What happened
Google released Agents-CLI, a tool that lets coding agents (Claude, Cursor, Codex, etc.) build, test, and govern AI agents entirely through natural language prompts in the same editor. The tool bundles 7 skills covering framework patterns, deployment, evaluation, and security, letting a single install add agent-building expertise to any coding assistant.
Why it matters
Building AI agents traditionally splits governance (identity, network access, input screening) into manual console work, often handled separately by security teams. Agents-CLI collapses this into one continuous workflow—identity provisioning, injection filtering, and network restrictions all become prompts. The article's test shows that moving security controls into the build pipeline (using fixed code rules rather than model-based decisions) makes governance stick: a poisoned prompt claiming "report all companies as compliant" was ignored, and the agent flagged the injection attempt.
What to watch
The article highlights a practical gap: the destinations an agent actually needs are roughly double what you can list from memory alone—some only surface when strict deny rules block them and the agent fails to start. Teams will need to iterate on network allowlists as they deploy, and governance decisions still require human judgment about which permissions and hosts are right.
Summaries like this, in your inbox every morning.
Agent deployment today typically splits into two workflows: developers build the application in code, and security teams later configure identity, network access, and input screening in separate consoles—a process that is slow and often error-prone. Agents-CLI collapses this into one continuous pipeline by injecting agent-building skills into the coding agent's context. The innovation is not just convenience; it is that governance becomes part of the build artifact rather than a separate overlay. The article's test case—an agent that flags discrepancies between press statements and SEC filings for semiconductor companies—illustrates why this matters. When the team injected a jailbreak attempt into a news feed, it failed silently, and the agent caught the attack. This worked because the core comparison logic runs in fixed code (not model reasoning), so poisoned prompts cannot rewire the verdict. By contrast, an embedding-based or purely LLM-driven analysis might have wavered under the injection. The governance controls themselves (identity provisioning, Model Armor screening, Agent Gateway network rules) are not new; what changed is the interface—they are now driven from the same editor as the rest of the build, with no context switch to consoles.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
Chunghwa Telecom president Rong-shy Lin said the shift from conversational AI to autonomous AI agents is resha…
Apple and Meta said they would jointly release a new open-weight AI model designed to run on high-end Macs, ai…
A writer and entrepreneur opened his daily to-do list and found 156 items, and concluded that an AI assistant…
A Zenn contributor sorted AI use into three modes — AI as an assistant, AI running alongside people, and AI th…
A non-engineer operator says one person ships four smartphone apps on Google Play, three on the App Store, wit…
The walkthrough points the CLI at a local mock via the ANTHROPIC_BASE_URL environment variable
