If you run Zoom Workplace, the agent features Zoom announced at Zoomtopia 2026 are live today, and most of the controls you would use to govern them are still on a roadmap. ZoomMate Agent Teams, MCP servers and the Search & Ask APIs are all marked "Available now" in Zoom's October 20 roundup. Centralized AI Management and Deepfake Risk Detection are expected in December 2026, Compliance Manager support for AI notes in January 2027, and AI Guardrails in Q1 2027. For any team whose conversations fall under retention or supervision rules, the safe sequence is to wait for the controls before switching on the agents.
Zoom published several separate Zoomtopia releases on October 20, and each one labels every feature as either available now or expected in a named month or quarter. That labeling is useful. It lets you build a rollout calendar from Zoom's own words instead of a keynote demo.
What Zoom Shipped on October 20 and What It Only Dated
Six of the 26 items in Zoom's roundup are labeled available now; the rest carry dates between October 2026 and early 2027. Here is the split for the items an enterprise admin will care about, taken from Zoom's main roundup, AI release, developer release and security release:
| Feature | What it does | Zoom's label |
|---|---|---|
| ZoomMate Agent Teams | Specialized agents work in parallel; a lead agent consolidates output for human review | Available now |
| Agentic search | Answers across Zoom Meetings, Phone, Chat and 40+ third-party apps | Available now |
| MCP servers | Lets developers and AI agents act on Zoom outside the Zoom UI | Available now |
| Search & Ask APIs | Query Zoom's Unified Context Layer from outside assistants and agents | Available now |
| Sensitivity Labels (Microsoft Purview sync) | Labels meetings and content; policy follows the label | Available now for select customers |
| Connections to AI Assistants | Zoom capabilities inside Claude, Codex, Copilot and Muse | Expected October 2026 |
| Zoom Admin MCP Server | Admin tasks performed conversationally | Expected October 2026 |
| Follow Meeting | My Notes attends meetings on a user's behalf | Expected December 2026 |
| Centralized AI Management | Admin view of running agents, the data they touch, policies and audit | Expected December 2026 |
| Deepfake Risk Detection | Flags possibly altered participant audio or video | Expected December 2026 |
| Compliance Manager for My Notes and Canvas | Archives and monitors AI-generated summaries, notes and documents | Expected January 2027 |
| AI Guardrails | Account-level rules on what AI can generate or use | Expected Q1 2027 |
Agentic search is the one most people will touch first. Zoom's AI release names ServiceNow, Workday, Google Drive and Microsoft OneDrive among the connected apps. Agent Teams is the newest idea: in Zoom's description, a team lead agent coordinates specialized agents working on different parts of a project and hands the combined result to a person for review.
The developer side ships wider than the end-user side. Zoom's developer release lists 15 new AI Services APIs, Microsoft 365 Copilot support over MCP today (Google Gemini "coming soon"), and planned MCP servers for Zoom Phone, Scheduler, Mail, Calendar and Marketplace Build with no dates. On the assistant side, the AI release says users will be able to launch Zoom workflows from Claude and Codex "starting in November."
The Governance Layer Trails the Agents by Two to Five Months
Every control an admin would use to see, restrict or archive agent output is dated, and none of them is live yet. Zoom's security release describes them in more detail than the roundup:
- Centralized AI Management (December 2026) shows which agents are running and what data they access, adds account-level policies, "AI activity audit controls," and admin control over agents that users build themselves. Zoom does not say what the audit records capture.
- Custom AI Guardrails (Q1 2027) let admins keep specified information, such as sensitive financial data or a discussion of a competitor, out of AI summaries and answers even when an agent can see it. They can also require human review of client-facing AI content and exclude whole channels from AI processing. Zoom's wording is that guardrails are "designed to reduce the likelihood" that the information appears, which is a probability claim.
- Deepfake Risk Detection (December 2026) analyzes audio and video in real time and flags participants who may have been altered outside Zoom, with a confidence indicator. Zoom pitches it for job interviews and vendor impersonation calls.
- Compliance Manager for My Notes and Canvas (January 2027) archives AI-generated summaries, notes and documents for retention and supervision. Zoom's roundup footnotes it: "Zoom Compliance Manager is not a substitute for independent legal or compliance review."
One date already disagrees across sources. Reworked's recap lists the guardrails for January 2027, while Zoom's own releases say Q1 2027. Plan on the later end of Zoom's window.
The gap matters most for Follow Meeting. Zoom's AI release says it "allows users to send My Notes to attend Zoom meetings on their behalf, even when they are unavailable." That puts an AI note-taker in rooms where the person who sent it is absent, which is exactly the situation the recording-consent rulings we covered last week turn on. Follow Meeting is expected in December, the same month as Centralized AI Management, and a month before Compliance Manager can archive what it produces. In a broker-dealer or a bank, a feature that generates records you cannot yet archive should stay off.
ZoomMate Already Has a Known Agent Weak Spot
The agent surface that Agent Teams builds on has already shown a real attack path, and the fix Zoom is promising (admin policy over agents) is one of the December items. Security firm PromptArmor published research showing that a malicious Skill, or an indirect prompt injection such as a hidden instruction in an email, could make ZoomMate run code that polls an attacker's server for commands and returns meeting transcripts, messages and connector data.
Two details from that write-up should shape your rollout. PromptArmor says the agent's code environment appears to have "unrestricted HTTPS network access," with "no user or admin-level configuration to lock it down." And the attacker's connection "can remain active even if the user clicks 'stop' on the agent and closes Zoom." PromptArmor itself frames this as a consequence of intended design, saying there "does not appear to be any specific vulnerability" to report, and the aggregated coverage from August 2026 reports no known attack on a customer and no published Zoom fix.
That is the steel-man for turning things on now: no customer has been hit, and Zoom warns users when a Skill is not from its catalog. The counter is that the warning puts the decision on each user, and Agent Teams multiplies the number of agents acting on a single request. We saw the same shape in SalesBleed against Agentforce and in Manus's email-triggered agents: the exploit lives in the content the agent reads, so the control has to be egress and tool scope set by an admin.
Your Meeting Record Is Now an API Other Agents Can Query
The Unified Context Layer turns conversation data into something outside assistants can search, and that changes who can reach it. Zoom's roundup says the Search & Ask APIs let you "Query Zoom's Unified Context Layer directly from Claude, GPT, Codex, Muse, MS Copilot, Gemini, and Slackbot," and they are available now. SiliconANGLE's report describes the layer as a graph of people, topics and decisions that updates in near real time, combined with data from Salesforce, ServiceNow and Workday.
A context layer, in Zoom's usage, is the shared store of meeting, call, chat and contact-center content plus business-app records that every agent draws on. Analyst David Danto, in a broadly favorable TalkingPointz piece, puts the risk plainly: "Some of the most sensitive information in any enterprise is spoken rather than written." Once a third-party assistant can query that store, your exposure follows that assistant's permissions and logging, not only Zoom's.
This is the same pattern as Copilot Studio's agent accounts: the assistant inherits more reach than the person who invoked it expected. Treat every MCP connection into Zoom as a new integration that needs an owner and a scope, and apply the client-side allowlist approach from our MCP server governance guide. The Zoom Admin MCP Server, expected this month, deserves extra care because it performs admin tasks conversationally.
Zoom Published No Price for Any of It
None of Zoom's Zoomtopia releases names a price, a plan tier or a credit cost for a new capability. The only anchor is ZoomMate itself. No Jitter reported in June that North American online plans start at $20 per user per month, that enterprise pricing depends on deployment size and integration, and that credits are pooled across the organization. Zoom's ZoomMate product page confirms 2,200 AI credits per user per month on the paid plan and says "Some ZoomMate features are available without using credits," without listing which.
No Jitter reported that meeting summaries, Canvas and AI note-taking do not consume credits, while task automation, search, deep research and content generation do. Agent Teams, which runs several agents on a single job, is the feature most likely to burn credits fast, and Zoom has not said how many. SiliconANGLE also reports a new option to pool annual commitments across seats, apps and AI, again with no figures, and quotes Zoom's chief product officer citing internal benchmarks of 45% to 65% cost reductions versus standalone agents, which Zoom did not validate independently.
Workday did the same thing a week earlier, selling agents on Flex Credits with no published price. The pattern means the unit cost gets set in your renewal negotiation, so it is yours to fix in writing.
What to Do Before You Turn It On
This Week:
- Pull the twelve features in the table above into a one-page rollout calendar, with Zoom's label beside each, and send it to your security and records leads so nobody enables a feature on the strength of the keynote.
- In the Zoom admin portal, check whether ZoomMate Skills, Agent Teams and third-party connectors are on by default for your account, and restrict Skills to Zoom's catalog for everyone outside a named pilot group.
- Ask your Zoom account team in writing what Centralized AI Management's audit records will capture and whether any setting today limits outbound network access from ZoomMate's code environment.
This Month:
- Decide which conversations are records. Map which teams fall under retention or supervision rules, and keep Follow Meeting and My Notes off for them until Compliance Manager support ships in January 2027.
- Inventory every MCP client and assistant (Claude, Codex, Copilot, Gemini) that could query the Search & Ask APIs, and give each connection an owner and a scope before you approve it.
- Run a two-week Agent Teams pilot with five to ten users and measure credit consumption per completed task, since Zoom has published none.
Before Renewal:
- Get the credit cost of Agent Teams, agentic search and deep research written into the order form, along with overage rates and whether pooled credits carry over.
- Make the December and Q1 2027 governance features a condition of expanding ZoomMate seats, with a contractual remedy if Centralized AI Management or AI Guardrails slip past their stated window.
The Bigger Picture
Zoom is asking enterprises to make their spoken record searchable by any agent they connect, and it has been through a version of this trust question before. In August 2023 it published a commitment on its blog that it does not use customer audio, video, chat and other communications to train its own or third-party AI models. That pledge is about model training. What a connected assistant can retrieve from the Unified Context Layer is a separate question that the 2023 pledge does not answer.
The pattern across this fall's vendor conferences is consistent. Dreamforce 2026 led with agent operations, Workday Rising with credits, and Zoomtopia with agents that ship ahead of their admin controls. In each case the admin controls are dated later than the features they govern. Zoom's labels at least give you the schedule, so line your rollout up against the governance dates.
Put the December and January dates on your calendar, and hold Follow Meeting until both have shipped.
Continue Reading
- Best AI Note-Taker After Otter's Wiretap Ruling Is Already Licensed
- Copilot Studio Agent Accounts Share Memory Past File Permissions
- Workday Rising 2026 Sells Agents on Credits With No Published Price
- MCP Server Governance: Enforce at the Client, Not the Registry
- Agent Audit Logging: Platform Logs Miss the Decision You Must Prove
- Dreamforce 2026 Shipped Agent Operations, Not the Headline Model
