Uber's agent gateway starts every tool switched off
Two engineering organisations published how they govern what their agents can reach, and both begin by refusing. A survey of 10,000 firms argues that readiness is an enterprise property after all.
How we Build
A tool is registered the moment it is discovered and stays switched off until its owner turns it on
Three Uber engineers describe a gateway now fronting over 800 agent tool servers and more than 5,000 tools. It was built after individual teams wired their own integrations and nothing stayed discoverable. A crawler reads the interface registry on a schedule and registers every API it finds as a tool, disabled. The tool goes live when the owning team reviews it, and any later change to its description raises a diff for that owner to approve.
We tell a client that an agent is an identity in the architecture register like any other. Somebody has to judge what it can reach.
Each agent acts as an identified identity in the architecture register, and its blast radius is computed on the assumption that everything it reads is hostile.
Uber’s registry is that register, and its policies name an agent as a caller beside humans and services rather than as traffic. What the account adds is that the judgement survived the scale: 5,000 tools, and the owning team still decides each one. It does not say how many are switched on. It computes no blast radius per agent either. The second half of that sentence stays a position rather than a finding.
Dun and Bradstreet asked 10,000 businesses in 32 countries how ready their data was and what they were getting back. Eight per cent called it fully ready. Of those, 81 per cent reported broad or strong returns, against 12 per cent of firms whose data was only partially ready. On strong returns alone it is 55 per cent against 2. Sixty-five per cent plan to raise AI spending while returns held at 28 per cent, flat on the quarter.
Our position is that readiness belongs to the use case, because a firm declaring itself ready has usually measured nothing a particular piece of work depends on.
Readiness is a property of the use case, not the enterprise.
This is a measure taken at exactly the level we say is the wrong one, and it sorted returns by a factor of nearly seven. Two things a reader should weigh. One respondent answered both the readiness question and the returns question, so some of that distance is the same person’s confidence recorded twice. And Dun and Bradstreet sells data products. It is also the second source to run this way, after two Thoughtworks engineers in September. If you think an enterprise readiness score tells you something real, or nothing at all, we would like to hear the case: transform@dromologue.ai.
How we Assure
An agent found five hundred flaws and reported only the ones it had already exploited
Google’s product security team ran an internal agent against its own web applications from January and found more than 500 cross-site scripting flaws. The design decision carries the result. When the agent proposes a flaw, a validator that is not a model fires a real payload at a running application. Only a reproduced exploit is written up. Unverified candidates stay inside the team. Applications built on the hardened framework Google published in 2025 yielded 2 in total.
Breaking your own systems first is something we ask of a client, and this is the largest first-party account of it we have seen. It is not the first. Wiz reported frontier models proving two decade-old flaws in PHP’s core in October, and Trail of Bits went the other way in September, having spent six months building tools before an audit could begin.
Attack your own agents before somebody else does.
The part worth taking is the bar rather than the 500: a product team hears about a flaw once it has been exploited, not once a model suspects it. Google is clear that the advantages are partly its own. It has a single repository an agent reads end to end, and a scanner that already signs in to nearly everything. The validators also miss whole classes, so the number is a floor on one.