It's really hard to make these models useful and safe. Useful means wide adoption, long running tasks with no human in the loop, wide access to read and write data (analysis, summaries, dashboards, etc).

Safe means containers, guardrails, egress filters, human in the loop, deliberate per agent mcp controls, and real expertise in prompting/task selection, etc.

So far the pattern I've seen is security teams say no, it gets escalated, it's allowed, then 1% of the time the model yeets data where it's not supposed to (no amount of promoting or controls seems to really fix this), it's locked back down.