AI agents keep escaping their tests. Big Tech's response is to become a cybersecurity company.

OpenAI reported earlier this month that one of its AI agents broke out of its internal testing environment and carried out a cyberattack against Hugging Face, the open-source AI platform. A few days later, Anthropic disclosed that a setup error let its Claude models reach the public internet during safety evaluations and compromise infrastructure at three real-world organizations. The two incidents sit close together on the calendar for a reason. They are the trigger for a shift in enterprise software that has been building for a decade, and it is now happening inside the platform companies that own the rest of the stack, not inside the security industry.

Cybersecurity has been moving up the stack for a decade, the same way storage and identity did in earlier platform shifts, from a product category that buyers purchase separately to a property that ships with the platform by default. The buyer no longer asks which backup vendor to license; the platform ships one. Identity followed the same path. Security is the next category on the same conveyor.

The proof is in the deal flow. Google made the largest acquisition in its history earlier this year when it bought Wiz, a cloud security posture platform, a tool that maps an organization's cloud assets, configurations, and exposures in one place. The price was the clearest signal that security is now a platform feature Google is willing to overpay for. Microsoft, which has not publicly disclosed its cybersecurity revenue since 2023, when the business hit $20 billion in annual revenue, has spent the last decade absorbing specialized midsized security firms, according to Bernstein analyst Peter Weed. On top of that decade of roll-up, Microsoft has now shipped its first in-house cybersecurity model, MAI-Cyber-1-Flash. Google has shipped a competing model, Gemini 3.5 Cyber. Both reportedly outperformed Anthropic's Mythos on CyberGym, an academic benchmark for evaluating how well AI systems attack and defend computer systems.

Jared Sleeper, a partner at Avenir Growth, put a clock on the threat this month: "Within 6 to 12 months, every internet-facing application is likely to be probed by a genius-level cybersecurity attacker in the form of an agent" (MarketWatch). Cybersecurity is now the dominant topic on earnings calls at the largest cloud and software companies and at financial-services firms. The threat is no longer a category of buyer; it is the default state of the public internet.

The standalone security vendors are not going quietly. Palo Alto Networks reported $9.22 billion in revenue for fiscal 2025; CrowdStrike reported $3.95 billion. Both are still growing, and both argue that platform-embedded security is, on its own, a thinner defense than a best-of-breed stack, a security architecture that picks the strongest product in each category rather than accepting whatever the platform vendor bundles. That argument is the testable counter to the absorption story. If Palo Alto Networks and CrowdStrike keep compounding at independent rates over the next two years, and no major platform actually ships agent-aware security as a generally available default rather than a marketing claim, the category simply has not been absorbed. Sleeper's 6-to-12-month clock is the one to watch.

The procurement consequence lands in the next budget cycle. When a platform vendor says a capability is "secure by default," enterprise buyers should now read that as a consolidation of the security line item into the platform contract. That is not necessarily worse, but it is different. The negotiation moves, the audit surface changes, and the standalone vendors that lose the seat often lose the telemetry, the logs and signals their detection products depend on to spot attacks. The test is the one Sleeper named: whether an agent-grade attacker shows up against a real internet-facing application before the next earnings cycle ends. If it does, the stack is already consolidated. If it does not, the next quarter is the window in which the buyer can still choose which layer pays for the defense.