The UK Says a Cyber Breach Is "Likely, If Not Inevitable". Google Opens the Doors for AI Agents Into Gmail and Drive.

On Monday 12 October Kanishka Narayan, the UK's AI minister, gave his first major speech at Imperial College London, and the government published the measures alongside it. The line that led the coverage: "It seems likely, if not inevitable, that our own cyber defences will be breached." He gave the example of an OpenAI agent, software that carries out a task step by step on its own, researching public spending on medicines: "It arrived on a government website where restrictions were placed on what it could access, so it found another way in." No personal medical records are known to have been accessed.

The measures are mostly for government and for operators of essential services. Two government pilots using advanced AI to find weaknesses have, in the speech's words, "helped identify and address more than a thousand vulnerabilities", and will be extended. The government will look at strengthening the Cyber Security and Resilience Bill to cover "AI loss of control risk", defined in the release as autonomous systems evading human oversight, and will work out how serious AI incidents and near misses get reported. The National Cyber Security Centre and the AI Security Institute will plan how to respond to incidents involving AI agents, which the release says could escalate faster and spread wider than other major incidents. To the companies building the most powerful models: "if you can't adequately control the risks, do not release the system."

For business owners there are three specific asks. The minister: "I want cybersecurity discussed in every boardroom in Britain, rather than simply delegated to middle management." The release repeats the government's open letter to business leaders from earlier this year: make cyber security a top-level priority, get the basics right with Cyber Essentials, and follow NCSC advice and join its Early Warning service. Cyber Minister Liz Lloyd called it "business-critical to ensure you're on the front-foot when it comes to cyber security." The same day the Home Secretary told the Commons: "to businesses in an increasingly online world, consider the cyber threat that you face and strengthen your defences."

On 12 October Google Cloud sent a mandatory service announcement to every organisation with an app connected to Google Workspace. It says Google "will soon roll out the Google Workspace Model Context Protocol (MCP) servers, which expose new functionality to external AI Agents across Gmail, Drive, Calendar, and other Workspace apps". MCP is a common plug, a standard way for an AI tool to connect to other software. Google's developer guide, updated 9 October, lists one server each for Gmail, Drive, Docs, Sheets, Slides, Calendar, Chat and Contacts, says they let agents such as Claude search emails, retrieve files, list calendar events, create draft emails, upload files and schedule meetings "under the user's own permissions", and marks them as a developer preview.

The notice adds a new switch. From 12 October a developer can mark an app's connection to Google as "agentic", using a checkbox labelled "Use this client for an AI-powered agent", so that Google "and Workspace administrators can differentiate AI agent traffic from traditional app traffic". From 11 November Google "will reject requests to Workspace MCP servers from OAuth clients that are not marked as agentic", with an error saying "the client isn't marked as an AI agent". From 12 November the setting is permanent on existing connections. Apps that only use the ordinary Gmail or Drive interfaces, with no agent, need do nothing.

Google's help page says the point is that separate identities for people and agents "ensures clean monitoring" and "allows enterprise administrators to apply granular access and security policies to AI agents". It also says marking a connection as an agent "does not grant additional scopes or privileges to access user data": the agent still needs the user's consent and Google's app review.

On 12 October Google announced "next steps" on the Google Meet post-meeting screen, powered by Gemini and Workspace Studio, Google's no-code automation builder. When a meeting that used "Take notes for me" ends, a section called "Routines for this meeting" offers one-tap follow-ups. The first two are drafting a follow-up email in Gmail and exporting the meeting's action items to Google Tasks, with more promised. Turn one on for a recurring meeting and it runs after every future meeting in the series; the first time you turn one on, Workspace Studio emails you a confirmation.

The follow-up email is drafted, not sent. Google's help page says you get a Google Chat notification when a "draft emails" step completes, and the draft sits in Gmail for you to check and send. There are conditions: it works on a computer, the meeting must be a Google Calendar event with "Take notes for me" and "Ask Gemini" on, and the email draft only appears when you are the host, the meeting is not part of a repeating series and at least one participant is outside your organisation, which is the client meeting case.

It is available on Business Standard and Plus, Enterprise Standard and Plus and the Google AI Pro for Education add-on, so not Business Starter. It is on by default; an admin can switch it off for the domain, a department or a group through the Workspace Studio or Take Notes for Me settings. Rollout started on 5 October and can take more than 15 days to reach every account.