BUSINESS

Egiziago Cioffi is the IT and Enterprise Architect and CEO of SynSphere Italia, a Microsoft partner based in Milan. He built an agent himself. He wrote the indexing job, configured the Azure OpenAI retrieval pipeline, connected it to SharePoint, and watched it pass every evaluation his team ran.His Azure OpenAI email assistant auto-resolves about 60% of inbound customer email, Cioffi told VentureBeat in written responses to our interview questions. The evaluation scores were clean, and the unit tests passed. None of them asked the question that mattered.Cioffi ran a low-privilege account against the same questions a high-privilege account had already put to the assistant. The outputs did not match. The assistant returned SharePoint content the requesting user could not have opened in SharePoint on their own. The logs told a different story than the evaluation scores.Cioffi’s retrieval logs are the evidence for this specific production failure. What follows is independent data showing the failure class is not isolated.In many production RAG deployments, the agent answers with the indexer’s permissions, not the requester’sAzure AI Search has shipped native document-level ACL trimming via Entra-based tokens since preview in May 2025, and SharePoint ACL sync followed in a later preview. The capability exists; however, it does not exist everywhere it needs to.The SharePoint ACL preview can now ingest site-group metadata via the spg: prefix in the 2026-05-01-preview API. However, only Entra-backed principals are documented as reliably enforced at query time. The preview runs through the REST API and preview SDKs and does not cover all agent deployment paths. Azure OpenAI On Your Data, for example, supports document-level access via Azure AI Search security filters, but Microsoft’s own documentation states that if the permitted-groups field is not mapped, document-level access is disabled. That is a fail-open default in a first-party path. Custom RAG pipelines that bypass Azure AI Search entirely still index under a broadly privileged service account with no query-time entitlement check unless the developer builds one. Cioffi’s deployment took the custom-pipeline path.Across production agents at scale, 91% of successful attacks ended in silent data exfiltrationStraiker’s red team ran more than 1,700 successful exploit attempts against production agents and published the results in its inaugural STAR Labs Threat Report in July. The 91% figure from their research measures all successful attacks on productivity agents that ended in data exfiltration without detection. It is a measure of what happened after an exploit succeeded, not a measure of how many deployments fail to enforce retrieval-time entitlements specifically.Across the productivity agents in scope, 91% of successful attacks ended in silent data exfiltration, with the report noting no malware had been required. There was also no lateral movement through the network. The agent returned all the data it could reach. Straiker’s report does not break out which of those successes trace to entitlement failures specifically versus prompt injection, tool abuse, or other attack classes. Working independently, the U.K.’s AI Security Institute documented 19 unsanctioned agent actions from a July 25 to 28 cyber evaluation. The UKASI published its incident report on August 4 of this year. The evaluation deliberately ran with cyber classifiers disabled and internet access enabled. What the UKASI report demonstrates is agents acting outside the scope their deployers intended, in a permissive test environment, with no reliable mechanism to catch the deviation before it causes damage. It is a containment failure, not a retrieval-entitlement failure, and the overlap with the Cioffi incident is the shared absence of a runtime scope check rather than an identical mechanism.Why evaluations miss this and why the native fix did not reach Cioffi’s deploymentThe evaluations Cioffi’s team ran were designed to test whether the agent answers correctly. They check factual accuracy, relevance, and task completion. They do not ask whose permissions the retrieval pipeline uses when it fetches the source material, because that question is not in the evaluation framework.Azure AI Search is currently shipping the retrieval-time entitlement check at the platform level. The query-time ACL trimming validates the caller’s Entra token, extracts user and group claims, and returns only documents whose synchronized permission metadata grants the caller access. For deployments that use Azure AI Search with the SharePoint indexer and Entra-backed principals, the control exists natively. Cioffi’s deployment did not use this path. His custom Azure OpenAI retrieval pipeline bypassed the native trimming layer, which is how the gap survived every evaluation his team ran.From the attacker’s side, this is a broken access control. Adriel Desautels, founder and CEO of Netragard, told VentureBeat in written responses that the failure reduces to a structural collapse of authorization boundaries. “If the NHI credentials usually have broad authorization and can read high privilege data then that is then stored in their index,” Desautels wrote. “If an app does not enforce identity-aware retrieval, then a ‘normal’ user with lower permissions can query the app and access otherwise restricted data. This collapses authorization boundaries down to the lowest privilege level with search capability.”That gap is what Cioffi’s low-privilege test exposed. The assistant’s context window contained SharePoint content the low-privilege account could not have retrieved through SharePoint directly. The evaluation had passed. The retrieval permission boundary had not been enforced.Desautels put the evaluation blind spot in operational terms. “Agents tend to run a single, long-lived, non-human identity that holds a wide range of permissions that it might need for any task it is ever asked to complete,” he wrote. “Evaluations also don’t often cover prompts, outputs, transcripts, memory, and logs where it can be read or hijacked through injected content. That mismatch is what most current evaluations get wrong.”Cioffi’s filter narrowed the assistant’s retrieval scope. It still resolves roughly 60% of emailCioffi’s fix did not require a new identity platform. He moved the entitlement decision into the retrieval path itself, adding a query-path filter that checks the requesting user’s SharePoint permissions before the model sees a chunk. The filter runs at query time, not at index time. Content the user could not open in SharePoint does not enter the model’s context window.The control narrowed what the assistant could reach. The assistant still auto-resolves roughly 60% of inbound email with the filter live, Cioffi told VentureBeat. He did not provide a before-the-filter auto-resolution figure for comparison. The qualitative tradeoff he described is that some content the assistant previously used to answer questions is now excluded because the requesting user’s permissions do not reach it. That is the price of enforcing the boundary.The question of whether retrieval-time entitlement filtering is worth the narrowed retrieval scope does not have a single answer. It depends on the sensitivity of the indexed content, the permission variance across the user population, and whether the deployment can tolerate unanswered queries when the filter blocks a chunk the model needs. What Cioffi’s incident demonstrates is that the gap exists in custom Azure OpenAI pipelines, that answer-quality evaluations do not catch it, and that a query-path filter closes it at a trade-off the builder can describe.Identity governance platforms address a different layer. Both controls are neededCrowdStrike announced its $740 million acquisition of SGNL on January 8, 2026, and closed the deal on February 20, 2026. Palo Alto Networks announced its $25 billion acquisition of CyberArk in July 2025 and closed the deal on February 11, 2026. Both deals closed the same month, establishing identity security as a platform pillar at two of the largest security vendors in the world.Identity governance platforms focus on which service accounts exist, what they can reach, and when their tokens expire. They govern the lifecycle of the credentials that power AI agents. That layer matters. What it does not govern is the retrieval permission boundary. That is the moment a correctly scoped service account retrieves content on behalf of a user who holds fewer permissions than the indexing job does.Every credential in the chain is legitimate. The service account is clean and properly managed. The knowledge base is correctly indexed. A low-privilege user queries the assistant, and it answers from the full indexed scope. Nothing flags the retrieval because no credential was misused.Cioffi’s filter is a control at the retrieval permission boundary layer specifically. Azure AI Search’s native ACL trimming addresses the same layer for deployments that use it. Neither replaces identity governance. A production deployment that wants to close both the credential lifecycle gap and the retrieval-time entitlement gap needs controls at both layers.One question and one test, any security team can run Ask whose permissions each AI retrieval system uses when it fetches content. If the deployment uses Azure AI Search with the SharePoint indexer and Entra-backed principals, verify that query-time ACL trimming is enabled and that the user population does not depend on SharePoint site groups. If the deployment uses a custom retrieval pipeline, the entitlement check may not exist at all.Start by proving the answer from a low-privilege account. Run the same question a high-privilege account has already put to the assistant. Compare the outputs against what the low-privilege account can access through the underlying system directly.Desautels confirmed that this is where a red team would start. “The first test would likely target the gaps between data and instructions, and the gaps between the user’s identity and the assistant’s own credentials,” he wrote. “We’d attempt to plant an instruction within content that we think the assistant will ingest as data. We’d have that content direct a side-effectful, privileged action that the attacking user is not authorized to perform.” A failing result, in Desautels’ assessment, is “the successful or even partial execution of our injected commands.”If the assistant returns more than the account’s direct access would allow, the retrieval permission boundary is not enforced at query time. That test costs two accounts and thirty minutes. It produces a result an evaluation score cannot replicate.Cioffi built the agent on a custom Azure OpenAI pipeline that bypassed the native ACL trimming layer. He ran every evaluation his team had. He found the gap in his own logs after all of them passed. The evaluation tested whether the agent answered correctly. It did not test whose permissions the agent was using. Run the two-account comparison before the next deployment goes live. Thirty minutes tells you which side of the line you are on.

Two albums by the band Deftones, ‘Around the Fur’ and ‘Private Music,’ return to the charts in the U.K., while a third set, ‘White Pony,’ also climbs.

Taylor Sheridan’s hit crime drama “Tulsa King,” starring Sylvester Stallone, is returning to Paramount+ next month.

MongoDB Inc. will report its Q2 2027 earnings after the market close on Sept. 1, 2026, offering clues into how this database giant is holding up in the face of market-wide malaise with software names.

Here are the numbers that analysts are looking for after the market closes:

Revenue: $733.68 million

Earnings per share: $1.61

Live updates will be published here as they come available. This page will update automatically with the latest updates.

Credo Technology Group will report earnings after the market close on Sept. 1, 2026, offering fresh insights into how the producer of high-speed connectivity products is benefiting from the boom in AI infrastructure spending.

Here are the mean results that analysts are looking for, per LSEG:

Revenue: $471.77 million

Earnings per share: $1.17

Live updates will be published here as results come available. This page will update automatically with updates.

Tesla has had a rough year by its own standards. Profits are shrinking, cash flow has turned negative, and the stock has trailed nearly every one of its Magnificent 7 peers.

A new policy out of Washington has nothing to do with cars, robots, or chips, yet it could still hand Tesla’s energy business a real opening.

President’s power grid order could benefit Tesla energy storage

On Aug. 26, President Donald Trump declared a national emergency and signed an executive order aimed at keeping foreign-made equipment off the U.S. power grid, Utility Dive reported.

The order covers transformers, inverters, battery storage systems, circuit breakers, generators, turbines, and the software that runs them. Cybersecurity and sabotage risks were cited as the rationale.

Any transaction involving equipment from a “Covered Foreign Entity” after Aug. 26 falls under the restrictions. The Department of Energy now has up to 180 days to spell out exactly which countries, companies, and products are covered, according to the White House.

Until that rule lands, utilities are left guessing about the order’s full scope.

More Tesla:

Tesla sales rebound hides costly problem for investors

Tesla record revenue masks cash burn, $1B SpaceX swing

Elon Musk, Tesla and SpaceX face serious questions from investors

The order also reaches equipment already installed across the grid. Energy Secretary Chris Wright has been directed to identify existing foreign-made equipment that poses risks. He must also recommend remedies, which could range from additional monitoring to outright removal, giving utilities an incentive to start lining up domestic alternatives now rather than later, Utility Dive reported.

China’s dominance in key underlying supply chains makes the stakes clearer. The country accounts for roughly 80% of global lithium-ion battery production capacity and 85% of solar manufacturing capacity.

This means that any serious push toward domestic sourcing could have significant implications for energy developers and the utilities powering the U.S. grid, Quartz reported.

Why Tesla’s energy business could be a winner

Tesla is one of a handful of U.S. companies with an existing, at-scale grid battery storage product, which is why analysts see it as a potential beneficiary of the policy shift. The company’s Energy Generation and Storage business has become its fastest-growing major segment, and Wall Street has increasingly built that growth into its valuation models, Fox Business reported.

RBC’s own sum-of-the-parts model for Tesla assigned 15% of the company’s valuation to Megapack energy storage, alongside 52% for Robotaxis and 27% for full self-driving software, with the traditional car business making up just 6%, TheStreet reported.

That weighting shows how far Tesla’s own investor base has already shifted away from thinking of it purely as an automaker.

Demand for that storage capacity has been climbing independent of any policy change. UBS analyst Joseph Spak projected 15.1 gigawatt-hours of energy storage deployment in the first quarter alone at the time, up 45% year over year, driven by grid upgrades and AI data center demand, even as the same analyst kept a Sell rating on the stock overall, according to TheStreet.

A separate 25-gigawatt-hour Megapack supply deal with NatPower, announced ahead of Tesla’s second-quarter earnings, further reinforced energy storage as one of the company’s more established growth engines.

Tesla’s supply chain complicates the clean domestic-winner narrative. The company has reportedly committed to sourcing at least 20 gigawatt-hours of battery cells from China’s CATL for stationary storage between 2026 and 2028, representing roughly 30% of Tesla Energy’s projected cell needs.

This shows that Tesla is not entirely insulated from the same foreign-sourcing questions the executive order is meant to address.

Whatever tailwind the grid order provides will need to work against a genuinely difficult year for Tesla stock.Xiaolu/Getty Images

Tesla’s stock still has a rough 2026 to explain

Tesla shares were up roughly 12% over the past 12 months but have fallen nearly 18% so far in 2026, while badly trailing the S&P 500’s roughly 12% year to date. Shares have remained roughly 26% below their all-time high of $498.83, set in December 2025, according to Barchart.

Tesla’s second-quarter 2026 earnings, released July 22, explain why. Revenue climbed 26% year over year to a record $28.24 billion, beating Wall Street estimates, yet the stock still fell roughly 5% the next session as profitability came in far weaker than expected, Barchart noted.

Free cash flow went negative $1.09 billion for the quarter. A year earlier it was positive $146 million. The first quarter of 2026 had come in at positive $1.44 billion. That reversal in three quarters, not the revenue beat, is the number that spooked investors, according to Barchart.

Some of Tesla’s reported net income also reflects unrealized SpaceX equity gains, rather than cash the business actually generated.

Capital expenditures told the same story from a different angle. Spending jumped 142% year over year to $5.79 billion, up from $2.39 billion in the prior-year quarter. This reflects the scale of Tesla’s simultaneous bets on Robotaxis, humanoid robots, and semiconductor manufacturing, Utility Dive reported.

What Tesla investors should watch next

The executive order is best treated as a potential long-term tailwind rather than an immediate catalyst. The Department of Energy’s rulemaking process will not conclude for months, and any resulting shift in utility purchasing habits toward domestic suppliers will take additional time to translate to Tesla’s actual order backlog.

The more immediate signal to track is whether Megapack deployment growth continues to outpace the rest of Tesla’s business in upcoming quarterly reports, since that is the segment most directly positioned to benefit if utilities start favoring U.S.-linked suppliers.

Investors should also watch how quickly the Department of Energy names specific covered entities, since a narrow list would blunt the policy’s practical impact on Tesla’s addressable market.

Tesla’s next earnings report, expected in October, will be the first real opportunity to see whether energy storage bookings show any measurable shift tied to the new rules, or whether the order remains mostly a headline-level opportunity layered on top of a business still working through a difficult year on the car side.

Related: Morgan Stanley sends a blunt Tesla message to investors

Investors are wondering if Broadcom will update its AI revenue guidance, and how durable growth in its AI business will be going forward, J.P. Morgan says.

An unrelenting rout has global bond yields touching their highest levels since 2008, driving up borrowing costs for households, businesses and world governments.

Sabrina Carpenter’s ‘Man’s Best Friend’ hits one year on the U.K. albums chart — one week after ‘Short N’ Sweet’ celebrated two years on the same ranking.

The announcement sent its stock soaring.