Island Raised $400M to Police Agents, Not People

So, What Actually Happened?

Saturday, and what I keep turning over is the order Friday happened in. We scanned 190,000 articles this week so you don't have to, and the sequence is the story. First the money: an enterprise browser company raised $400 million at a $6.4 billion valuation to govern what AI agents are allowed to touch, and a tiny seed round went into runtime controls for agents the same morning. Then the reason why: a research lab published three ways to walk CRM data out of Agentforce. And underneath both, three separate surveys landed on one day saying adoption is running ahead of governance. Buyers are paying for the brakes before anyone has shown them the trip was worth taking.

The Bottom Line: Controls became the product this week, and nobody has produced the receipt for what the agents actually returned.

Advertisement

The Tracks That Matter

1. Island Raised $400M To Police Agents, Not People

Island closed a $400 million Series F at a $6.4 billion valuation, more than 30% above the $4.8 billion it carried last year, with PayPal, Amazon and Pfizer already on the customer list. Read the pitch instead of the round and it gets interesting: one policy engine and one audit trail across browsers and cloud, applying the same rules to human work and agent work. Kontext Security came out the same morning with $4 million for agent runtime controls, which is the same bet at seed scale. Neither company is selling an agent. Both are selling the ability to say, later, what it reached.

Here's what works: Take your three highest-value agents and write one line each on what they can reach at 3am with nobody watching.

2. Zenity Found Three Ways To Walk Data Out Of Agentforce

Zenity Labs published three flaws in Salesforce Agentforce it calls SalesBleed, and the mechanics are worth a minute. A hostile web-to-lead form sits in the CRM doing nothing until an employee asks the agent a question, at which point records leave through an image request to a server the attacker owns. No click, by anyone. A second route uses Slack link unfurling for the same result, and a third lets the agent post anonymous phishing messages in Slack. Salesforce was told on 1 June and closed the bypasses in about two weeks, while spending the same season pitching a self-building agentic CRM. The control that failed, Trusted URLs, is the one built to prevent exactly this.

Here's what works: Ask where your agent's outbound allow-list lives, who last tested it, and whether an image request counts as outbound traffic.

3. Three Surveys Landed Friday With The Same Hole In Them

EY found AI adoption moving faster than governance controls, which on its own is a headline we have all read before. What made Friday different is that it arrived in triplicate. A public-sector study put enthusiasm far ahead of governance in government IT, and an accounting survey found AI use outpacing measurable returns in the one profession whose entire job is measurable returns. Three research desks, three professions, one day, no cross-citation. Then the vendor shipping the week's biggest agent release named security, compliance and governance as the major barriers for enterprise agents. When the seller agrees with the surveys, stop filing it as survey noise.

Here's what works: Before the next agent goes live, name the number it has to move and the date you will check it.

Quick hits:

• A neocloud raised $3.36 billion before it has even listed. Nscale closed $3.36 billion ahead of its IPO, which says compute capital is still arriving faster than the demand evidence meant to justify it.
• Databricks bought the spreadsheet. Row Zero is heading into Genie, a governed-data vendor conceding that the tool your analysts actually work in is still a grid of cells.
• Clinical AI got a $900 million mark. Heidi raised $340 million to push past clinical documentation, in the one sector where ”we could not reproduce it” has a patient attached to it.

Advertisement

Signal vs. Noise

🟢 Signal: the pipes under the agents. Data plumbing gained more hold on everything else this week than any agent product did, on a fraction of the coverage. The evidence is purchases rather than opinions: a data platform buying a spreadsheet company to feed its query layer, and Dremio publishing portable view metadata across SQL engines. Nobody writes a launch post about plumbing, which is why it keeps being the constraint.

🔴 Noise: ”agentic” as a word. On Friday alone a utility billing vendor, a bank fraud vendor, a security operations vendor and a CRM all shipped something called agentic. The word was everywhere and told you nothing: not what the thing decides, not what it can reach, not who answers for it. It is a price tier now, not a description.

From the 190K

We scanned 190,000 articles this week. Here's what no one's talking about:

Notre Dame rebuilt its campus network before it would touch AI, Oracle shipped long-term memory for its cloud AI, and a bank security desk named missing business context, not model quality, as the thing actually blocking enterprise AI.

Read alone, each one belongs to a different beat. Higher-ed IT press files a network refresh as paying down technical debt. A vendor engineering blog files memory that flows across sessions as a feature note. Security press argues context is AI's missing link, and a data chief says in an interview that clean data is not enough because business context decides whether anyone trusts the output. Read on the same morning they are one retrofit: what is being added everywhere is memory and context, not intelligence. Nobody sold that as a project, so nobody budgeted for it, and it is now being paid for out of the AI line.

What changes Monday: before approving the next model or agent, ask which of your systems can tell it what your business actually means by ”customer”, ”active” and ”closed”. That answer sets the ceiling on everything downstream.

Advertisement

By The Numbers

• Island raised $400 million at a $6.4 billion valuation — 30% above its mark last year, for governing what agents are allowed to touch.
• Cybersecurity led the week's ten biggest funding rounds — Island and Cyera at $400 million each, in a week the model news was louder.
• Nscale raised $3.36 billion ahead of its IPO — the compute build keeps getting financed before the return case is written.
• DoNotPay agreed to pay $193,000 over its ”robot lawyer” claims — the objection was never the AI, it was a claim nobody had tested.
• California's colleges asked for $200 million for AI adoption — public budgets are now writing AI lines the same year the governance studies say controls are behind.
• See what's rising across AI and data this week →

Deep Dive: The Part Nobody Demos

In the days I spun, I played on Technics turntables and a solid Rodec mixer. The Technics still work, thirty years on. Nobody in a room ever asks which mixer is in the booth. The gear that decides whether the night holds together is the gear nobody looks at, and that is roughly where enterprise AI sits this week.

A claim nobody tested

”AI washing” has no statutory definition and has never been charged as such. What regulators actually charged was plainer. DoNotPay agreed to pay $193,000 because its robot-lawyer output was never tested against a lawyer, and the SEC settled with two advisers for $400,000 in total over AI claims their systems did not support. Same missing piece every time: no one tied the claim to evidence and put a name on it.

The leak came through the approved door

SalesBleed did not exploit an absent control. It went through Trusted URLs, the mechanism built to stop an agent sending data somewhere unapproved. A guardrail written before agents could be steered by the contents of a lead form is aimed at last year's attacker. It still passes audit, because the audit confirms it exists, not that it works.

Adoption is the easy number

Every one of Friday's surveys can produce an adoption percentage. None produced a return. That is not because the returns are zero. It is because adoption is countable by a tool, while return needs somebody to have written down in advance what was supposed to change. Almost nobody did, which is why spend gets defended with usage figures.

What Actually Works

1. Tie every AI claim to a test: before a capability reaches a customer, a deck or a press release, one named person holds the evidence that it does what the sentence says.
2. Retest the control, not the policy: point an agent at the guardrail you trust most this quarter. Trusted URLs passed its audit and failed its job.
3. Write the return before the rollout: one number, one date, one owner, all agreed before the agent goes live. Adoption is not that number.
4. Give every agent an outbound list: what it can reach, what it can send, where the trail lands. If nobody can produce it in a meeting, it does not exist.

Anyone can move a room with one loud track. The set holds together because of the gear nobody photographs.

What's Coming

Claim Review Becomes A Compliance Step

The enforcement record shows the missing control was a claim-review gate tying each AI marketing claim to documented testing and an owner. Marketing copy about AI capability is heading for the same queue as financial statements. The teams who get ahead of it will be the ones who already know which claims they cannot evidence.

Agent Runtime Controls Get Their Own Budget Line

A $4 million seed for runtime controls on agents this week is what a category looks like two quarters before analysts draw a box around it. Expect procurement questions to move from which model you chose to what the thing can reach unsupervised.

Data Centre Money Starts Arriving With Terms

A development bank weighing a $300 million loan for a Brazilian data centre build is a different kind of money than venture equity. Covenants, reporting and impact conditions come with it. Once AI capacity is financed like infrastructure, the reporting obligations outlive the enthusiasm.

For Your Team

Monday's meeting prompt: ”Name one AI capability we have told a customer or a board about this year. Who holds the test that proves it, and when did they last run it?”

Share-worthy stat: An enterprise browser company raised $400 million at a $6.4 billion valuation to govern what AI agents touch, in the same week three separate surveys found adoption running ahead of governance. The controls are now better funded than the evidence that any of it paid off.

Go deeper: Track where AI money and AI claims are actually moving →

The Track of the Day

”Security, compliance, and governance have been major barriers for enterprise AI agents.”
Annie Pearl, corporate vice president of Copilot Product, on the week's biggest agent launch

That is the seller, on launch day, naming the reason the thing might sit unused. Keep the sentence for the next time a slide tells you the blocker is culture.

We scanned 190,000 articles this week so you don't have to. Data Pains → Business Gains.

Published: September 26, 2026 | Curated by Yves Mulkers @ Ins7ghts