and H&M highlighting the exposure created by retailers’ customer-facing platforms and interconnected supply chains.
The Foschini Group’s U.K. subsidiary, TFG London, disclosed a cyber incident on October 11 affecting IT systems used by Phase Eight, Hobbs and Whistles, disrupting some website functions and online orders while physical stores remained open. Meanwhile, H&M investigated claims of a potential cyber incident, but subsequently said website disruption was caused by routine maintenance and was unrelated to external interference.
According to Voldemaras Kadys, Head of Security and Platform Engineering at Mediatech, the digital publishing house behind Cybernews, large retailers tend to attract more attention from cyberattackers for two reasons. “Retailers hold valuable customer data, which can be reused in secondary attacks. Also, any incident involving a larger retailer draws more public attention than more isolated attacks.”
The answer lies in the basics, Kadys said. “Defense in depth, zero trust and the principle of least privilege remain essential. They help control the attack surface and limit the impact when a breach does happen.”
The commercial stakes are high: customer trust, service continuity and the ability to process transactions during an incident.
“Digital resilience will become more important than classic security controls alone,” Kadys warned.
“You have to assume an incident will happen and be prepared ahead of time, to avoid the most damage.”
Nvidia Commits $250M to UK Agentic AI Safety Research
Maintaining customer trust will depend on more than setting boundaries around AI agents; organisations also need reliable ways to test their safety and security before handing them greater responsibility.
To that end, NVIDIA is putting significant resources behind efforts to make agentic systems safer, committing $250MN in compute access over five years to support U.K. research into agentic safety and security.
The commitment equates to $50MN annually and will support research across the U.K. AI safety and security community, including the British Open-Ended Learning and Discovery Lab (BOLD) at the University of Oxford, SOFAIR at University College London and Imperial College London’s Frontier AI Research Lab. U.K.-based cloud partners will also contribute to the initiative.
Research areas include secure AI agents, open-model security, robotics safety, real-world threat mitigation, secure sandboxes and safety benchmarks.
The funding arrives as organizations explore autonomous AI capabilities that create new opportunities for automation but also introduce risks when agents encounter malicious inputs, access sensitive resources or behave in unexpected ways.
