Google is treating AI security as a live operating problem

Google is not pretending AI security is solved. That is the useful part.

At a recent event in Los Angeles, Google Cloud COO Francis deSouza told TechCrunch that enterprises are still in a transition period and that security has to be part of the platform from the start. The point is simple enough to sound obvious and still be missed in practice: once AI systems start moving through internal tools, data stores, and workflows, security stops being a late-stage review item and becomes an operating constraint.

DeSouza's warning was not a vague call for caution. He pointed to shadow AI, governance gaps, auditability, and the risk that agents will surface data and systems nobody has looked at in years. That is the part worth taking seriously. The most dangerous thing about agentic systems is not that they are magical. It is that they make old organizational sloppiness visible at machine speed.

The normal enterprise security stack was built around slower humans, slower access patterns, and a cleaner idea of where data lived. Agents break that assumption. If a system can search, plan, call tools, and move across services without waiting for a person to click each step, then the security model has to be able to trace identity, permissions, logging, and revocation with the same speed.

Google's own public messaging now reflects that shift. In a Cloud CISO Perspectives post tied to Next '26, deSouza says the enterprise has entered the agentic era and that the mission-critical front line has shifted to securing models, agents, and the data that fuels them. The company also lays out a concrete stack around that idea: Agent Identity, Agent Gateway, Model Armor, agent sandboxing, observability, evaluation, and other tooling meant to keep delegated systems inside a governed perimeter.

That is the part worth reading as market signal. Google is no longer describing AI security as a compliance sidebar. It is packaging it as core infrastructure for the agentic enterprise. The message is not "trust the demo." It is "if you want autonomy in production, the platform has to carry the weight of policy, identity, and audit trails."

The TechCrunch reporting lands that point in a less polished way. DeSouza warns that the attack surface now includes models, data pipelines, prompts, and agents, and says the old perimeter model is too slow for what is coming. He also says agents roaming internal systems can surface forgotten repositories and access controls that nobody has touched in years. That is not a theoretical risk. It is a pretty good description of what happens when software gets to search more of the company than the company remembers it owns.

There is an awkward tension here, and it makes the story better. Google is telling enterprises to move to machine-speed defense while also describing the products it believes will help them do it. That does not make the advice wrong. It does mean the advice and the sales pitch are intertwined. The company is not only naming the problem; it is defining the layer it wants to sell around the problem.

The real takeaway is narrower and more interesting than "AI is insecure." It is that the security discussion has moved from whether AI should be allowed into the business to what kind of security architecture makes delegated action survivable. Humans can still review and override. They just cannot be the only control plane anymore.

That is why the boring-sounding details matter. Identity. Access boundaries. Prompt filtering. Audit logs. Model governance. Rollback. If those are weak, autonomy becomes a liability multiplier. If they are strong, the business can do something new without pretending the old controls still fit.

This is where Google sounds almost conservative. The company is saying the agentic future does not begin with bigger promises. It begins with better plumbing. That is probably the right take. It is also an admission that the industry spent a lot of time talking about capability before it had done enough work on control.

The short version: Google is not talking about AI security like a feature. It is talking about it like the operating system the feature depends on. That is where the market is now, whether people like the pace or not.

Takeaways

• Google is treating AI security as a platform problem, not a bolt-on feature.
• Agentic systems force identity, auditability, and revocation to run at machine speed.
• Google is both naming the problem and selling the control layer around it.

Source basis

• TechCrunch, May 24, 2026: reported Francis deSouza saying AI security cannot be bolted on later, warning about shadow AI, governance and auditability, and arguing that agents can expose forgotten internal data assets.
• Google Cloud Blog, April 2026: Francis deSouza described the agentic enterprise, said security must cover models, agents, and the data that fuels them, and framed the problem as a machine-speed security issue.
• Google Cloud Next 2026 Wrap Up, April 25, 2026: Google announced Agentic Defense, Agent Identity, Agent Gateway, Model Armor, and related security tooling for the agentic era.