The Willow team is off to @CrowdStrike Fal.Con Europe in Barcelona next week.
I had my chief of staff agent go through our customer calls from the past 30 days before departing to gather some insights.
It seems that everyone has employees plugging AI into their email, crm and some even prod envs. They know they can't block everything. This isn't a viable option in 2026.
A customer told me "i dont know if we're going to end up blocking it all but i want to know whats going on."
Treat your model as a privileged user just as George Kurtz mentioned. Yes each agent will need to have its own identity with permissions to what it needs and be tied back to a person. That's how its going to have to be. No way around this.
If you'll be there and this is on your mind, ping me - happy to grab a coffee ☕️ x 🏕️
Every person in my company has permission and the means to build anything.
That’s the difference between true AI native companies and sleepy incumbents.
You see, back in the old days, you sweated your ass off and created a beautiful roadmap. Every item was categorized, graded, and backed by deep reasoning and thought. Q2 would be X, Y, and Z. Your team sprinted for three months building X, Y, and Z, you shipped it, and everyone applauded. 👏👏👏
Those were the good ol' days I tell ya! 👴
But these days you can ship X, Y and Z over a weekend.
Which is awesome… until you’re the CEO of a product company. How do you stick to your true north?
The problem with being able to do anything is that your product ends up looking like a Swiss Army knife from Temu. And nobody wants that! (believe me, don't get that). People want a Japanese santoku for slicing and dicing, a Swedish wrench for loosening stuck pipes, and scissors that actually cut.
We’re trying something to keep our product roadmap both nimble and narrow:
Everything engineering builds goes out hidden first.
Users don’t see it. We do. Once a week we look at what was built, choose what we want to test, and release it to users.
Everything else stays hidden until we release it or kill it.
Permission to build anything these days is cheap. Everyone has it.
Shipping selectively is the only reason Willow still makes sense to the people using it.
Don't let your agents run destructive tools without a human approval in the loop! It's that easy. This is the default behavior of our Salesforce connector.
👉 3 min setup at @withwillowai
“Our leadership went from no AI to ‘use AI as much as you want,’ and now I’m playing catch-up.”
A VP of Security at a 1,500-person company shared this note with me last week.
AI is rolling out faster than security can review. This is such a cliché. But clichés are clichés for a reason.
To stay competitive, you can’t really block the rollout of cowork, chatgpt, or [insert-your agentic-tool-of-choice].
Stop playing defense.
Stop waiting for your existing vendor to catch up.
Companies that want to stay relevant in this race can’t afford to wait on the sidelines for the next 12 months. AGI is here and you need to replace your manual workflows with automated ones. (This is me just stating the obvious here again).
Go trial multiple vendors and just pick your winner.
p.s. we usually win ✌️
Eyal Ben Ezra retweeted
Assorted things I've been mulling over regarding agents in the economy:
• Companies are in some sense the original superintelligence. It's often the case that they can use their amortized cognitive surplus to advance their interests against those of certain consumers: relative to the optimization capacity of companies, consumers can be inattentive, underinformed, irrational, etc. (Think, say, of some of the classic insurance upsells at the end of a booking process, which is typically priced substantially above what a regular policy would cost.) Herbert Simon introduced the idea of bounded rationality, and firms often end up benefiting from it. Thanks to personal agents, we will probably get somewhat more rational in how we engage with companies.
• How exactly will outcomes change? Well, certain kinds of price discrimination will work less well (how do coupons work if every agent hunts fastidiously for them?), and certain kinds of customer cross-subsidy will change (today, people who forget to cancel subscriptions subsidize those who don't). Taken across the economy as a whole, I'm not sure what the incidence of all of this will be.
• In corporate strategy, people have long debated the relative importance of distribution and product quality. Perhaps you've made something better, but does anyone know about it? Won't people just continue to buy the ACME Corp Mousetraps? Personal agents will, I think, act as a kind of structural subsidy for product quality. How would markets look different if individuals always spent at least 10 hours researching their purchases? On the margin, focusing on making a product better is, I think, going to become a more effective strategy for companies. This is good!
• It true, a corollary is that information about product quality will become more important and impactful. Today, most people have very limited ability to aggregate and integrate such data, but agents will have insatiable thirst for such signals. (It's often said that data is becoming more valuable because it helps in the training of models. That's obviously true, but I think there's a secondary way in which it's more valuable simply as a complement to cheaper intelligence.)
• A big question is whether agents will increase superstar effects (rational agents all settle on the same product) or increase dispersion (because everyone has slightly different tastes and preferences, which agents are good at eliciting, finally overcoming the artificial clustering we've been subjected to).
• Many internet companies have monetized demand routing, which is in turn often predicated on short attention spans. "I'll click on the first thing I see." This has led to some amount of inefficiency, as companies try to propitiate capricious ranking algorithms and incur various placement fees. It's not all deadweight loss (willingness to pay is itself a kind of signal, which is valuable to buyers), but it's not great. How will the nature and value of this routing change in a world of personal agents? I don't know the answer, but I think that the effects might be pretty big.
• Much of what I'm writing hinges on the assumption that personal agents will be on the consumer's side. I suspect that that will be the winning strategy, but whether it's true, and what it means to be true, involves a lot of other questions.
Taken as a whole, the market is a massively parallelized, decentralized, and highly imperfect value attribution machine, and, taking stock of all of the effects, it seems to me that the quality point may well be the biggest: that agents will change the nature of the backpropagation such that the rewards for better products increase. Maybe this is too optimistic, but I suspect (and hope) that companies that make things that they're proud of will feel that the universe is a little more partisan in their favor.
Eyal Ben Ezra retweeted
"We think the best team size is one, because a single author can do things that is impossible to do for teams, and hit high notes that are unreachable." — @tobi
We now run more than 100 background agents at Willow.
(Top performer this month gets a model upgrade instead of a $ bonus)
Building them was easy. Keeping them in line in production? Not so much.
An agent fails at 2am. In the morning you want to know one thing: which call broke, and why?
The first thing you do is trace the call. Willow's Logs Explorer helps by surfacing possible reasons why a call might have failed:
- Failed tool calls
- Calls blocked by guards
- Slow tool calls
- Rate limits
Calls that didn't go through the gateway at all.
Once you found the call, you used to open the raw JSON. A sea of text. You know something happened, but it was not easy to pin point what exactly happened.
Today we're excited to show: Tool Call Flow.
It makes it super easy to reason about what happened to a specific agent. Just open it in Monitor, and you'll see the visualization of the call flow, with all the approvals, guards, and the MCP server in the path. Click on any of them to see timing and token stats.
Go give it it a spin!
16 g2 badges this fall. the one i care about is best support.
you can't game that one. it means someone was in the slack channel at 11pm when something broke.
thanks to our customers, and to the team that answers every time.
"Shadow AI discovery on the endpoint is table stakes." - I've heard this line almost verbatim several times in the past few weeks from various buyers.
That’s on point. Almost all vendors will scan your workforce endpoints and render a list of AI agents, skills and MCPs that weren’t approved by IT.
The endpoint story is just one piece of the AI boom puzzle. As agent runtime moves to the cloud, the gateway architecture is the right choice.
Personal assistants such as instinct and muse are making a huge wave in the b2c world. It’s just a couple of weeks until we see the same thing happening for b2b. If you've experienced it, the feeling is of a ChatGPT moment happening again. Something about the UX has magic baked into it.
The runtime for these new breed of assistants is the cloud - not the endpoint. This is where the future is headed. And in this future if you don’t centralize access with an MCP gateway you’re losing the battle over safe AI usage.
Willow’s MCP gateway is best in class and built for real enterprise scale. It already powers millions of tool calls with low latency. Don’t take my word for it - go read our G2 reviews.
88% of orgs have already had an AI agent security incident. 92% of the breached ones had no access controls on their agents. (Gravitee, IBM)
The agents are already inside. Most are ungoverned.
Willow just joined @okta's Cross App Access. Connections now flow through Okta identity: least privilege, full audit, instant cutoff.
On-prem had Active Directory. SaaS had Okta. Agents need the same layer.
Safe browser use is a huge unlock for AI agent productivity.
Most work still happens through web interfaces. Until MCP catches up with what websites already do, the browser is where the longtail of work gets done.
Claude in Chrome gives your agent the power to tap into the browser. The issue is that it can log in with your employees creds with zero guardrails. Salesforce, Gmail, Jira, and god forbid - your AWS console - all these are up for grabs. Read and write included.
Until today, as an org admin you were able to set a url allowlist and turn “act without asking" on or off. But there is no effective middle ground that lets you say yes to this powerful feature without compromising your AI risk posture.
That’s why we’re shipping Willow for Chrome. A FREE browser extension.
As an admin it gives you per-app, per-action, per-user policy for every website Claude can touch:
→ Allow agents to read Salesforce on the browser 𝗕𝗨𝗧 Block any writes.
→ Allow agents to create an email draft in Gmail 𝗕𝗨𝗧 Require a human approval before it gets sent send.
→ Block AWS entirely, or any site that fails your risk bar.
Go put a leash on Claude in Chrome usage in your org - it’s 100% FREE. Open source. 🏕️
MCP is the abstraction layer AI needs in order to run in a controlled and safe env. Sure, you can give the agent an api key and a rest endpoint but don't do that if you care about the outcome.
In most companies I speak with, 5% of people are driving the company forward with AI. Those 5% consume the most tokens (way more than the rest). They try the new tools as they come out.
→ Talk to the CISO? They'll call this "Shadow AI."
→ Talk to the CIO? They'll refer to it as bottom up innovation.
The 5% are paving the way for the other 95%. And paving a new road means moving faster than control can follow. Meanwhile the other 95% are stuck in place or quietly rebuilding what the 5% already built.
The CIOs I talk to want the same thing: take what the 5% created and hand it to the other 95%, safely. You can't do that without knowing what the 5% are building. You can't do that when your visibility is not in sync with enablement.
@withwillowai brings both under the same roof 🏕️
My company runs more than 50+ Background AI agents.
Not copilots.
Not chatbots.
Actual agents, doing real work in the background.
A year ago this would have sounded reckless. 50 agents with access to production, customer data, and the CRM?
It works because none of them run on trust. Every agent has an identity, a scope for exactly its task, and an audit trail back to a human. We govern them the way we tell our customers to.











