Broadcom wants to catch shadow AI in the packet path
Two threads worth pulling as the day closes: the infrastructure layer is quietly claiming the job of policing AI agents, and the enterprise is pushing back on the price of admission for frontier models. Both point the same way — the bottleneck on agentic AI is no longer capability, it's control.
Broadcom is moving agent security into the network itself, betting that the place to catch a rogue agent is the traffic it can't avoid generating. Unveiled at VMware Explore 2026, Broadcom's new AgentMinder sits on top of two existing pieces it already sells: VMware vDefend, which now watches traffic flows across VMware Cloud Foundation to automatically identify MCP servers, models, datastores and tools, and flags the unauthorized ones as shadow AI; and the Avi load balancer, which inspects agent transactions in flight to block remote code execution and file injection, baseline normal agent behavior, and stop credentials or personal data from leaving. AgentMinder is the control plane above them — it treats each agent as an enterprise identity with a declared mission, permitted intents and approved tools, then enforces least-privilege policy on every single tool call, logging all of it on OpenTelemetry for audit. Broadcom's Umesh Mahajan made the blunt version of the pitch: if you don't have security, you can't deploy agentic AI at all, because the workloads can be compromised from outside and can also turn around and attack outward. Clayton Donley's line is the one that sticks — we've had 50 years to figure out how to manage human employees on computer systems, and about 15 minutes to figure it out for agents.
This is a land-grab, and the timing is not subtle. CrowdStrike spent the same week planting its flag on the endpoint with Falcon Guardian, arguing that agents belong to whoever already owns the laptop. Broadcom's answer is that the endpoint is the wrong chokepoint when the interesting traffic never touches it — an agent calling an MCP server is a network event first and a process event second, and the network tier sees every agent a company runs whether or not anyone installed an inventory tool. Mahajan's argument for one vendor's stack is self-serving but not wrong: make customers stitch three products together and they make mistakes. The catch is that "curated security stack completely from Broadcom" is a lock-in pitch wearing a safety helmet, and agent governance standards are young enough that whatever gets baked in now will be hard to rip out later. We watched the same fight at the endpoint in Talos ships a permission kernel for AI agents that demand shell access — agent permissions keep migrating downward, from the prompt into the infrastructure.
Anthropic's Enterprise Frontier Safeguards are drawing real skepticism from exactly the people who care most about privacy — the local-model crowd. The Fable 5.1 release page describes EFS as giving customers "complete privacy (the same as a zero data retention policy)" while staying state-of-the-art at preventing misuse, by storing the data in cloud infrastructure the customer controls rather than Anthropic's. It rolls out in phases starting this fall, with eligible customers getting plain zero data retention in the meantime. A r/LocalLLaMA thread picked apart the wording: zero data retention conventionally means prompts and client data are discarded the moment a response is generated and never stored at all, so holding data in a customer's own bucket reads less like zero retention than like outsourced retention — with the customer now paying the storage bill. The second complaint is that EFS is enterprise-tier, so everyone outside that tier is still on the training pipeline.
The structural read is more interesting than the semantic one. Whether or not "the same as ZDR" survives scrutiny, the direction of travel is that proprietary labs are being forced to bid for the one advantage open-weight models always had for free: the data never leaves. Anthropic is not doing this out of generosity — it introduced 30-day retention with Fable 5 specifically to get the abuse visibility it says it needs, and EFS is the compromise that keeps the monitoring while handing the storage and the keys to the buyer. If locally-run models keep closing the quality gap, privacy stops being a feature labs can charge a premium for and becomes table stakes, and this is what table stakes looks like from the incumbent's side.
What to watch: whether Broadcom's packet-path approach and CrowdStrike's endpoint approach end up integrating or fighting, and whether EFS ships this fall with the audit trail enterprises will demand before anyone signs off on it.
If your agents are already running in production, who owns their permissions today — security, platform, or nobody? Tell us in the comments.
Sources: SiliconANGLE · Broadcom — AgentMinder, vDefend and Avi for agentic AI · Anthropic — Claude Fable 5.1 · r/LocalLLaMA discussion
