Agents get a badge now

Hey there 👋

I read the CrowdStrike announcement three times looking for the tool, and there isn't one. There's a certification. For five weeks the agent news has been about break-ins and identity: who the agent is, whose keys it holds, what happens when it forges the logs. This week the story quietly changed lanes. It stopped being about security incidents and started being about purchase orders.

Here's my bias, for what it's worth. A certification you don't control is a convenience, not a proof. It saves you an evaluation you were dreading, and it hands the definition of 'safe enough' to whoever owns the checklist. That can be a fine trade. It is still a trade, and it is worth knowing you made it before an agent you didn't build is running in your stack with a badge on it.

So today is about procurement. How agents get sold, certified, and wired in. Let's get into it.

The Big Thing

CrowdStrike will certify agents you didn't build

At Fal.Con on Monday, CrowdStrike launched an AI Partner Specialization inside its Accelerate Partner Program, and the piece that matters is a new Verified Agent certification. Partners build agents on the Falcon platform using Charlotte AI AgentWorks and Falcon Foundry, put them through CrowdStrike's requirements, and the ones that pass earn Verified Agent status and a slot in the CrowdStrike Marketplace.

Strip the partner-program language and the mechanism is simple. Until now, if you wanted a third-party security agent touching your environment, you ran your own evaluation: scope, permissions, blast radius, the whole bespoke review. CrowdStrike is offering to do that review once, stamp the agent, and let every customer inherit the stamp. For a security team drowning in agent pitches, a shared certification is a real shortcut.

That shortcut is also the catch. It's CrowdStrike's bar, defined by CrowdStrike, running on CrowdStrike's platform, and the requirements aren't independently audited by anyone outside the company. A Verified Agent badge tells you the agent cleared one vendor's checklist. It does not tell you the checklist matches your risk tolerance, your data residency rules, or the specific way your environment breaks. Believe the mechanism, grade the badge yourself.

The strategic read is that CrowdStrike wants to be where agents get bought, the same way it became where endpoints get watched. Verified Agent plus a Marketplace is an app-store move for the agentic era, and app stores are how you turn a platform into a toll road. Every partner who certifies makes the next buyer likelier to shop inside the Marketplace instead of building. That's good for buyers who want fewer decisions and good for CrowdStrike either way.

Ship it? Watch. This is a certification and a channel, not something you deploy on Wednesday. If you already standardize on CrowdStrike, the useful move this week is on your side of the fence: list the security runbooks you'd hand to an agent first, triage, enrichment, low-risk remediation, and see which ones map to a Verified Agent that already exists. Do not rebuild your whole agent-procurement process around one vendor's certification yet. One stamp is a starting point. Build the policy around it yourself.

Sources: CrowdStrike press release + investor relations, Fal.Con 2026 (Aug 31).

Tour de Headlines

🛠️ NCS ships an agent factory for the ops team. Singapore's NCS added Sunshine.core to its Sunshine.AI suite, a platform to build and run production-grade agents, and pushed agentic upgrades into Sunshine.coder, Sunshine.operations, and Sunshine.productivity. The reported wins are the boring, valuable kind: more code shipped per engineer, fewer IT incidents escalated to a human. The pattern to copy is the scoping. One agent per domain, wired straight into the systems that domain already runs on, rather than one god-agent that supposedly does everything. Regional launch, but the shape travels.

💶 Money keeps landing on the orchestration layer. Amsterdam's Conversed.ai raised a growth round to push its AI Agent Optimization Studio across Europe. The pitch is lifecycle management: take a standalone bot and turn it into a monitored, improvable production assistant wired to voice, email, ticketing, and the systems of record underneath, CRM, ERP, even EHR in regulated shops. The signal for builders is where the capital is going. It's flowing into the plumbing that keeps an agent alive and accountable after launch. Agents are being sold as products with a lifespan now, things you operate for years.

🤝 B2B agents start talking to each other. ZG Group and Tencent's WorkBuddy team launched NextB2B, billed as the first full-process B2B agent on WorkBuddy, with modules for procurement, sales, back office, and operations. The headline feature is agent-to-agent transactions, one company's buying agent negotiating with another's selling agent. Read the fine print: A2A here is still on the roadmap. It's a direction worth tracking, because agents that transact without a human in the loop is either the next big efficiency or the next big incident, and probably both. Grade it as a plan for now.

Tool of the Day

⚡ Microsoft Agent Lightning

Train the agent you already have with reinforcement learning, almost no code changes.

Most teams tune agents by hand-editing prompts until the demo looks good, which is exactly why the agent then face-plants on real inputs. Microsoft Research's Agent Lightning is an open-source trainer that takes a different route. It wraps an agent you already have, whether you built it on LangChain, the OpenAI Agents SDK, AutoGen, or from scratch, streams its real runs and rewards to a training server, and improves it with reinforcement learning at almost zero code change. You can even train just one step of a multi-step agent, say the query-writing step, and leave the rest alone. If your agent works most of the time and you can't figure out why it fails the rest, this is the honest fix: learn from what really happened instead of guessing at a better prompt.

Get it on GitHub

Worth a Click

• The 90,000-employee rollout everyone is copying: Cisco's MyAgent playbook (rolled out over the summer, reference read). Route each task to the cheapest capable model, run much of it on-prem for cost and control, keep humans supervising the autonomy. The cost-routing detail is the part worth stealing.
• Why your agent passed the demo and failed in prod: a sharp writeup of the reliability gap. Benchmarks in the 90s collapse in production on tool calls that fail mid-loop, context that decays over long sessions, and metrics the agent quietly learns to game. The fix is adversarial testing and real telemetry rather than a higher benchmark score. It's one engineer's analysis, so grade the exact numbers, but the failure modes are the right ones to worry about.
• One format for skills and MCP configs: Agent Plugins v1.0.0, an open standard from OpenAI with AWS, Cursor, GitHub, VS Code, and Vercel. It packages Agent Skills and MCP server configs into one portable file that works across OpenAI, Cursor, GitHub, VS Code, Hermes, and OpenClaw. Less rewiring every time you switch clients.

The arc turned this week. For five weeks the question was who the agent is and whether you can trust it. Now it's how you buy one, and who signs off on the one you didn't build. Remember that a certification is somebody else's confidence, rented to you by the month.

— Ron