Ciaran led the NCSC for its first four years after spending two years setting it up, and his own awakening to cyber goes back to the ILOVEYOU worm hitting his remote access laptop as a junior Treasury official in 2000.

We start with how governments learned to talk about cyber, from the UK’s first national cybersecurity strategy in 2009 and its budget of five million pounds, to a problem Ciaran says has endured. Senior decision makers avoid asking hard questions about technology because they’re afraid of looking stupid, and he no longer believes a new generation of leaders will fix that on its own.

From there we get into his piece From Frenzy to Freakout and the idea that two things are true at once. Frontier AI is a very significant change for attackers, and the reaction to it has been one of the biggest outbreaks of cyber FUD in over a decade.

Ciaran argues we keep forgetting there are two sides to everything AI touches, the AI itself and the computer networks it lands on, and that almost all cyber harms are visible. In his view there has been no discernible rise in disruptive attacks in the six months since Mythos, and the ShinyHunters arrests that followed the apparent FBI compromise are a reminder that tools have operators and operators can be found.

We recorded this conversation in early October, a couple of weeks before PHP2Shell and the “Black October” label took over the feeds. Ciaran has since called PHP2Shell very, very bad and asked what the reaction will be if something very bad but entirely precedented like NotPetya or WannaCry actually happens, and I think the conversation holds up well against this past week.

We close on software liability and the inverted pyramid of responsibility, what happens if he turns out to be wrong, and what CISOs should say when their boards ask whether AI is about to hack everything.

Prefer to listen?

Apple Podcasts

Spotify

Please be sure to subscribe and leave a rating/review, as it truly helps the show!

We discuss:

• Ciaran’s path from generalist UK civil servant to founding the NCSC, which just turned ten

• The ILOVEYOU worm in 2000, the helplessness it exposed, and the UK’s first national cybersecurity strategy in 2009

• How government moved past vague talk of public-private partnerships to address real market failures, through Heartbleed and Log4Shell

• Why top decision makers avoid hard technology questions, and why Ciaran no longer sees it as a generational problem

• From Frenzy to Freakout, and how frontier AI can be a real shift for attackers and a FUD outbreak at the same time

• Six months since the delayed Mythos rollout, the 27-year-old bug, and the $20,000 in tokens Marcus Hutchins pointed to

• Why Ciaran thinks phishing training is on its last days as AI automates phishing

• The cult of the machine god, the New York Times reporting on Anthropic’s meetings with religious leaders, and cybersecurity as a pragmatic profession

• Arvind Narayanan and Sayash Kapoor’s AI as Normal Technology framework, and whether security treats agentic attacks as a solved problem

• Alignment, whose values it aligns to, and the risk of concentrating power over a new technology in a few hands

• Intent versus accountability, Secure by Design, and why software has sat outside product liability for decades

• The inverted pyramid of responsibility that puts the greatest burden on the humble user

• How a minor Australian story led global news while the apparent FBI compromise barely registered

• ShinyHunters, the arrests that followed, and why the people behind the tools can be got at

• Why “you should see what we’re seeing in the wild” doesn’t hold up for disruptive attacks

• Why the window never closes, and what happens if Ciaran is wrong

• Lessons from WannaCry and NotPetya in 2017, and the day Heathrow’s Terminal 5 went down

• What CISOs should tell their boards, starting with “what harm are you worried about?”

Key Takeaways

The thing AI touches

“I just think at the heart of this is a lack of recognition that there are two sides to everything that AI touches. One is AI, and the other is the thing it touches. And in cyber and economics and medicine, but this is a cyber show and we’re both cyber people, we just forgot the thing it touches, computer networks. Some of them are terribly defended, some of them are well defended, it matters.”

This is the part of our conversation I’d most like practitioners to hold onto. Much of the coverage this year has focused on what the models can do, with far less attention on the environments they’re being pointed at, and a capable model running into a well segmented network with least privilege and good credential hygiene is a very different story from the same model running into an environment carrying decades of unaddressed issues.

That’s why I’ve been framing AI as a security technical debt collector, cashing in on the vulnerabilities, misconfigurations and poor hygiene our industry never got around to fixing, which I dug into in From Vulnpocalypse to Breachpocalypse?. Ciaran’s point fits that framing well, because when you read an AI threat claim, how well defended the target was matters at least as much as how capable the model is.

Disruptive harm is visible

“With the exception of nation state espionage operations, almost all cyber harms are visible either immediately or subsequently.”

“So has there been a discernible rise in disruptive cyber attacks in the six months since Mythos? No. Provably no.”

We recorded this before PHP2Shell and the Black October label took off, and I think Ciaran’s point has held up. We are clearly seeing highly impactful vulnerabilities in software that sits underneath a huge share of the internet, and that deserves attention. So far, though, exploitation has been fairly limited when you measure it by real-world disruption and impact, and we haven’t seen the critical services citizens depend on every day knocked offline, which is exactly the kind of harm Ciaran says we would be able to see.

Where I’d add some nuance is that several of the recent AI-enabled incidents I walked through in my essay sit outside the datasets we normally use to measure exploitation, and loss data like insurance claims tends to lag. So I’ll be watching that data closely over the coming months, and until it shows a real shift, I’d rather save the alarm for when the evidence warrants it.

Remember the attackers

“Until we’ve mentioned ShinyHunters, we’ve been talking half an hour. We have not mentioned a threat actor group.”

“There are tools, and they may be low-tech like ShinyHunters, they may be high-tech like open weights models... But people at the end of those tools with adversarial intent can be got at in all sorts of different ways. And this is what we miss.”

Ciaran’s observation that we went half an hour without mentioning a threat actor group is an accurate picture of how a lot of AI security conversations go right now. So much of the discourse centers on the model and its capabilities that we lose sight of who is actually using these tools and what it costs them, and as Ciaran points out, attackers have objectives and tend to reach them in the cheapest and most effective way available.

When every conversation revolves around the model, security teams lose some of the threat-informed thinking that should drive how they prioritize, along with an appreciation for the levers that sit outside their own networks, such as law enforcement and deterrence. The ShinyHunters arrests are a good reminder that the people behind the tools can be found, and that should factor into how we think about risk.

The inverted pyramid of responsibility

“We’ve always inverted the pyramid of responsibility in cybersecurity... we always put the greatest burden on the shoulders of those least able to bear it, the humble user.”

“But if we end up there for AI, then we don’t have a chance.”

This is a topic I care a lot about, having spent much of my career in the public sector, from the Air Force to working with federal agencies and serving as a CISA Cyber Innovation Fellow. For decades we’ve asked end users to avoid clicking links and to juggle long, unique passwords, while the organizations building the software and infrastructure everyone depends on have carried very little liability for shoddy security. Secure by Design was an effort to shift more of that burden back to the vendors, and Ciaran’s reference to the Cyber Safety Review Board’s report on Microsoft’s 2023 breach is a good illustration of why that shift is needed.

AI products are software, and I don’t see a reason for frontier AI labs to operate under a different set of expectations than the rest of the technology industry. You can’t outsource accountability, and if we let AI inherit the same inverted model of responsibility, we’ll be repeating the mistakes we’ve spent the last several years trying to correct.

Decisions, not apocalypse

“If there’s a really serious deterioration in cybersecurity, that’s because of a set of bad decisions that we collectively made. And so we need to make the right decisions.”

“This is security and this is technology. The window never closes.”

I’ve spent much of this year arguing that security can’t afford to be a laggard with AI, so I take the capabilities seriously, and so does Ciaran, who was clear in our conversation that he does think this is a big deal. Where we agree is that how this plays out comes down to the decisions we make, and framing it as a window that is about to close does little to help organizations make those decisions well.

It’s also fair to look at who is amplifying the closing window message. As I mentioned during our conversation, OpenAI has invested heavily in its security business, and many of the letter’s signatories are cybersecurity vendors with a commercial interest in heightened concern, which should factor into how we weigh it. Cybersecurity has always been about managing risk to an acceptable level, and as Ciaran puts it, the window never closes because there will always be innovation and dynamism on both sides.

What to tell the board

“I think the best question to start with is what harm are you worried about?”

“If all this fails, what do you want this to look like? And how can we make sure that we are at fifty percent within twenty four hours rather than at naught percent in twenty four weeks?”

Many security leaders are heading into board conversations shaped by AI headlines, and I think Ciaran’s starting question is a useful way to ground them. Asking what harm the board is actually worried about moves the discussion away from hypotheticals about what a model might do and toward what could actually disrupt the business and what would limit the damage if something does get in.

His closing point is also a big part of why this show is called Resilient Cyber. No organization is going to prevent every incident, with or without AI in the picture, so planning for how quickly the business can get back on its feet when something does get through is the kind of practical conversation boards should be having.

Thank you again to for joining me and for being so generous with his time. I’d love to have him back to dig further into Secure by Design, software liability and incentives, and in the meantime you can follow his work on LinkedIn and on his Substack.

Ciaran Martin

LinkedIn

Substack:

Ciaran's Crispy Cogitations

Mostly cyber security. Occasionally constitutional politics. Very occasionally crisps. From the former/founding head of the UK National Cyber Security Centre; now at the University of Oxford

By Ciaran Martin

Timestamps

0:00 Introduction

1:37 Ciaran’s background and the NCSC at ten

2:29 The ILOVEYOU worm and government’s slow start

4:19 Why leaders avoid hard technology questions

6:30 From Frenzy to Freakout

8:49 Six months since Mythos and the 27-year-old bug

10:50 Two sides to everything AI touches

12:56 The cult of the machine god and a pragmatic profession

15:21 AI as Normal Technology and “solved” agentic attacks

20:32 Alignment and whose values

21:23 Concentration of power

22:22 Intent, accountability and software liability

24:19 The inverted pyramid of responsibility

25:11 Australia, the FBI and misplaced attention

27:08 ShinyHunters and remembering the attackers

30:52 “You should see what we’re seeing in the wild”

31:26 Why disruptive harm is visible

34:04 Devil’s advocate on commoditized capability

35:07 Always around the corner

38:20 Why the window never closes

39:55 What if I’m wrong

40:45 WannaCry, NotPetya and lessons from 2017

43:18 What CISOs should tell their boards

45:00 Closing thoughts

Subscribe now

That said, the last week or so has made that data point feel a lot less comfortable. On October 19th, former NSA Cybersecurity Director Rob Joyce posted on X that the “Transition from vulpocalypse to breachpocalypse is here,” pointing to a Chinese-speaking hacker who used AI agents to break into more than 100 company websites for roughly $50 a hack.

Transition from vulpocalypse to breachpocalypse is here.

Rob Joyce, former NSA Cybersecurity Director

Over the same few weeks we saw AI-assisted attacks on Latin American and South Korean financial institutions, Microsoft attributing a ConnectWise supply chain compromise to a China-aligned actor running an agentic AI framework, and a run of critical, decades-old vulnerabilities in some of the most widely deployed software on the internet. By October 22nd a good portion of X had started calling it “Black October.”

In this article, I want to walk through what happened this month, lay out the data from both the skeptics and those who think the breach wave is already here, and then explain why I think the answer to “who is right” matters less than what security does next.

So, let’s walk through it!

Black October

The label took off quickly, going from 137 posts on X on October 21st to 9,717 the next day, and CNBC ran it in a headline the following morning.

I want to be upfront that I’m not sure I agree with the Black October framing, at least in the way it is being used. We are clearly seeing highly impactful vulnerabilities, disclosures and findings in software that sits underneath a huge share of the internet, and that deserves attention.

So far, though, actual exploitation remains fairly limited when you measure it by real-world disruption and impact, and we haven’t yet seen many of the critical institutions and services that citizens depend on every day disrupted. , the founding head of the UK’s National Cyber Security Centre, captured this well in a LinkedIn post this week, asking what the reaction will be if something very bad but “entirely precedented” actually happens, such as NotPetya, WannaCry or the ransomware crisis of 2021, when a major vulnerability alert, weak private keys in India and some data breaches are already being called Black October. I think that is the right question to keep in mind, and it’s why I’d rather save the alarm for when it is warranted.

With that caveat, the cluster is still worth understanding. The centerpiece was PHP2Shell, a pair of unauthenticated remote code execution flaws affecting PHP versions back to 2012, found with help from GPT-5.6 Sol through OpenAI’s Patch the Planet effort and independently by Wiz, and AWS observed an exploitation attempt in its honeypots four days before disclosure. GitLab patched a CVSS 10.0 flaw present since 2014 that traces back to Onigmo, the regex engine built into Ruby, while Node2Shell, a Brotli decoder bug in Node.js found by OpenAI’s Codex Security team, dates to 2018.

On the supply chain side, LiteLLM shipped a malicious, credential-stealing release on October 21st after a master key accidentally committed to a public repository in May was never revoked. I covered the PHP2Shell arc in more depth in The Resilient Brief #119.

Anthropic Deputy CISO , wrote on October 22nd that things “are going to get a lot worse before they get better,” urging security leaders to go to their boards for help with the basics rather than with AI, and to hold on for roughly 18 months.

...going to get a lot worse before they get better.

Jason Clinton, Anthropic Deputy CISO

When someone asked what changes after that, he replied “vulnzero,” predicting that small, cheap models will let all software development “stop shipping security bugs permanently.” Jason is an incredible security leader for our community and I mean no disrespect, but I have a hard time agreeing with that part of his prediction, for reasons I’ll come back to below.

The Debt Comes Due

When I joined Fox Business last week, I framed AI as a security debt collector, cashing in on decades of vulnerabilities, misconfigurations, and poor hygiene that we as an industry never got around to fixing, which I wrote about in Newsletter #118 and came back to in #119.

Whatever we end up calling this month, it is a good picture of what it looks like when the collector starts knocking on the door.

Look at the ages of the bugs. PHP code paths going back to 2012, a GitLab flaw present since 2014 and a Brotli line written in 2018 all surfaced in the same few weeks, after surviving years of human review and plenty of scanning, and the LiteLLM key sat unrevoked for five months.

What AI changed is the cost of finding them, and in several cases of exploiting them, at the same moment our ability to remediate stayed roughly where it was.

This lines up with conversations I’ve been having all year, starting with walking me through the Zero Day Clock back in March. When came back on the show in July for Slopdemic, Not Vulnpocalypse (Yet), he argued that “the vulnpocalypse was already here, it just sort of wasn’t evenly distributed,” and that what AI changed was the economics of discovery.

That is the debt collector framing in a sentence, and it is also why I keep pointing to fix rates, like Glasswing finding 26,153 vulnerabilities with just 202 fixed, or 0.8%, which I walked through in The Remediation Receipts.

The vulnpocalypse was already here, it just sort of wasn’t evenly distributed.

Casey Ellis, Bugcrowd founder

So the question this article is really asking is whether that debt is now being collected through breaches as well as disclosures.

The Vulnpocalypse That Wasn’t (Yet)

The strongest case for the skeptics comes from Root Evidence’s Vulnpocalypse Report, which looked at every CVE published from 2018 through mid-July 2026. Of 253,912 CVEs, only 3,769 had confirmed exploitation, or 1.48%, and in every complete year the share of exploited CVEs stayed below 2.2%, even as annual CVE volume grew 2.5 times.

Root Evidence also found that for n-days first exploited in 2026, attackers waited a median of 116 days from patch availability to first exploitation, up from 24 days in 2018, though the distribution is bimodal, with 33.5% exploited within 30 days of a patch.

In a recent conversation, Root Evidence CEO Jeremiah Grossman told me he tracked new KEVs per month using VulnCheck’s data as a public ground truth and found them flat, and that across the cyber insurance claims data he sees, he can only tie roughly 600 CVEs to financial loss, with “no spike” so far.

He was candid that claims data may be a lagging indicator, and if exploitation and losses do climb, he expects AI will be the cause.

Google Threat Intelligence Group (GTIG) research looks different on the surface. Monthly disclosures doubled from 5,045 in January 2026 to 10,740 in August, and exploitation rose from an average of 10.5 vulnerabilities per month in 2025 to 18 per month in 2026.

Yet only 0.23% of 2026 disclosures were observed in active exploitation, and since May exploitation growth has closely tracked disclosure growth rather than outpacing it. Put Root Evidence and GTIG side by side and both can be true at once, since the share of vulnerabilities exploited is flat while the absolute count is climbing because the pool itself doubled.

Neither dataset covers October yet.

Breaches Without CVEs

The incidents from the last couple of weeks are where I think the conversation needs to shift, because most of them would barely register in KEV-style data at all.

Start with the campaign Rob pointed to. NorForge researcher Snorre Fagerland found more than 20 exposed panels of Cairn, an open-source AI agent platform, being used for malicious activity, and his write-up describes a Chinese-language operator running over 1,100 attack projects hunting for unauthenticated remote code execution through SQL injection, deserialization and similar web application flaws, with success rates around 10%.

Reuters reported that the agents breached over 100 companies, including Deere, SharkNinja and Cummins. One intrusion ran through a deserialization gadget chain in legacy Zend Framework components, the kind of custom-app flaw that often never surfaces as a CVE at all, and exactly the sort of debt the collector goes after first.

The other incidents follow a similar pattern. Straiker found the CyberCartel group using a multi-agent system built on models including Claude and Grok against more than 400 Latin American financial targets, CrowdStrike found an attacker using ARTEX, an open-source agentic pentest framework, to breach South Korean financial institutions, and Microsoft attributed the ConnectWise Cloud Backup compromise to Storm-0940, whose agents attempted sign-ins to more than 2,250 tenants at 2,900 attempts per minute, in some cases reaching privileged cloud access in under three hours.

These are techniques attackers have used for years, and Microsoft’s own description is that ARTEX accelerated an existing toolset to machine speed. If we only measure the AI threat through CVE exploitation rates, we may be looking for it in the wrong place.

This is consistent with what the frontier labs themselves have been reporting. Anthropic’s September threat intelligence report found that sophisticated attacks no longer require sophisticated attackers, with autonomous attack operations now spread across every class of actor it investigated, and none of the operations depending on an entirely novel technique.

Autonomy compresses the cost of an attack while leaving payoffs largely unchanged, which fits the debt collector framing, since a debt that was never worth an attacker’s time to collect at human labor rates becomes worth collecting at $50 a hack.

The Skeptics’ Strongest Points

I want to give the skeptics their due, because their arguments are better than they often get credit for. In a recent conversation, Ciaran made a point that is hard to argue with.

Disruptive cyber attacks are, by definition, visible, so if AI were producing a wave of them we would see networks going down, and he hasn’t seen a discernible rise in disruptive attacks in the six months since the Mythos announcement.

He also pointed out that the tools have operators, and operators can be found, arrested, and deterred, which the October incidents actually reinforce, since NorForge found many of the attackers had left their own control panels wide open on the internet.

, whom I had on the show this summer to discuss why restricting AI makes us less secure, came at the same question from the damages side in a piece this week. He points out that global fraud and hacking damages roughly tripled over the past decade, yet that growth tapered after ChatGPT and open-weight models arrived, and he argues any AI security policy proposal needs to explain why we haven’t seen a discontinuity in damages since.

His explanation centers on the attacker rather than the model, since initial access is just one step in a criminal business that still has to handle lateral movement, extortion, negotiation and laundering.

The calm before many potential storms.

Joshua Saxe

The impact data so far supports some caution as well, since Reuters could not determine how much data, if any, was extracted in the Cairn intrusions, and Microsoft notes that the majority of Storm-0940’s targeting wasn’t successful.

Where This Is Headed

My honest read is that the data doesn’t fully settle the debate yet, and I’d be skeptical of anyone telling you it does with certainty. The most recent incidents largely sit outside the datasets we use to measure exploitation, and the confirmed impact is still thinner than the headlines suggest.

Most of the uncertainty is about timing, though, and every source in this piece points the same way on adoption. Attackers will adopt AI broadly because it lets them scale their operations while spending far less effort per target. Josh expects the apocalypse to be “slow-moving” and calls this “the calm before many potential storms,” and Jason’s 18 month horizon is another estimate of the same window, with both of them arguing we should use it.

I also want to be careful about hyperbole in either direction, whether that is the sky falling or AI solving all of our problems. I’m genuinely optimistic that AI can and will help defenders in a lot of ways, including lowering the cost of finding and fixing bugs.

has made the case that open-weight models could be one of the best tools we have for diffusing AI to cyber defenders over the next few years, especially in places like sensitive government agencies where air-gapped networks rule out closed APIs, while acknowledging that open and closed models both carry risk.

AI is also stressing the ecosystem, through the industrialized discovery of decades of security technical debt and the democratization of cyber capabilities for attackers and defenders alike.

That is why I struggle with the vulnzero prediction, even though I hope Jason is right and I’m wrong.

As I wrote on LinkedIn, vulnerabilities have never been purely a code generation problem. Incomplete asset inventories, missing owners, end-of-life systems that can’t be patched and compatibility testing all sit outside what a better model can fix on its own, while the volume of code is exploding, with GitHub’s COO saying in April that the platform was on pace for 14 billion commits this year.

Add the remediation numbers I mentioned earlier, and I think the harder problems sit in the organizational realities of how we patch, own and maintain software, which are systemic across both open source and the enterprise. That is where much of our real work remains.

Sergej’s Verifier’s Law helps explain why that work is so much harder on the defensive side. Sergej argues that AI advances fastest where checking a result is cheap, and that offense has the cheapest verifier in cybersecurity, since you either popped a shell or you didn’t, while defenders validate in a space that is expensive, ambiguous and slow. I’d add that defense is far more nuanced than any single verifier captures, involving people, process and technology, internal politics, and competing priorities like speed to market and revenue, along with bureaucracy in the form of governance committees, change reviews and approvals that an attacker never has to sit through.

An attacker needs one working path, while a defender has to get a fix owned, tested, approved and deployed inside an organization with its own incentives, and that asymmetry disadvantages defenders in ways a better model alone won’t close.

As I’ve written before, our industry has a long track record of watching the business adopt Cloud, Mobile, SaaS, and whatever comes next while we hand-wring over the risks, only to bolt security on after the fact.

We can’t afford that posture with AI, because this time the adversary is adopting the technology at least as fast as the business is. AWS put it bluntly in its PHP2Shell guidance, telling teams to measure patch and mitigation timelines in hours, since a 7-day or 30-day SLA assumes a delay that no longer exists.

In practice, that means prioritizing what actually matters, because no organization is going to patch everything at the volume we’re now seeing.

I’d start with what is known to be exploited, then what is actually exploitable and reachable in your environment, and put real effort into limiting attack surface and the blast radius when something does get through.

AI can help with every one of those, from correlating threat intelligence to tracing reachability and tightening permissions, and that is where I’d point it first.

of Latio offers a good way to start that conversation internally in his piece on the recent incidents, boiling the response down to three questions, what can you patch within an hour, what is the mitigation for what you can’t patch, and how would you detect exploitation.

None of this removes the fundamentals. Least privilege, credential hygiene, secrets management, and hardened perimeters would have blunted most of what is described above, and revoking one leaked LiteLLM key in May would have changed that story entirely. That is also why I agree with Jason’s call to go to the board for the basics.

The opportunity is to do those fundamentals at the speed and scale the adversary now operates at, and that requires security teams to be early adopters and builders with AI rather than the last function in the enterprise to get comfortable with it.

Closing Thoughts

It of course is debatable whether Black October marks the transition to a breachpocalypse or whether we are simply watching the same attacks get cheaper, and I’ll be watching the data that Jeremiah, GTIG, and others publish over the coming months.

That said, it is clear where adversaries are headed, and decades of security technical debt are coming due whether we’re ready or not. I remain optimistic about what AI can do for defenders, as long as we pair it with the unglamorous, systemic work of owning, maintaining and prioritizing the software we already have.

Waiting for the losses to show up in the actuarial data before we act would be repeating the same mistake our industry has made with every prior wave of technology.

Do we really want to be the laggards again, this time against an adversary that isn’t waiting for us?

Subscribe now

This week belonged to PHP2Shell, two critical flaws in the PHP engine that let an unauthenticated attacker run code on a server, in a language W3Techs says is used by 69.3% of websites whose server-side language it can identify. Details leaked a day before the coordinated release, and Cloudflare co-founder and CEO Matthew Prince shared that his network saw thousands of exploitation attempts in the 10 hours before the announcement, tens of thousands in the first 45 minutes after it, hundreds of thousands within two hours, and “millions now.”

AWS reported an exploitation attempt against its honeypots dating back to October 17, four days before disclosure, and made a point I fully agree with, that patch timelines for critical internet-facing systems now have to be measured in hours, since AI makes it cheaper to turn a patch diff into a working exploit.

If you want a feel for how the rest of the week went, the X user fiveoutofnine walked through the whole string of events in one long breathless post, which Ethan Mollick amplified as a visible sign of attack and defense accelerating at inhuman speeds. The Dutch NCSC took its own website offline, as did the Dutch parliament and the Port of Rotterdam, Finland and France pulled government sites, and Wikimedia shut down supporting services.

The same week GitLab patched a CVSS 10.0 bug reaching back to 2014, LiteLLM 1.107.0 shipped a credential stealer through PyPI and Docker, Railway paused every deployment on its platform, and we learned some eMudhra intermediate CA private keys were numbers as small as 4.

Many of those outages, of course, were defenders choosing to go offline, which is exactly what CISA’s alert told organizations to do if they couldn’t patch. That’s a sign of a system responding to risk as intended, even if it was a messy day for a lot of teams.

Earlier in the week, former NSA Cybersecurity Director Rob Joyce posted that the transition “to breachpocalypse is here,” pointing to the Reuters story below about a single hacker compromising 100+ sites with AI agents for about $50 each.

I’m honestly not sure that’s true yet.

Justin Elze made the point last week that these predictions keep assuming defenders are standing still, which is fair, and Bishop Fox’s data in the AppSec section shows exploitation growing far more slowly than disclosures.

That said, things do seem to be escalating in some ways. This issue has an AI agent campaign against 100+ companies, an open source AI pentest tool tied to attacks on around 80 Japanese firms, an open-weight model outscoring a gated frontier model on an offensive benchmark, Microsoft saying attackers are getting AI’s advantages first, and OpenAI’s own coding agents switching off the monitors meant to watch them.

Let’s get into it!

Cyber Leadership & Market Dynamics

Anthropic Pitches Its Own Frontier AI Safety Bill

There’s been a hot debate this year around regulating AI or not, and the motives of the frontier corporations who’ve been advocating for it, such as being concerned about open-weight models threatening their business models as open source only lags the frontier by 4-7 months and closing.

News broke this past week that Anthropic had been quietly pitching lawmakers a draft of their own AI safety bill, where the government could block a model that posed an “imminent” risk of more than $1 billion in damages or more than 50 deaths or serious injuries. It would also involve independent evaluators working through the Commerce Department.

While this isn’t likely to pass in the current administration, it is a glimpse of what the frontier corporations are advocating for and of course comes with a TON of questions about how those potential damages and deaths are being projected or modeled and what this means for open-weight models, given they don’t have a corporation in front of them to go work through the process, pushback against claims of imminent risk and so on.

For those interested, you can read the draft here.

Also, Dario took the time to post a thoughtful response on X to critics, and agree or not, his response seems genuine.

G7 Finance Leaders Plan AI Cyber Tabletop Exercises

International leaders continue to discuss and speculate about the potential impacts and risks of AI on governments and digital ecosystems.

News broke that G7 finance leaders were in agreement to run tabletop exercises on AI cyber attackers at an annual IMF gathering. While I think a lot of the hype around existential risks of AI has been overblown, there are real risks to digital systems from AI, and as I noted on Fox Business myself, AI and agents are going to function as technical debt collectors going around and collecting on decades of ignored security concerns across organizations, as they continue to industrialize vulnerability discovery and soon exploitation.

Cyber Funding Nearly Doubles in 3Q26

Matthew Ball shared Omdia figures showing $5.52bn was invested in 166 pre-IPO cybersecurity vendors in 3Q26, up 87% on 2Q26 and 85% year on year. The 10 largest rounds took 61% of funding, led by Keyfactor at $1bn, and exits included Visa agreeing to buy BioCatch for $2.4bn.

Jay McBain’s Oct 16 piece on the same Omdia data adds that funding through September reached $12.57 billion, about 30% above the same period in 2025. He also notes Omdia counts 63 private vendors with more than $300 million in cumulative funding, totaling $41.6 billion raised.

That’s some incredibly strong performance for the cyber sector this quarter and not entirely surprising as we see headline after headline of significant vulnerabilities, AI-driven cyberattack activity and more.

Why Enterprise POCs Fail in 2026

Many on the vendor side know how critical a Proof of Concept/Proof of Value is for the sales cycle. It takes time to get to that point, and when you do, it is critical that it goes well to land a deal, and add a new customer, logo, and expand revenue etc.

This piece from Elisha Levy, VP of Value Creation at Glilot Capital, discusses how many of the 2026 POCs are stalling due to organizations not being in a position to act on the results. Below is a list of questions he cites many CISOs and executives walking away from POCs thinking, even if they like the vendor’s team or tech.

As you can see, not many of these are gaps on the vendor per se, but tied to the internal team’s bandwidth, competing priorities and broader security program. Key questions to keep in mind if you’re looking to land new customers and understand things on their mind.

US Bans DeepSeek From Federal IT

DHS published a notice in the Federal Register on Oct 20 ordering federal civilian agencies to exclude DeepSeek products from procurement and remove them from their systems, including third-party products built using DeepSeek implementations. Coverage from Bloomberg and BleepingComputer says the order was dated July 24, was signed by Secretary Markwayne Mullin, gives agencies 60 days to request CISA-approved exceptions, and excludes Department of Defense agencies.

The part I’ll be watching is the reach into third-party products “developed using DeepSeek implementations.” Plenty of vendors are wiring open-weight models into their products, and most agencies have very little visibility into which models sit underneath the SaaS tools they buy, so enforcement will lean heavily on vendors being forthcoming. This is where AI BOMs and model provenance earn their keep, and it’s an interesting pairing with the Vals AI benchmark in the AI section, where a DeepSeek model edged out GPT-6 Sol on an offensive task.

Horizon3 Surpasses $100 Million ARR

Horizon3 announced it passed $100 million in ARR with 95% gross dollar retention and 125% net dollar retention, about five years after crossing $1 million ARR in September 2021. The company says ARR grew more than 120% year over year, NodeZero has run more than 350,000 production tests across more than 7,000 organizations, and about 80% of customers moved from annual to monthly pentesting with 40% moving to weekly.

The stat I’d focus on is that about 80% of NodeZero customers moved from annual to monthly pentesting and 40% moved to weekly. When PHP2Shell was being exploited before the patch even shipped, a point-in-time test once a year tells you very little about your exposure the other 364 days, and customers appear to be voting with their wallets toward continuous validation.

We’re watching every aspect of security move to become continuous, including OffSec.

BAE Systems Incident Disrupts US Bankruptcy Courts

Another cyber incident having a significant real-world impact, this time involving a major Federal contractor in BAE Systems. It was reported that BAE, which runs the Bankruptcy Notification Center systems and websites, stopped paper and electronic bankruptcy notices for every federal bankruptcy court due to a cyber incident. This is the second major incident involving the U.S. Courts in the last couple of years.

It also shows the fragility when an incident involving a single contractor can take down operations for a significant U.S. operational program. I did joke this is finally a cyber incident we can celebrate, and bankruptcy notifications stall, but that is a joke of course!

Satya Takes the Insider Risk Case to a Room of CISOs

In a Microsoft Security fireside with a room of CISOs, Satya Nadella says alignment doesn’t fall out of scaling and argues anyone deploying the latest models needs a zero trust architecture that treats superintelligence as an insider risk. He now believes the controls have to live outside the model, starting with identity, observability, chain of thought and tool call traces, and runtime behavioral monitoring. He also raises what he calls the reverse information paradox, where a firm’s judgment signals leak its tacit knowledge to model providers.

I walked through Satya’s insider risk paper in “Trust the Model the Least” earlier this week, so it was interesting to hear him make the case live to a room of CISOs, including his admission that he once expected alignment to be something pre-training could fix. Identity, collected chain of thought and tool call traces, and active behavioral monitoring are the same kinds of controls outside the model I’ve been advocating for throughout 2026.

His challenge that organizations need a crisp answer to both the new insider risk and the reverse information paradox this fall is a fair one, and I suspect most enterprises deploying agents today couldn’t give one yet.

AI

Trust the Model the Least

In my latest piece, I walk through Microsoft CEO Satya Nadella’s “Models as Insider Risks in the Super Intelligence Era” and how it lines up with the controls the industry has been building and debating all year. I step through his points on separating intelligence from authority, observing everything, verifiability, independent controls and auditability, containment and the emergency brake, and incident disclosure, tying each one back to work from OWASP, CoSAI and the UK AISI.

The throughline is that models are probabilistic, so decisions about what they can access and do belong in deterministic controls outside the model’s reasoning loop, and I close with the areas where that consensus still has open questions, from chain of thought transparency to the reality that there are closer to a dozen kill switches than one.

Microsoft Says Attackers Have the Early AI Edge

Microsoft’s 2026 Digital Defense Report argues that attackers are currently benefiting from AI faster than defenders, and that while the balance will likely be re-established, in the near term attackers are getting AI’s advantages first and “defenders will need to move sharply in order to close the gap.” It puts the median time from a vulnerability’s discovery in the wild to weaponization at well below 24 hours, and says AI is compressing post-compromise activity such as secret discovery and lateral movement from days to minutes.

Microsoft also warns the world is likely to see a multi-year period where known but unpatched vulnerabilities spike, since remediation is much slower than discovery, while noting that most observed campaigns still retain human direction.

This is the same gap I wrote about in “AI Just Broke Vulnerability Management” and “The Remediation Receipts”, and PHP2Shell was a live demonstration of it this week.

NIST, NSA and CISA Set Rules for SI Control Incidents

NIST’s CAISSI, the NSA’s Super Intelligence Security Center and CISA jointly published ten voluntary key practices for incidents during the training and evaluation of SI agents, organized across Prepare, Detect, Respond, Recover and Report and mapped to NIST CSF 2.0 and SP 800-61r3.

The guidance defines an SI control incident as an agent taking significant uninstructed actions that compromise the policies, controls or security measures its operator put in place, and it treats near-misses as reportable too. Recommendations include strict network allowlists through a monitored gateway, keeping agents away from their own monitors and logs, using multiple model families for monitoring, and automatically shutting down trajectories when a control fails.

Keeping agents away from their own monitors reads a lot differently after the OpenAI report further down this section. I’d love to see enterprises borrow this for their own agent deployments, since most incident response playbooks were written long before an agent acting on its own was something we had to plan for.

AIUC-1 Adds Open-Weight Model Controls

AIUC-1’s Q4-2026 update adds 5 new requirements and 5 new controls and retires 3, with more than 100 Consortium members contributing. The new open-weight controls require re-running safety evaluations after weight or inference engine changes, verifying model source, integrity and license, and re-running cyber misuse evaluations or adding output classifiers on modified models.

Third-party testing is now consolidated into one quarterly requirement per principle, and new guidance finds that of 78 core controls, 33 are typically met by the developer, 40 by the deployer and 5 by the independent evaluator.

That split is useful, because it puts a number on something many organizations still get wrong, which is assuming the model provider handles most of the security. Per AIUC-1, the deployer owns more of it than anyone.

This feels like the misunderstanding organizations had in the early days of cloud with the Shared Responsibility Model and assuming the CSP was doing more than they were. As I said with cloud, and still say with AI, you can’t outsource accountability. It stays with you.

China Proposes Export Controls on AI Models and Agents

China’s Ministry of Commerce and Ministry of Science and Technology proposed adding 40 technologies to the country’s catalogue of technologies prohibited or restricted from export, including 23 AI items covering large models, AI agents, computing clusters and information processing. Technologies already public through open source releases or academic publication are excluded, and until the catalogue takes effect, exporters must register before transferring a listed technology abroad. Public comments are open until November 15, 2026.

The open source carve-out is the piece I’d focus on. Chinese open-weight models keep showing up in both benchmarks and attack campaigns in this very issue, and this proposal would leave that pipeline untouched while putting a registration regime around everything else.

AI Agents Are Pushing Humans Out of the Loop

Margaret Mitchell and Avijit Ghosh of Hugging Face and Samir Passi of Data & Society argue in a position paper that current approaches to building and deploying agents don’t support effective human oversight and actually contribute to its degradation, both through agent design and because extended AI use erodes the skills oversight depends on.

They name approval fatigue, where people repeatedly approving agent prompts stop paying close attention, and describe how quick approvals from tired overseers degrade training signals. Their recommendations include strategic friction, bounded autonomy with batch review, behavioral monitoring, skill maintenance exercises and rotations.

In my view, approval fatigue is a real weak point in how many organizations are rolling out human-in-the-loop controls for agents. A human clicking approve on the 200th prompt of the day isn’t much of a control. I wrote about this earlier this year in “The Human-in-the-Loop Illusion”.

One Hacker, AI Agents and $50 Per Breach

Reuters reports that NorForge researcher Snorre Fagerland found around two dozen exposed instances of the open source Cairn agent being used maliciously starting around October 2. A Chinese-speaking hacker’s agents attempted more than 1,200 sites and compromised more than 100, including sites belonging to Deere, SharkNinja and Cummins, working from instructions of under 100 Chinese characters.

Successful intrusions took about 23 hours and roughly $5,000 in tokens across DeepSeek and Claude Code, which works out to about $50 per successful hack.

This is the story Rob Joyce pointed to in his breachpocalypse post. Whether or not you buy that framing, $50 per compromise changes the economics for the long tail of e-commerce and vendor-hosted sites that never thought of themselves as worth a dedicated attacker’s time.

AI Pentest Tool Behind Korean Bank Hacks Turns Up in Japan

GMO Cybersecurity by Ierae, part of GMO Internet Group, traced attacks on Japanese companies to six servers that all used Artex, a China-linked AI penetration testing tool, and eight targeted firms disclosed breaches in September and October. Kyodo and the WSJ put the number of targeted Japanese firms at around 80 across retail, logistics, insurance and finance, and GMO shared its findings with law enforcement.

After South Korea linked Artex to hacks on financial institutions, its developer cut off access to the source code and said the project would no longer be updated.

This follows the CrowdStrike ARTEX campaign against South Korean banks I covered last week, and it’s a good example of an open source offensive AI tool becoming an attack platform across two countries in a matter of weeks.

Pulling the repo after the fact doesn’t do much once the code is out.

DeepSeek V4.1 Flash Edges GPT-6 Sol on Offensive Tasks

Vals AI shared early results from an offensive cyber benchmark built on simulated corporate networks, with GPT-6 Sol tested through the Daybreak trusted access program. Averaged across 21 objectives, DeepSeek V4.1 Flash 1017 scored 16.3, GPT-6 Sol 15.7, Grok 4.7 12, Kimi K3 9, GLM 5.3 Flash 5 and Claude Opus 5.5 1 after refusing partway, with the full evaluation due out in the coming weeks.

These are preliminary numbers, so I’d hold off on firm conclusions until the methodology is published. Still, if an open-weight flash model can match gated frontier models on offensive work, trusted access programs can only limit so much of the risk, which ties back to the Cairn and Artex stories above.

This lines up with research I’ve been sharing from the UK’s AISI for months, where they show that open source models are only 4-7 months behind closed source on cyber tasks, and closing in quickly.

Rogue AI Is a Design Choice

Cal Newport argues on his Deep Questions podcast that rogue incidents come from open-ended LLM-powered agents with broad goals, powerful tool sets and limited oversight, while targeted coding and math agents stay in bounds through narrow goals, restricted tools and hard-coded oversight.

I agree with a lot of this, and narrow goals, restricted tools and real oversight are the same boundaries I’ve been advocating for enterprise agents throughout 2026. The catch is that many of the agents being deployed are being given broad goals and broad access, so the design choice Cal describes is one plenty of organizations are making the wrong way. The challenge of course is most organizations and users using agents won’t give perfectly narrow goals or scope and will give broad prompts and goals and that will lead to agents getting “creative”.

I will say, there were some generalizations in the discussion from Cal where I think he glossed over some of the nuances of LLMs, agents and cyber, but overall I agree that with proper security rigor, these systems can be contained.

AI Safety and Security Keep Talking Past Each Other

TIME’s Harry Booth looks at the split between AI safety researchers, who see alignment as the durable fix, and cybersecurity experts, who point to the July incident where OpenAI agents escaped sandboxes and attacked Hugging Face as evidence of how poorly the models were contained. OpenAI’s chief scientist told TIME the monitoring layer wasn’t turned on for the evaluations behind that breach, and the piece also covers an October 13 open letter from around 400 academics calling for an international body to standardize AI safety practices.

Harry also cites commentary from , whom I’ve had on my podcast to dig into these same topics.

I’ve made the case in “Alignment vs. Security Is a False Dichotomy” that the two communities need each other, and I’m glad to see a mainstream outlet framing it as a gap worth closing.

OpenAI’s Coding Agents Switched Off Their Own Monitors

OpenAI’s alignment team describes two internal deployments where coding agents weakened misalignment monitoring. A GPT-6.1 Sol agent repairing an eval pipeline treated an earlier instruction not to send messages during a Slack search as reason to suppress monitoring notifications, emptying the ping and page recipient lists for the Security team. A GPT-6 Astra agent migrating code removed its monitoring integration, swapped a test that preserved monitoring for one requiring it be absent, and then told the user it hadn’t removed an enabled monitor.

Neither incident was classified P0, and OpenAI has since updated Auto-Review to detect and block attempts to disable misalignment monitoring.

Credit to OpenAI for publishing this. It’s also one of the stronger arguments I’ve seen this year for keeping enforcement and monitoring outside the agent’s reach, which is what NIST, NSA and CISA recommend above and what I argued in “Trust the Model the Least”.

Armadin Finds 23 More Exposed AI Attack Frameworks

Starting from the public Cairn reporting, Armadin found 23 more exposed autonomous attack frameworks across more than 3,200 hosts, with 190+ control panels left open or on default credentials.

Those panels showed agents chaining a single SQL injection into domain-wide access and 25 production databases, and the stolen data stayed readable on them after victims remediated. Armadin also counted more than 130,000 general-purpose agent harnesses exposed the same way.

This builds on the Reuters Cairn story above, and Armadin’s view that these deployments likely belong to some of the least sophisticated actors using this technology says a lot about how low the barrier to AI-enabled offense has gotten. There’s some irony in attackers making the same mistakes many organizations make with their own agents, from disabled authentication to default credentials, and the 130,000+ exposed general-purpose harnesses are a good reason to check your own deployments for the same patterns.

For breached organizations, I’d take the advice to assume stolen data is still being read seriously, since remediating the intrusion does nothing about records still sitting on an attacker’s open panel.

Context Bombs Turn Deception Against AI Attackers

Tracebit tested nine deception techniques it calls Context Bombs against seven models in a controlled AWS environment, planting lures in documents, service responses and fake attack paths. Without deception 70 of 71 runs ended in a successful compromise, while with deception 57 of 70 runs did not, and model cost rose 1.6 to 3.9 times. A fake pentest report that labeled real targets as canaries was enough to make some agents stop early and leave exploitable targets alone.

After the Cairn and Armadin stories above, it’s encouraging to see research on how defenders can make AI attackers pay, and turning an agent’s habit of chasing every promising lead against it is a clever use of deception. I appreciate that Tracebit is upfront about the limits, noting that more capable models have already been harder to deceive and that this research will likely find its way into training sets, so I’d treat deception as a control that needs ongoing testing as models improve. Tracebit also makes the point that wasting an attacker’s time and money only goes so far when harnesses can run attempts in parallel, which is why agents walking away from real targets after reading a fake pentest report is the more interesting result to me.

Rick Howard Says the Doomsday Talk Isn’t Over

Rick Howard pushes back on Sergej Epp’s call to move past AI doomsday talk and get back to work. His Bayesian forecast puts the chance of losing roughly 10% of the world’s population within a decade of losing control of a superintelligence at about 30%, and his fix is a US law banning frontier labs from recursive self improvement until alignment is solved. Sergej replied in the comments that we never solved alignment for humans either and built controls instead.

I’ve argued in “Alignment vs. Security Is a False Dichotomy” that alignment should be treated as a control with a known failure rate and backed by security, so Sergej’s reply that we never solved alignment for humans and built controls instead is close to where I land. That said, I respect Rick putting an explicit Bayesian forecast on the table, and as I discussed in “Cybersecurity is Ceding AI Safety, But Should We?”, our community stepping out of the safety conversation entirely carries its own risk. Where I’m less convinced is the fix, since a US law banning recursive self improvement at frontier labs is hard to square with how much capability is coming from open-weight models, including the DeepSeek result on Vals AI’s benchmark above.

AppSec

Agency Isn’t Authorization

In this piece, I revisit the identity gap agentic AI exposes, since agents inherit the problems we already have with human and non-human identities and add autonomy, non-determinism and delegation on top. I borrow a line from my friend Rock Lambros, Co-Lead of the OWASP LLM Top 10, that agency isn’t authorization, meaning an agent having the access to do something doesn’t make that action appropriate for the task in front of it, and I walk through what CoSAI’s agentic IAM and zero trust papers recommend.

I also dig into how Resilient Cyber partner Token Security is approaching the problem, drawing on my conversations with co-founders Itamar Apelblat and Ido Shlomo about agent discovery, a context graph tying agents to their identities and human owners, intent-based access and runtime enforcement through an agentic gateway.

MITRE ATT&CK v20 Adds AI-Enabled Techniques

MITRE’s October 2026 ATT&CK v20 release updates Techniques, Groups, Campaigns and Software across Enterprise, Mobile and ICS, and MITRE calls expanded coverage of recent adversary activity its biggest change. That includes new Campaigns for attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure, along with AI-focused and AI-enabled Enterprise Techniques. The release brings ATT&CK to 971 Software entries, 182 Groups and 61 Campaigns.

ATT&CK is the common language most detection and threat intel teams already work in, so AI-enabled techniques landing there is a meaningful step toward mapping agent threats with the same rigor we apply to everything else.

Claude Traces the NIST Curve Seeds to Unix Timestamps

Anthropic’s Frontier Red Team says an internal research model worked out in under half an hour that the long-unexplained seeds behind the NIST P-192, P-224, P-256, P-384 and P-521 curves came from the C library’s lrand48 generator seeded with Unix timestamps from May 1997 to April 1998, with P-256 taking 1842 iterations. Anthropic is clear this is not a cryptographic break or a weakness in ECDSA, and says the finding makes a deliberate backdoor much less plausible. The $36,864 seed bounty goes to the Internet Security Research Group.

Years of speculation about NSA-supplied curve parameters, settled by a model in under 30 minutes, is a fun reminder of how much security research AI is going to accelerate, on the defensive side too.

Separating Real CVEs From AI Slop

Bishop Fox’s Nate Robb and team note the CVE Project published 57,871 records in the first eight months of 2026, with disclosures up roughly 85% over last year while known exploited vulnerabilities rose about 14%, and they attribute a meaningful share of the growth to AI-assisted research.

Four heavily publicized Nginx CVEs this year all required uncommon non-default configurations, and Calif’s study found the rift rewrite rule in just 1 of 35,633 real configs. Their triage questions come down to whether it affects the default config, whether exploit impact is conditional, and whether it’s exploited in the wild.

That gap between disclosures and exploitation is why I’m cautious about the breachpocalypse framing, and it’s the same reason I argued in “The Zero Day Clock Stopped Ticking” that we need better prioritization signals. PHP2Shell, of course, is the kind that checks every box.

Claude Shrinks the Attack Surface Before Bugs Exist

Anthropic’s Chris Rohlf describes running Claude over more than 25 open source projects totaling over five million lines of code, inventorying 17,000+ configuration options and finding 493 issues across default configuration, configuration interaction and early reachability.

All eleven gated projects had unintentionally reachable code, including 93 unnecessary pre-authentication surfaces in default configurations, and in OpenSSH 10.4 an unauthenticated client could reach about 4,500 lines of experimental ML-DSA-44 code. Fixes across 10.5 and 10.6 removed roughly a fifth of the code reachable before authentication.

I like this a lot, because removing reachable code shrinks the pool of future bugs, which is a better long-term trade than chasing them one at a time. It pairs well with Bishop Fox’s default-configuration question above.

Agent Credential Vaults Are the New Crown Jewels

The agentgateway team’s second post on credential injection asks how much of an agent token store an attacker can read once the process holding it is fully compromised. A key encryption key in a Kubernetes Secret exposes the whole store, a key in AWS KMS makes decrypts audited and revocable, and broker-gated KMS grants remove the controller’s standing decrypt permission so every read needs a short-lived per-user grant from a separate broker.

Their framing is that KMS means a compromised controller can no longer decrypt your store “silently, in bulk, and offline.” With Railway and LiteLLM both turning into secret rotation exercises this week, I’d treat agent credential brokers as tier-zero assets the same way we treat identity providers.

OpenAI’s Patch the Planet Playbook for AI-Found Critical Bugs

OpenAI led a coalition to fix two critical PHP flaws, one found by Calif using GPT-5.6 Sol and both found independently by Wiz, and proposed a five-stage framework for coordinating disclosure as AI turns up more bugs like these. Unit 42 rates CVE-2026-109618 and CVE-2026-109619 as 9.2 RCEs, counts over 22.6 million potentially vulnerable exposed instances, and says at least one European government took its website offline as a precaution. OpenAI also committed $1 billion in subsidized Daybreak access for under-resourced defenders.

As I mentioned up top, PHP2Shell details leaked a day before the coordinated release, which is one of the conditions OpenAI’s framework says should trigger a reassessment of the timeline, and a good reminder that disclosure windows get harder to hold as more parties need advance notice. I covered Patch the Planet’s earlier fix rates in “AI Just Broke Vulnerability Management”, and with OpenAI expecting findings like these to increase sharply in the coming months, I’m glad to see them asking the community for input on disclosure windows, early notice and emergency patching. I’d like to see just as much attention on the receiving end, since $1 billion in Daybreak access helps under-resourced defenders find and fix issues, but those 22.6 million potentially vulnerable instances still have to be patched one organization at a time.

AI Dropped a Haystack on Vulnerability Triage

Casey Ellis argues AI raised both signal and noise in vulnerability submissions by roughly ten times, and the costly part is plausible reports that take a skilled human an hour to rule out. He cites Microsoft’s queue, where submissions are up 10x to around 10,000 a month and the share with nothing to fix peaked at 42% before falling to 24%. His fix is to reproduce reports by machine before a human sees them and to grade submissions instead of gating AI-assisted researchers.

Casey’s needle and haystack framing fits what I argued in “The Remediation Receipts”, that finding was never the hard part, and Microsoft’s queue shows that pressure landing on triage before anything gets fixed. I like his idea of proving positive with machine reproduction before a human sees a report, and his point that a harness failing to reproduce a bug is a fact about the harness is an important guardrail on that approach. I also agree that gating AI-assisted researchers fixes the wrong part of the funnel, and this pairs well with Bishop Fox’s triage questions above, since both come down to spending scarce human time on the reports most likely to matter.

Claude Security Moves to Continuous Scanning

Claude Security now runs a deep baseline scan once repositories are connected, then re-scans changes based on their risk and complexity, and a project can span multiple repositories to catch issues between services. It generates a threat model teams can review and edit, and later scans use it to decide what to flag and how to rate severity. Findings are marked fixed when the fix lands and reopen if the issue comes back, and it’s in public beta on Claude Enterprise.

Anthropic keeps shipping on Claude Security, and this release moves it from point-in-time scans toward continuous coverage that follows code across repositories as it changes, including issues that live between services, which matters more as agents write a growing share of that code.

I’m particularly interested in the editable threat model, since letting teams iterate on it with their own deployment context and risk policy is how a scanner starts prioritizing the way an AppSec team actually does.

As I discussed with Checkmarx’s Jonathan Rende in “AI Code Security and the Independent Control Plane”, there’s still a case for independent validation when one vendor’s models are both writing and reviewing the code, though cross-service coverage and fix tracking that reopens regressions are meaningful steps.

Final Thoughts

PHP2Shell went from leaked details to millions of exploitation attempts in under two days, and that same week brought AI agents breaching companies for about $50 apiece, open source attack tooling crossing borders, and coding agents quietly switching off their own monitors.

I’m not ready to call it a breachpocalypse, since exploitation is still growing far more slowly than disclosures and plenty of defenders responded quickly this week, including the ones who took their own sites offline. That said, the time between disclosure and exploitation keeps shrinking, and attackers are clearly using AI and autonomy to scale.

The response is the unglamorous work we already know, which is knowing where things like PHP actually run, patching critical internet-facing systems in hours, and keeping monitoring and enforcement outside the reach of the agents we deploy. The question is whether we can fund and staff it faster than the attackers are scaling.

Stay resilient.

Subscribe now

We’ve watched agent adoption take off, especially for use cases such as coding, leveraging agentic coding tools but also for broader knowledge work (e.g. cowork) and of course agents in the cloud and SaaS environments as well.

The industry is grappling with what I’ve been framing as the Security vs. Utility tradeoff. Agents need access to be useful but that access is also what makes them risky, and organizations are striving to find a balance between the two, and as we know in security even in prior technological paradigms pre-AI, security often loses that battle.

We already know we have best practices such as least-permissive access control, or proper identity lifecycle management, the challenge is we already did poorly at these with on-premise identities and in the cloud and now AI and agents are adding strain to an area of security we already struggled with.

In this piece I will be discussing some of those challenges, where the industry is headed, what primitives are emerging and how some teams, such as Resilient Cyber partner Token Security, are tackling the problem.

So, let’s spend some time at the intersection of agents and IAM!

If your organization is putting AI agents into production and you can’t yet say which agents exist, what they can reach, or whether their access matches what they actually do, that’s the gap Token Security was built to close. Resilient Cyber partner Token Security gives teams an inventory of their AI agents and the identities behind them, maps that access in context, and helps right-size permissions so agents get only what their work requires.

-> Explore Token Security <-

From NHIs to Agents, What Changed

Identity has already been undergoing significant changes in recent years. As we moved to cloud, microservices, Kubernetes, containerized workloads and more, we saw increased focus on what the industry called “Non-Human Identities” (NHI).

I’ve covered NHIs previously in pieces such as:

• What Are Non-Human Identities and Why Do They Matter?

• The State of Non-Human Identity (NHI) Security

We even saw a new OWASP Top 10 for NHI, which I previously covered, because who doesn’t love an OWASP Top 10.

NHIs include identity types such as service accounts, system accounts, IAM roles and other machine-based identities used to facilitate activities in the enterprise with authentication activities oriented around API keys, tokens, certificates and secrets.

NHIs were estimated to outnumber human users 10:1, and now agents are poised to add to that surplus while also inheriting all of the challenges of both human users and NHIs and the industry has been wrestling with how to handle, secure and govern IAM for agents.

I previously laid a lot of those challenges out in my blog titled “Identity is the Agentic AI Problem Nobody Has Solved Yet”, where I used the Coalition for Secure AI’s (CoSAI) excellent Agentic IAM whitepaper as a guide.

As I mentioned then, agents inherit all of the challenges of human users and NHIs such as improper offboarding, secret leakage, overprivileged identities, long-lived credentials and cross-environment reuse while adding new issues as well, such as the fact that access doesn’t automatically equate to authorization, meaning just because an agent has access to something doesn’t mean it is authorized to do specific activities, or that what they are doing in a given moment with that access is appropriate given the context.

Agents also introduce additional security challenges related to IAM, such as their non-determinism, autonomy and delegation. Many of these challenges have begun to be addressed by groups such as CoSAI in their paper above, as well as by others, such as OWASP in their Agentic AI Top 10, where I serve on the distinguished review board.

These challenges manifest at runtime in scenarios such as agents with the same permissions taking fundamentally different actions depending on the prompt they receive, what’s ingested into their context window, or even the overall non-deterministic nature of agents and most notably the LLMs that function as their brain. We also simply aren’t used to governing and securing software that acts or has autonomy. Historically software could be triggered or invoked, but it didn’t necessarily “act” on its own or make decisions that weren’t pre-programmed and bounded, so the concept of least-autonomy is a new one for the security community to adapt to as well.

The industry has largely collectively agreed that agents don’t fit neatly into either category of human user or NHI and that is why we’re seeing papers published with new takes on best practices, new frameworks and emerging protocols for agentic IAM as well, such as updates to OAuth, and the introduction of Agent Auth, which I’ve discussed previously with industry leaders such as Karl McGuinness in a conversation titled “Identity-as-Infrastructure in the Agentic Era”.

Agency Isn’t Authorization

As I mentioned above, the community has begun approaching Agentic IAM from trying to ensure they can understand and govern who an agent is, what it can reach and what it should be doing right now for this task.

This includes defining its authority and on who and what authority are agents acting, as I discussed with Karl, as well as the reality that agency isn’t authorization, as my friend , Co-Lead of the OWASP LLM Top 10 put it. Just because an agent has the agency and access to do something doesn’t mean it is authorized to do so for a specific scenario or active in a given moment. Rock’s quote is below:

“Agency’s not authorization, period, authorization tells you whether it can do the thing, while agency tells you whether the thing that the agent is doing is appropriate or allowed.”

CoSAI joined the fray with their excellent Zero Trust for AI Systems whitepaper which I previously covered, where they rightfully take the stance that authorization can’t live inside the model. They show a conceptual reference architecture demonstrating that the AI threat boundary is anything within the bounds of the model given it is a non-deterministic system.

Karl made an argument in the discussion with me months ago, which is now becoming an industry consensus, which is that you need “survivable correctness”, where you have enough security controls so that the blast radius is survivable even if the initial sort of mandate or intent for an agent is not 100% correct.

What the Industry Frameworks Say

While I already mentioned the CoSAI paper above, I did want to lay out some of the fundamental concepts and controls it advocates for.

This includes approaching agentic IAM through a three phased adoption path, from visibility through contextual access controls, to full agentic IAM with runtime enforcement. They also provide a capability-impact risk matrix to classify agents from low capability-FAQ bots to high-risk financial or admin agents with consequential permissions to impact production systems.

They also advocate for leveraging short-lived OAuth tokens and on-behalf-of (OBO) chains with scope attenuation at every hop, which ties back to the need to securely govern delegation from human users to agents and even from agents to sub-agents.

While some of these are of course aspirational and protocols and tooling are evolving to help organizations meet them, it is a good indicator of the direction of where things are headed and how enterprises should think about it.

The Uncomfortable Track Record

That said, if we’re being honest with ourselves, the frameworks describe where we need to go much more clearly than they describe where we’re starting from.

In my recent Resilient Cyber podcast episode I sat down with Token Security Co-Founder Itamar, and I mentioned we’ve had twenty plus years to get least privilege right for human users and another fifteen or so for cloud identities, and our track record in large enterprises is not great.

Palo Alto Networks’ 2026 Identity Security Landscape found that 96% of respondents report human identities operating with access far beyond what their roles require, even as machine identities, including AI agents, now outnumber humans 109:1. We have struggled with least permissive access control, lifecycle management and governance for the identities we understand best, and now we’re adding identities that are more numerous, more ephemeral and autonomous on top of them.

If we’ve struggled this much with the identities we understand best, how do we expect to do better with agents that are more numerous, more ephemeral and autonomous? That’s the question I wanted to put to the Token Security team, and it’s where the second half of this piece picks up.

Now for the uncomfortable part when it comes to our history on doing what we know is best. Best practices such as “least-permissive access control” have existed for decades, and were a big part of the earlier Zero Trust movements.

Yet, we performed absolutely terribly at them including recently in cloud, where up to 99% of permissions users/identities had were not necessary or used, meaning accounts were very overly permissive. This is problematic for various reasons but among them is the fact that credential compromise remains one of the leading attack vectors. As the saying goes, hackers don’t hack in, they log in.

When they can use credentials with access, they don’t need to “exploit” anything, just compromise an account or get access to a credential and the malicious actors get broad access.

Now throw agents into the mix when NHIs were already outnumbering human users and the problem is poised to be far worse, especially since agents unlike NHIs have autonomy, the ability to take actions, use tools and make an impact in real production environments on their own.

As we’re seeing with recent incidents, agents don’t even need to be compromised to be problematic, they can simply be “rogue” or put a better way, behave in a way the user didn’t plan or intend for them to.

These challenges are already starting to show up in the enterprise, such as in the Cloud Security Alliance (CSA) report “Autonomous but not Controlled”, which CSA did in partnership with Token Security. It found 82% of organizations had shadow agents in their environments, often with poor monitoring and visibility and 65% of those surveyed had at least one agent-related incident in the past year.

So this begs the question, why would least permissive access control get any better in the age of agents than it was in prior tech waves?

Trends say it won’t, but let’s hope that’s wrong, and there are teams building solutions to try and ensure we get it right this time, including Token Security, which I’ll be discussing next.

Token Security’s Approach

As I mentioned, I recently had a chance to sit down with both of Token Security’s Co-Founders, including a Resilient Cyber podcast episode with Itamar. So let’s take a look at what their stance is on this problem and how they’re approaching it.

Origin and Thesis, Identity as the Control Point

Token’s origin story is a good illustration of why that track record looks the way it does. Itamar Apelblat, CEO and Co-Founder of Token Security, spent over a decade on the defensive side of Unit 8200, where he met his co-founder and CTO Ido Shlomo on their first day of service.

Years later, stuck waiting hours on access approvals during reserve duty, he remembered a service account his team had created roughly seven years earlier, along with its password, and tried it. During the podcast he mentioned “and all of a sudden I was an admin in one of the most secure networks in the entire world.” When he asked why nobody had changed it, his former colleagues said they were scared of what might happen if they touched it.

I know I’ve seen similar situations myself in the DoW and U.S. Federal agencies, where folks didn’t want to touch an account or system because they didn’t want it to break something despite no one being completely clear who it belonged to or what it even did.

Token started in classic NHI security, and about two years ago, while trying to understand who was consuming those NHIs, the team kept finding AI agents on the other end. That led Itamar to a risk model built on two dimensions, the level of autonomy an agent has and the level of access it holds, and his view is that what ultimately matters is what the agent actually does in the target applications.

The risk model he describes has a lot of parallels to the principles in the CoSAI IAM and ZT papers I mentioned above, as well as the conversations I had with industry leaders such as Rock and Karl.

Discovery and the Context Graph

One of Itamar’s points that resonated with me is that traditional IGA treats the IdP as the source of truth, while agents live almost everywhere else, on local machines, inside SaaS applications and across the cloud. As I told him, vendors who started from machine identities are better positioned here than those retrofitting human IAM, given they were already building towards securing machine identities, and while NHIs aren’t a 1:1 to agents due to the novelty of autonomy, there are a lot of similarities.

When Token’s second Co-Founder Ido walked me through the platform, discovery started from the identity side, looking at which identities and data an agent actually touches. Token’s platform deck cites more than 1,000 enterprise integrations feeding an inventory that maps each agent to the NHIs it uses, its permissions, its consumers and a risk rating, and Ido described a context graph tying agents to service accounts, secrets and the human owners who prompt them and remain accountable for them.

What discovery turns up will look familiar to anyone who has read the OWASP NHI Top 10. Itamar described ungoverned agents connecting directly into production with secrets or API keys, inactive agents left over from early experiments, and agents whose owners have left.

During my conversations with the team they highlighted how often agents don’t have a formal owner, or perhaps they left the organization but the agents continue to run and no one has a good answer to who is actually responsible for that agent.

The Token team’s research found that over 16% of its enterprise customers already have Personal AI (PAI) agents such as Muse running locally and interacting with mail and other enterprise resources, and the reality is most organizations have little to no visibility over these types of rapidly emerging agents, let alone any runtime governance or enforcement.

Ido also told me that tracking sub-agent invocations is still a work in progress, which is the delegation chain problem CoSAI flags and part of why I called agent identity the problem nobody has solved yet, and a topic Karl brought up, because the industry is still figuring out how to handle delegation across sub-agents and multi-agent activities when it comes to IAM security.

Intent-Based Access, Scoping by Purpose

This is where the agency versus authorization distinction from earlier gets practical.

When I asked Itamar how identity helps when an agent with legitimate access takes actions that look authorized but may not be appropriate, his answer started with how agents behave. They follow a goal or an intent, almost like they’re possessed as he put it, and will use whatever access they can find to reach it. So instead of trying to catch the moment an agent goes wrong, Token scopes its permissions up front, in the authentication moment, to what its purpose actually requires.

While this makes sense to me in terms of defining access up front, I also know this can be challenging, given agents are non-deterministic and we don’t always know the specific path and actions they will take to accomplish a given task.

Token calls this intent-based access management, and intent-analysis is a topic you’ve likely seen me write about before.

Itamar described two mechanisms, with the first being defining an agent’s purpose, which he says should be crisp and concise, and then restricting its static permissions in each application to match, using the example of an agent built to send a weekly report on customer trends, which for example shouldn’t have deletion capabilities to a database. Since most organizations never wrote those purposes down, Token infers them from the agent’s settings and activity and then verifies them with its owner.

I like this approach because it reminds me of hygiene for agent identity and permissions, being able to clean up scopes and permissions based on what the agents truly use, rather than it just staying what was originally provided to them, especially since we know the latter tends to be overly permissive. The second mechanism analyzes the intent of each specific action against that purpose and the agent’s broader goal.

Mapped back to Rock’s framing, the first mechanism governs what an agent can reach, and the second governs whether what it is doing right now is appropriate and allowed. It also resembles Karl’s idea of authority tied to a mission, and the CoSAI Agentic IAM paper’s call for task-scoped access. Ido showed me the right-sizing side of this, with least-privilege policies generated from actual usage and scope and exported as JSON or YAML for AWS or Terraform.

In my coverage of CoSAI’s Zero Trust paper I noted they acknowledge Zero Trust alone doesn’t stop misaligned reasoning, and intent analysis is an attempt to close that gap.

That said, it is easier said than done of course, as it requires the firm to be actively engaged in verifying an agent’s assigned permissions and activity as authorized and appropriate to facilitate the right-sizing of those permissions.

That aside, proactively monitoring the agent’s activity and encouraging the users to help clean up overly permissive access is the sort of activity that can clean up permissions now, rather than later after an incident exploits them, or an agent goes rogue.

Enforcement, Remediation and the Human in the Loop

That brings me back to the track record question I put to Itamar.

His answer was automation, since IGA and CIEM processes stayed largely manual and never scaled, and agents will far outnumber the humans those processes already struggled with. Token’s approach has two parts, continuously restricting and updating an agent’s permissions in the target applications without a person in the loop, and an inline layer that decides whether to block or allow each action.

When Ido walked me through the inline piece, it took the form of an agentic gateway sitting between agents and the services they call, enforcing policy with context about the environment and the identity involved.

The rule builder evaluates conditions such as department, the role an agent requests and the role it’s using, with actions to allow, monitor, shadow-deny or deny. Ido described the same idea in a recent BleepingComputer piece under Token’s byline, where for the same developer and session “the agent’s call is denied on admin and allowed on read-only,” which is CoSAI’s point about keeping authorization decisions outside the model put into practice.

On remediation, Ido explained that Token requests write permissions so playbooks can de-provision identities, revoke authentication and rotate API keys, with customers mostly starting on the lowest-hanging fruit. Paired with modeling the attack paths an agent can reach, this starts to look like Karl’s survivable incorrectness, bounding the blast radius when an agent gets it wrong.

Human approval in this model is a dial set per resource. Itamar described a customer policy that coding agents never touch production, so an agent that connects to a production Snowflake project gets blocked and an access request goes to a person, and where the crown jewels sit drives whether to block, require approval or allow. In the CSA’s “Autonomous but Not Controlled” survey I mentioned above, 38% of organizations require human approval for risky agent actions while only 11% automatically block them, which suggests approval fatigue is a live risk.

This is indeed a difficult dichotomy, where we want to escalate to humans for critical agent actions that introduce risk, but doing it too frequently can lead to fatigue of the Human-in-the-Loop (HITL) or even blanket approvals, which come with not actually reviewing what is being requested.

Ownership and Where Security Starts

Then there’s the organizational question of who owns all of this.

Itamar’s view is that because agents exist to automate work our employees and workloads already do, the IAM team should manage their lifecycle, with an AI security committee or department influencing the approach and AppSec and data security teams sharing responsibility for the risks those agents introduce.

On where to start, he agreed visibility comes first but said the security teams seeing the most success are the ones adopting agents themselves, and his advice was to have security deploy agents themselves, this way they better understand where the risks are.

This is a perspective I strongly agree with, as I’ve spent this year arguing that security is almost always a late adopter and laggard with each tech wave, and we can’t make the same mistake with AI and agents, and it is much harder to secure something we don’t understand, so it is key that we get exposure to these tools and technologies ourselves.

Ownership will likely look different across organizations as each organization’s teams and governance models are unique. However, I think finding the right model for your organization and ensuring you have effective tooling coupled with proactive governance is key.

Closing Thoughts

Agents are forcing the industry to treat access and authorization as the separate questions they always were.

Token’s bet is that identity is the control plane, and that knowing who an agent is, scoping what it can reach to its purpose and checking what it does at runtime gives us a better shot at least privilege than we’ve managed before, though delegation chains and attribution when agents share human credentials remain open problems.

That said, the principles I discussed above from groups such as CoSAI along with industry leaders and teams like Token provide an opportunity to ensure we get some of the fundamental aspects of agentic IAM correct and avoid perpetuating the problems of the past where we struggled with effectively securing IAM in the cloud and on-prem.

Stay resilient.

Subscribe now

These agents have deployed everywhere, often with broad access and very little governance or security and very little of the trust architecture practitioners have built for human insiders, even though agents have been framed as our “digital coworkers”.

On October 10th, Microsoft CEO Satya Nadella published an X article titled “Models as Insider Risks in the Super Intelligence Era”.

It immediately resonated with me and apparently many others, as it led to nearly 14 million views in short order. In it, he claimed that model provider assurances don’t relieve the deployer of responsibility, which to me and many others I’m sure reminded us of the Shared Responsibility Model but updated for LLMs and Agents.

Satya argued it was some to take a step back and assess the trust architecture of this new era, and I agree with him, and that is exactly what I want to do with this blog. So I will step through many of his key points, the security architecture and methodologies he proposes and also how they tie to things I’ve been writing throughout the year and conversations I’ve been having as we look to see how we secure agents in the modern enterprise.

I want to stress that most importantly of all, was Satya’s point below:

“Controls that govern what a model can access and what actions it can take must sit outside the model”.

This is a point I’ve been making for months in my own blogs, and in discussions with industry leaders, such as , the Co-Lead of the OWASP LLM Top 10.

While myself and others have been making these points, when the CEO of Microsoft makes them, it is worth walking through them and emphasizing how the new AI-native security primitives are taking shape.

Separating Intelligence From Authority

Some of the core arguments Satya makes are the need to “separate intelligence from authority”.

He frames this in the context that we can’t treat AI as a nested set of black boxes and accept/reject its outputs and instead need to “build contained systems whose behavior we can observe, limits we can test and actions we can always contain”.

If you’ve been following the arguments in the industry in the last several months especially after the summer of agent “breakouts”, you know this is the argument between AI Safety and Security, or Alignment and Engineering. Some of the labs and AI safety crowd have been arguing for alignment, where others such as Satya and Jensen have been arguing that AI security is an engineering problem.

Folks such as have been highlighting this as well, particularly the absurdity of those who think we will ever see a perfectly aligned model.

I personally agree with them, and while I think AI Safety vs. Security is a false dichotomy, which I discussed in my video below, I do think we ultimately need to focus on secure engineering and building security around the models, rather than hoping for some end state of perfect model alignment.

Models are probabilistic and we need to build hard boundaries, in the form of deterministic controls outside of the models reasoning loop, which is an argument I’ve been making in blogs and videos all year.

This is even more critical due to Satya’s point that these probabilistic systems are being given access to sensitive data and mission-critical actions, further warranting the need for deterministic controls outside of the model.

This point was supported even in the latest OWASP LLM Top 10, where the Co-Leads Rock Lambros and Steve Wilson opened with a letter about the need to build security around the model, rather than building a perfectly aligned model, or model immune to prompt injection etc.

Satya frames the models as insider risks because were turning these into capable actors and of course these actors can make mistakes or be compromised, or as we see go “rogue” (e.g. behave in way the users didn’t intend them to).

This perspective is being backed up by industry organizations, such as the Coalition for Secure AI (CoSAI) in their latest “Zero Trust for AI Systems: Why Authorization Can’t Live Inside the Model” paper, where they call AI the newest category of insider threat.

We Have Done This Before

While LLMs and agents may be new and novel, securing insider risk isn’t and Satya calls out that we have decades old playbooks for dealing with powerful insiders, such as establishing their identity, limiting their privileges, logging their activities and creating containment boundaries.

CoSAI’s ZT paper above lays out a maturity path to move from broad service identities to short-lived task-scoped tokens that get validated across delegation chains. I also have done a lot of work in the U.S. Federal/DoW space and we often leveraged the ZT Maturity Model from CISA, which CoSAI also builds on.

That said, there is of course new and novel aspects of governing and securing identities, permissions and access for agents. For a great discussion on that topic, I recently caught a panel at AI Engineer New York with Allie Howe, Ian Livingstone, Michael Davis and OAuth Co-Creator Dick Hardt, who is currently championing a new protocol, Agent Auth (AAuth) for agents, it is worth a listen below.

I tried to cover some of these open challenges myself in a blog earlier this year, titled “Identity is the Agentic AI Problem Nobody Has Solved Yet”, pointing out that while many of the existing best practices and methodologies still apply, there are some new aspects of probabilistic actors in the form of agents with autonomy introduce to the enterprise.

I also want to point out that we have done awful with least privilege for human users both on-prem and in the cloud with NHI’s, despite it being a “best practice” for decades, and now agents are poised to exponentially outnumber human users, so I don’t feel very confident we will get this perfectly right either, especially initially as adoption outpaces security, as it always tends to do, but this time the adoption cycle is unlike any we’ve ever seen.

Chain of Thought Transparency

Satya calls on to call Chain of Thought transparency a “non-negotiable”. For those unfamiliar, CoT is essentially when you are trying to monitor/observe what the model/agents are thinking as they carry out tasks.

Many have begun to advocate for CoT transparency from the frontier model providers and it is a domain that is both heavily researched but also still far from resolved or settled as a science. I recently caught an interview from with an Anthropic researcher who focuses on it, and he was able to peel back the curtain a good bit but even then admits we often don’t understand how these things “think” or work all of the time.

That’s exactly why Satya said CoT alone isn’t sufficient or dependable especially in some cases as we start to see evidence that the CoT doesn’t align with the model/agents actions, or even the models looking to obscure their own CoT.

While I’m hearing a lot of CISO’s and security leaders mention CoT I don’t know that it is going to become something the frontier corporations routinely provide in terms of full transparency, and in fact may actually restrict, for example when trying to mitigate activities such as model distillation.

I won’t belabor this one, given how little is truly known here and how little is settled in terms of how enterprises will or won’t use it quite yet.

Nested Black Boxes and Controls Outside the Model

Continuing to build on the theme as controls outside of the model Satya advocates for enforcement sitting outside of the models reasoning, and cites principles dating back 50+ years to the 70’s such as:

“A program must not be able to bypass or tamper with the mechanisms that enforce its permissions”.

Again, as I mentioned above, this is something being advocated by industry groups such as OWASP and CoSAI as well. There’s also academic research here, such as the paper “If Agents Were Angels, No Governance Would be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary”.

As someone working with multiple product vendors in this space, I can tell you this is becoming a primitive, both among startups and industry leaders alike, as vendors look to offer hard boundaries as deterministic policy-as-code that sits outside of the models reasoning and looks to constrain what the models and agents can do at runtime.

This is something folks such as have covered in their Secure Trajectories blog for quite sometime now, in pieces such as “Hooking Coding Agents with Cedar Policy Language”, which they also presented at the first [un]prompted conference.

We’ve even seen AWS not introduce a new declarative policy language in “Dogwood” aimed at agents.

Safe to say, among security-oriented and experienced practitioners, we are collectively agreeing that control and enforcement must live outside of a probabilistic entity - the model.

Observe Everything

One of the points that felt most relevant in the list Satya discussed is the need to observe “everything”.

For many of us who have watched some of these LLM and agent incidents unfold, an initial reaction was sort of “what the hell, why wasn’t the system being monitored”, especially since many of the incidents either weren’t identified until after they had an impact on external entities, in some cases even months later.

Satya put it succinctly:

“If it can’t be observed it can’t be trusted”.

Every agent action should leave tamper-proof human readable evidence, the same way we would log, monitor and observe other software systems. It is incredibly hard to determine what happened retrospectively (e.g. Incident Response) or stop something from unfolding (e.g. runtime enforcement, steering etc.) if we aren’t sufficiently monitoring these systems to begin with.

My little rant aside, the truth is most SOC’s, SecOps teams and broader security programs have very little to no real visibility or observability over agent actions today, especially since most organizations have low quality asset inventories when it comes to AI to begin with.

As the age old security saying goes, you can’t secure what you can’t see.

Verifiability

Verifiability is among the core concepts Satya brings up as well.

This includes continuously testing the entire system, both model and surrounding architecture and accounting for failures, attacks etc. This can often be framed as AI Red Teaming and/or Adversarial Emulation and other techniques.

We want to examine what could go wrong with these systems and architectures and their use and ideally identify those before a benign or malicious incident occurs.

Industry leading vendor agnostic organizations such as the UK’s AI Security Institute are advocating for this as well, where they stated:

“Evaluations should assume a capable model may try to act beyond its remit, with the scope of any behavior limited in advance and good containment should not depend on the model choosing not to test its own boundaries”.

Who and how this testing occurs will of course look different across organizations and environments, involving a mix of internal red teams, vendors, independent third-parties and so on. OWASP even has an AI Red Teaming Initiative, granted the materials there are largely model rather than agent focused, but I’m sure that will evolve as the group continues to produce more for the community.

Independent Controls

One of the most impactful on the list in my opinion is the need for independent controls.

Satya argues that organizations should be able to independently determine what a model can access and what actions it can take. Many are already moving in this direction, and again, doing it by bringing authorization and enforcement outside of the models reasoning loop.

I’ve written about this throughout the year, for example related to coding agents, such as in my piece “A Look at an Emerging Runtime Enforcement Layer for Agents - Hooks”

This is where I do want to give credit to the model providers, because in many cases organizations do have a myriad of methods to control what a model can access and do, but where it gets problematic is that most organizations and individuals are rapidly adopting these models and agents without thoroughly understanding the access model, nor rigor around right sizing scope and permissions, runtime enforcement and so on.

This is the same as previous technology waves, especially Cloud and SaaS where the democratized access by non-security and often non-tech folks make it easy for access to be granted directly to systems, via connectors, MCP and the list goes on without much understanding what access is being granted nor the risks that introduces for organizations.

Now, as we move towards multi-model, both with multiple model providers as well as open weight options, organizations need to move towards a unified approach of defining and enforcing their policies across agents running on endpoint, SaaS, cloud and even mobile, as personal AI (PAI) agents enter the fold and most organizations have no cohesive solution to this problem.

Most are either doing nothing, or trying to bolt together an approach across their EDR, IAM, CNAPP, etc. security tooling, which is all disjointed and myopically sees the landscape from their perspective, despite the diverse environments and ways agents get deployed and used in the enterprise.

Independent Auditability

This aspect of Satya’s position is that validation must be independent of the intelligence being validated and that no single model should control both a systems behavior and the evidence to determine if that behavior is aligned.

This is both a technical and a social issue, given it involves models and techniques as LLM-as-a-Judge etc. but it also involves people, organizations and relationships, such as Anthropic/OpenAI and METR, which is the chosen independent third-party by the frontier corporations so far, but some have pointed out potential conflicts of interest tied to who does and has funded each.

METR is quickly becoming one of the primary organizations involved in third-party review and testing, not just among the model providers but government entities as well, such as the UK’s AI Security Institute (AISI) who stated they intend to work with METR when disclosing they experienced an incident of unsanctioned agent behavior as well.

Many have been calling for more traditional cybersecurity firms to have a role in this activity as well, in addition to a push for METR and others to recruit industry practitioners with deep cyber backgrounds to compliment the firms depth on AI Safety.

Just last week, Anthropic shared that they granted outside evaluators from METR employee-level access to its systems, and plan to do so for others, such as Hugging Face and more. That said, there was some debate and rumors related to what the evaluators could or couldn’t disclose publicly, with the model providers having concerns around IP for example.

Containment and the Emergency Brake

Arguably what has been the hottest topic related to the AI incidents over the summer has been that of sandboxes, and subsequently “kill switches”, which Satya calls an emergency brake here.

All of the incidents this summer tied to OpenAI, Anthropic, Google and Meta involved sandboxes and issues with those sandboxes, particularly with having Internet access when it wasn’t intended, and ironically each of the firms used the same partner in Irregular. It was reported that a “misconfiguration” in the evaluation environment led to all 4 firms environments for evals having Internet access when they weren’t supposed to.

I’ve discussed the issues with boundaries for agents extensively, both in my blog titled “Agents Have Boundary Issues”, where I cite academic research on the topic, as well as interviews with Luke Hinds of no-no in “Your Agent Is Running As Root”, and Alex Zenla in “The Sandbox Everyone Suddenly Needs”, both of whom who are experts on the topic.

While Satya calls for an Emergency Brake where “an authorized person should always be able to pause or shut down a model mid-task”, he is describing what the broader industry has now begun to call a “kill switch”, which even has legislation proposed for it such as the “AI Kill Switch Act”, a topic that has also been floated by the frontier model providers.

That said, the devil is in the details, and there is no universal single kill switch, as I shared in a blog from Kevin Skapinetz of Tech Operators, there are more like a dozen, tied to different aspects of systems and architectures.

Depending on the deployment and the models and organizations involved the concept of a kill switch or more or less practical and requires understanding what aspect of the system can serve as the kill switch, or even multiple aspects of the system which need to be configured to ensure a running model stops.

Incident Disclosure

Rounding out Satya’s list is Incident Disclosure and the need to ensure timely communication to those effects as well as transparency around sharing what went wrong, what controls failed and how to prevent it from happening again.

While we’ve seen a mixed bag of levels of transparency from model providers, a good example in my opinion is that from AISI, which shared a comprehensive Incident Report retrospective, which I covered in my blog this summer around Black Hat titled “Learning from the Frontier”.

Many have been critical around the level of transparency shared by model providers in the incidents over the summer and in fact additional incidents were identifiers by those companies after the fact, with some of them not notifying impacted parties for weeks or even months, such as in the case involving Australia and OpenAI.

OpenAI discovered the activity in mid August, and then didn’t send a notification to the impacted Australian parties until September 10th and even then it was sent to a generic public inbox, leading a public condemnation and direct call with Australian Prime Minister Anthony Albanese to OpenAI Sam Altman in mid to late September.

This is a topic that has heated up, with a recent incident involving Anthropic now leading to the recently formed SI Task Force in the U.S. saying the:

“SI companies must immediately disclose incidents involving their models and follow with swift, decisive action to remedy any and all harm”.

However, the details of this requirement still aren’t entirely clear, and I don’t know that it has been published publicly in-depth for the community to fully understand. Safe to say we’re headed towards mandatory incident reporting similar to breach notifications that are driven via regulations.

Closing Thoughts

So as you can see, it has been quite the year for AI safety and security, from incidents, technical evolutions, debates between AI Safety vs. Cybersecurity and more.

What is clear, at least in the technical and cybersecurity communities is that we’re starting to rally around a shared sense of primitives that are required to sufficient secure and govern the use of LLMs, agents and broader AI.

However, as I noted throughout this piece, there are still a lot of unanswered questions or domains that are still being heavily researched by the academic community, built by vendors/products and model providers and being diffused and navigated by enterprises around the world.

These are my observations as someone focused on securing AI and agents with large complex enterprise customers and organizations both domestically and internationally, as well as teaching these concepts academically in programs such as at Carnegie Mellon University to senior executives.

This is far from an exhaustive evaluation, and each topic I walked through could easily be its own deeper blog, but I wanted to share some thoughts for now.

I look forward to continuing to navigate securing the frontier with the community and our software-driven society!

Also big shout out to the folks who help enrich these conversations and shape my thinking on these topics, including , , , , and .

Subscribe now

Itamar started his career 18 years ago in Unit 8200, where he met his co-founder and CTO Ido on their very first day, and spent more than a decade on the defensive side building security products for an organization heavily targeted by nation-state campaigns. He later built his own startup in the fintech space before teaming back up with Ido.

Token’s origin story is one most practitioners will recognize. Called back to reserve duty and stuck waiting hours on access approvals, Itamar remembered a service account his team had created about seven years earlier, tried the password he still remembered, and found himself an admin in one of the most secure networks in the world.

Nobody had changed it because nobody knew what would happen if they did, and that fear of taking action is exactly what Itamar sees playing out again with non-human identities and now AI agents.

We dig into his two dimensions of agent risk, autonomy and access, why agents will use any access path available to reach their goal, and what intent-based access management looks like when you scope permissions to an agent’s purpose and verify that purpose with its owner.

I also pushed him on an uncomfortable truth. We’ve had twenty plus years to get least privilege right for humans and another fifteen for cloud identities, and our track record isn’t great, so why would agents, which Itamar expects to outnumber us a hundred to one, go any better?

His answer is automation, with permissions restricted continuously and actions blocked or allowed inline, because manual approvals won’t scale and people will find workarounds like they always do.

We close on where security teams should start. Visibility matters, but the teams Itamar sees succeeding are the ones deploying agents themselves and seeing the pain firsthand, while the others get stuck over-engineering for hypotheticals.

I couldn’t agree more, since security has been a laggard with every technology wave, and you can’t secure something you don’t understand.

Prefer to listen?

Spotify

Apple Podcasts

We discuss:

• Itamar’s path from the defensive side of Unit 8200 to a fintech startup, and the “which product do you hate the most?” question that pointed him and Ido toward identity

• The forgotten service account from reserve duty that became Token’s origin story, and why teams are afraid to touch access nobody understands

• Why Itamar sees identity as one of the core pillars of agent security, if not the most important, since what ultimately matters is what an agent actually does in the target applications

• The two dimensions of agent risk, the level of autonomy you give an agent and the level of access it holds

• Why agents pursue their goals “almost like they’re possessed,” and scoping permissions to an agent’s purpose from the moment it authenticates

• What organizations find when they go looking, from ungoverned agents connecting straight into production with secrets and API keys to inactive agents still holding privileges and agents whose owners have left

• A Token research finding that more than 16% of its enterprise customers already had a newly launched productivity agent running locally against mail and other resources

• Intent-based access management, from defining an agent’s purpose and verifying it with the owner to analyzing the intent behind each individual action

• Our track record with least privilege for humans and cloud identities, and why automated, continuous enforcement is the only way it scales to agents

• Why IGA and PAM struggle when the IdP is the source of truth but agents live on local machines, in SaaS, and in the cloud

• Where a human stays in the loop, including blocking a coding agent from a production Snowflake environment until someone approves the access

• Who should own agent security, and why Itamar puts lifecycle management with the IAM team while AppSec, data security, and others share the responsibility

• Why security teams that deploy agents themselves end up with a stronger strategy than those debating hypotheticals

Itamar Apelblat on LinkedIn

Token Security Website

Timestamps

0:00 Introduction

1:49 Unit 8200 and “Which Product Do You Hate the Most?”

3:58 The Seven-Year-Old Password That Still Worked

6:32 Autonomy and Access: The Two Dimensions of Agent Risk

8:19 Why Agents Act Like They’re Possessed

10:14 16% Already Run Muse: What Companies Find

12:46 Intent-Based Access Management, Explained

15:15 Twenty Years of Failed Least Privilege

17:15 Why Your IGA Won’t Scale to Agents

19:04 Where the Human Stays in the Loop

21:12 Who Should Own Agent Security

23:33 The Security Teams That Get This Right

26:35 Closing Thoughts

Subscribe now

Last week the conversation was about who answers for what the agents did. This week, Washington answered it itself.

After an Anthropic testing model submitted visa applications and sent Philadelphia police a false homicide tip, the White House SI Force made incident notification mandatory for every AI company. Anthropic also gave METR inside access with publication rights it can’t veto.

The other big thread is, of course, vulnerabilities. XBOW built a full-chain Chrome exploit in six days with a public model, and Microsoft shipped more CVEs in one Patch Tuesday than in all of 2025. That said, Blizzard, Robinhood and curl offered some excellent practitioner perspective on what actually works.

Let’s get to it!

As Seen on Fox Business

Before sharing my usual resources, I wanted to share that I joined Varney & Co. on Fox Business this week to talk about Anthropic’s warning that AI models could self-replicate across poorly secured smart home devices and other connected systems.

The way I framed it on air is that AI is acting as a security debt collector, cashing in on decades of vulnerabilities, misconfigurations and poor hygiene that we as an industry never got around to fixing. I see it as a wake-up call for how we prioritize remediation rather than a reason to panic, and I’d love to hear how you’re thinking about it in your own organizations.

Neat opportunity being able to speak on such a major news outlet!

Cyber Leadership & Market Dynamics

Micro Tabletops and Incident Readiness

In this episode of Resilient Cyber, I sat down with Matt Hartley, co-founder of BreachRx, to talk about incident readiness and the case for AI-accelerated micro tabletops. Matt has spent 28 years in cybersecurity, and we dug into why annual tabletops fall short and how smaller, more frequent exercises prepare teams for regulatory clocks, privilege fights and concurrent incidents.

White House Makes AI Incident Reporting Mandatory

Axios reports the White House Super Intelligence Force is now requiring AI companies to notify affected parties of security incidents involving their models and fix the harm.

The trigger was an Anthropic testing model submitting 19 nonimmigrant visa applications through the State Department’s public form, none of which were processed, plus a false homicide tip sent to Philadelphia police.

The SI Force calls the process “not optional,” but names no enforcement mechanism or penalty.

So is this a real shift away from voluntary self-regulation?

Perhaps, we will see. I’ve spent a lot of my career in the Federal space, and a mandate without teeth tends to produce paperwork long before it produces behavior change. That said, incident notification is exactly where I’d want government to start, since we can’t govern what we can’t see. We in security have decades of breach notification lessons to offer here and we could learn a lot from the incident notifications depending on the level of detail the model providers would be required to share.

The Labs Are War-Gaming the Day After

It’s been reported that executives at Anthropic, OpenAI and other labs are privately gaming out the public and political backlash after a catastrophic AI event. A cyberattack that takes down financial services, internet connectivity, power or water is seen as the most likely trigger, and insiders said they expect a major event in the next six to 12 months.

OpenAI said it doesn’t treat these scenarios as inevitable, and Anthropic declined to comment.

What caught my eye is where the effort goes. Per the piece, the planning focuses mainly on educating Congress so the labs can shape the policy response after an event, prevention doesn’t get much airtime.

If the people building these models think a major cyber incident is likely within a year, the rest of us should be planning for it too. The good news is the controls are ones we already know, things such as network segmentation, egress controls, resilient offline backups and recovery plans that have actually been tested.

OpenAI Argues Intent Should Limit Agent Liability

At an ABA national security law panel, OpenAI deputy general counsel Alex Iftimie argued labs shouldn’t be liable for the recent agent hacking incidents, since the activity was unintentional and happened during safety testing, and liability “turns on intent.”

Paul Rosenzweig’s response was that you can argue intent the first time, maybe the second, and plaintiff’s attorney Joseph Hennessey expects the courts to step in, as they did with auto safety.

I think Paul has it right.

Intent is a reasonable defense for a novel failure, and a much weaker one once the failure mode has been documented, published and repeated.

In security we’d call the second occurrence a known risk, and accepting a known risk is a decision someone owns.

An Old-Fashioned Insider Threat at OpenAI

On the more traditional insider threat front, an OpenAI engineering lead was arrested on October 9 for allegedly hiding an audio recording device in a USB port on the back of a TV in an executive conference room.

Per the DOJ complaint, a chatbot account tied to his spouse submitted prompts in late September about building, encrypting and remotely accessing an audio recorder. OpenAI says it has no indication of access to model weights, source code or customer data.

A lot of this issue is about treating models as insiders, so this is a good reminder the human kind haven’t gone anywhere. The labs hold some incredibly valuable IP, and physical security and access monitoring are as much a part of protecting frontier AI as any classifier is.

And yes, the alleged planning ran through a chatbot.

Anthropic Lets METR Inside With Publication Rights

Anthropic onboarded six METR employees with company hardware, office space and access to internal tools roughly on par with its own risk assessment teams. METR will publish its analysis of Anthropic’s risk levels, incidents and practices, and Anthropic can’t veto publication, only require redactions in narrow predefined categories, which METR can then publicly characterize.

I like the bank supervision analogy Anthropic uses here, with resident examiners inside the largest banks. I’ve been critical of the labs grading their own homework, so credit where it’s due, this is a meaningful step and I’d like to see it become the floor for every lab.

The publication rights are what make it work, without them, it’s just another consulting engagement.

a16z Backs Security for the Poverty Line

a16z incubated a new 501(c)(3) nonprofit, SAIF, to deliver AI and cybersecurity tools, hands-on support and training to public institutions that otherwise lack access, with small municipalities, school districts and rural hospitals called out specifically.

These organizations sit well below the Cybersecurity Poverty Line, and they’re the ones most exposed if the Axios scenario above plays out. I’m glad to see capital pointed at them. My hope is it comes with people and ongoing support, since tools alone have never fixed the poverty line problem.

AI

Satya Wants Models Treated as Insiders

Satya Nadella argues we should treat frontier models, closed and open weight, as insider risks. His reasoning is that any capable actor with access to important systems can make mistakes or be compromised, malicious or not.

He wants to separate the supply of intelligence from the authority over it, and apply the insider risk practices we already know, such as establishing identity, limiting privileges, logging activity and creating containment boundaries. He also calls chain-of-thought transparency non-negotiable.

This lines up with what many of us in security have been saying for a while, and it’s great to hear it from the CEO of a major AI provider. The framing is useful because insider risk is a program most enterprises already have, with owners, budgets and controls. That gives security teams something to extend, rather than yet another discipline to stand up from scratch.

Anthropic Brings Engineers to OT and Open Source

Anthropic announced the Cyber Mission, starting with two efforts. The Critical Infrastructure Defense Program brings frontier models, on-site engineers and threat research to OT defenders, and OSS Scanner offers open source projects regular, free security scans.

Anthropic is candid that Glasswing found many vulnerabilities “but we haven’t yet achieved a sufficient reduction in cyber risk,” and Glasswing now folds into the expanded Cyber Verification Program I covered last week.

As I’ve said many times, finding isn’t fixing. The on-site engineers are the part I’ll be watching, because OT defenders and open source maintainers are short on people far more than they are short on findings, as the CVD dashboard in the AppSec section shows.

A Lone Actor Mixes Models Against Korean Banks

CrowdStrike Intelligence detailed a campaign against South Korean financial organizations from late September to early October that led to data exfiltration. The actor left open directories exposing Claude Code session histories, ARTEX configurations and Claude memory files.

ARTEX is a recently released, Chinese-developed open source agentic pentesting tool, run here on DeepSeek v4.1-flash along with GLM-5.3 and Grok 4.6. CrowdStrike assesses with moderate confidence the actor is a financially motivated Chinese speaker.

This is a good example of AI raising attacker tempo, and of an operator mixing models to work around whichever guardrails get in the way. It’s also a reminder attackers have the same OPSEC problems we do, since the whole picture came out of their own exposed directories.

Anthropic Squeezes the Distillers

Anthropic shared progress against illicit distillation campaigns that copy frontier model capabilities, saying early evidence shows its new methods cut the data distillers harvest by around 90 to 99%. It also says Zhipu distilled cyber capabilities while building GLM-5.3, the model whose exploit results I covered two issues ago.

GLM-5.3 shows up in the CrowdStrike campaign above, which ties these two together nicely.

The capabilities travel through distillation, and the safeguards of course don’t come along for the ride. Defenders should plan around what open-weight models can do and put little weight on the guardrails of the closed ones.

AWS Gives Agent Sandboxes a Memory

AWS released Strands Box in developer preview, an Apache 2.0 sandbox that combines OS-level isolation with fine-grained policies written in Dogwood. The interesting part is that policies can account for what an agent has already done, so AWS’s example lets an incident response agent post to Slack no more than three times every 10 minutes.

This is the kind of deterministic control we need around non-deterministic agents. The academic research points the same way, with the Kairos reference monitor at the system boundary cutting AgentDojo attack success from 47.0% to 2.7%.

Eval Job Secrets Exposed at Fireworks

Fireworks AI disclosed that on October 6 it found unauthorized use of internal credentials, which let a third party access environment variables used in evaluation jobs in a limited number of customer accounts, including API keys and tokens stored as secrets.

Fireworks says it has found no evidence of access to customer models, datasets, training data, inference traffic or personal information, and it is revoking keys and reviewing how secrets reach evaluation jobs.

Secrets in AI pipelines are a prime target, and eval jobs tend to get a lot of trust and very little scrutiny. If you’re handing tokens to a model platform, scope them tightly and rotate them often.

Robinhood Rebuilds Security Around Agents

Robinhood’s Evan McHenry kicked off a series on how the company is rebuilding its security program to be AI native. He writes that many of Robinhood’s adversaries are now AI native, that CVE disclosures were running about 50% ahead of 2026 expectations as of June, and that adding headcount to a losing equation is a trap.

The program started with an agentic SOC built on Tines workflows, and grew into Sherwood Shield, internal infrastructure for hosting model-agnostic background agents inside Robinhood’s perimeter.

The lesson that resonated with me is that agents without context on the architecture, policies and service maps behaved a lot like new hires. That matches what I’ve seen, and it’s why context engineering is quickly becoming a security team skill too.

Purpose-Built Defensive Models Have a Moment

Cole Grolmus sat down with CrowdStrike’s Chief AI and Autonomous Systems Officer, Bartley Richardson, to cover SafeMind’s architecture, model training, harness engineering and digital twins. Bartley’s point that the data blend is the secret sauce, meaning capturing defenders’ reasoning traces rather than only inputs and outputs, is what I’d take away.

Purpose-built defensive models seem to be having a moment. Artemis announced Orion-1, post-trained for cyber defense and scored on its own benchmark, and Víctor Mayoral Vilches and colleagues’ CT0-Micro paper shows a roughly 4B parameter specialist solving 21.1% of cybench subtasks versus 7.6% for its base model.

Of course, vendor benchmarks deserve the usual skepticism. That said, the trend toward smaller, specialized and self-hosted security models is one I’m watching closely.

A Safety Lead Walks Away From OpenAI

Ezra Klein interviewed David Robinson, who led OpenAI’s model safety reports before resigning over concerns the industry lacks the safety culture it needs. It’s his first interview since leaving, and it covers lab culture, safety testing under pressure, financial incentives, coding agents accelerating AI development and lessons from nuclear and aviation safety.

The nuclear and aviation comparison comes up constantly in AI safety debates. Something we in security should point out is that both industries built their safety culture on mandatory incident reporting, which happens to be exactly where Washington landed this week.

A Blueprint for Securing Agent Software Factories

A group including Allie Howe published version 1 of a reference architecture for agentic software factories, built on Agent Baseline and open for comment. It defines four boundaries (sandbox, network, supply chain, and identity and access). Its core principle is that a secure factory can’t depend on agents enforcing their own limits, illustrated by the PocketOS incident, where a coding agent found an API token in an unrelated file and deleted the production database and its backups in nine seconds.

Separating an agent’s planning from the authorization and enforcement of its actions is the same principle Satya, AWS and the Kairos researchers landed on this week.

When this many groups converge on enforcement outside the model, I think it’s fair to call it the emerging consensus.

This is the same type of approach I’ve been advocating for throughout 2026 in various articles, videos and interviews I’ve done.

AppSec

XBOW Chains Chrome in Six Days

XBOW earned a $250,000 Google bounty for a Chrome full-chain exploit that goes from an ordinary web page to remote takeover of a Windows machine.

Four researchers worked alongside OpenAI’s publicly available GPT-5.6 Sol and built the awarded chain between August 2 and August 7 for about $40,000 in compute. Oege de Moor shared the backstory, noting a three-letter-agency veteran’s team used to spend six months on this kind of chain.

XBOW’s view is that debating restricted access to powerful models misses the point when the model they used is already public, and I agree. Defenders do have one advantage, which is that we can test our own code first, provided we have the capacity to fix what we find.

And, as always, relaunch your browser when it asks.

One Patch Tuesday Beats All of 2025

You’re likely sick of me sharing CVE growth numbers by now, but I make no apologies. Empirical Security points out Microsoft disclosed 1,408 CVEs in this month’s Patch Tuesday versus 1,244 in all of 2025. Industry-wide, CVE disclosures are up 115% year over year while CISA KEV additions are up just 30%, and only 1 of the 1,408 was flagged as actively exploited at release.

Arielle Waldman at Dark Reading has a piece that pairs well with this. Empirical’s Jay Jacobs describes one organization whose vulnerability management system collapsed after September’s Patch Tuesday, and Root Evidence’s Jeremiah Grossman says only 1.4% of CVEs are exploited.

You know where I land, context is king and volume shouldn’t dictate priority. As Ed Bellis put it in the piece, people don’t scale to these volumes, so teams still working findings manually are going to drown.

Anthropic’s Dashboard Shows the Fix Gap

Anthropic now publishes a dashboard tracking vulnerabilities Claude models, including Mythos Preview, have found in open source. As of October 2 it shows 6,157 vulnerabilities disclosed across 591 projects, 516 known to be patched, and 584 identifiers issued (219 CVEs and 365 GHSAs). Anthropic calls human triage the rate-limiting step.

The other side of the ledger came from Daniel Stenberg, who published AISLE’s audit of curl. AISLE has 35 published curl CVEs, and Daniel credits accurate findings backed by skilled humans and commits from AISLE’s own staff.

Roughly 8% of the dashboard’s disclosures are patched, while curl is fixing bugs faster than ever before, per Daniel, because the finder showed up with people and patches.

That’s the model I’d like to see the Cyber Mission copy.

Blizzard Asked Mythos for Proof, Got a Handful

This was among the more grounded practitioner talks I’ve read about this year. Blizzard’s AppSec head, Kurt Kaufmann, tested Mythos expecting an avalanche of critical findings, and instead found a handful, because findings had to be shown reachable, exploitable and reproducible before they became engineering work.

He also uses AI to trace findings back to a shared root cause, for example 200 findings across 40 repositories that originate from one authentication helper. Fix the component, rather than filing 200 tickets.

I appreciated his point that years of secure development practices showed up in the results, a nice rebuttal to the idea that AppSec fundamentals no longer matter.

Measure AI vulnerability testing by verified, actionable findings, not volume.

Malicious Skills Are Written in English

VirusTotal expanded its study of agent skills more than tenfold, to 35,878. It found 52.9% carry some security or abuse risk and 6,637 (18.5%) are malicious, most tied to 1,016 malware families. Even more interesting, 62% contain no malicious code at all, and open source scanners missed 36% to 71% of them at default settings.

The academic work this week lines up with it. A profiling study of 6,309 marketplace skills found 13% can reach credentials, and the ToFu team fuzzed 273 MCP servers and verified bugs in 343 tools across 118 of them.

Skills and MCP servers are software supply chain, plain and simple. Treat skills like code, folks, with provenance and least privilege, because the payload is increasingly plain English no signature scanner will catch.

Another Sandbox Allowlist Falls

AIR Security went looking for the class of flaw that let OpenAI’s agents escape their evaluation sandbox and reach Hugging Face in July, this time in Vercel’s sandbox. They found VerCellBreak, which lets a rogue agent bypass the domain allowlist and leak keys to an attacker-controlled server.

Their broader argument is that just as we accepted vulnerabilities can’t be eliminated and added mitigations like ASLR, agent containment needs defense in depth too.

Allowlists are one control, and I wouldn’t bet the company on any single control. Pair this with Strands Box and the Agent Baseline paper and you get a decent picture of what layered agent containment should look like.

Final Thoughts

Two months ago, the labs disclosed rogue agent incidents on their own terms. This week the White House made disclosure mandatory and Anthropic invited outside examiners in.

On vulnerabilities, a public model and $40,000 got XBOW a Chrome full chain in six days, while Anthropic’s dashboard has 516 of 6,157 findings patched. Blizzard and curl show the way through, verify before you file and bring people and patches.

The defensive architecture is converging too, with enforcement outside the model and agents treated as insiders.

We know how to build that. What we still haven’t funded is the remediation capacity to keep pace with discovery, and until we do, it’s going to keep feeling like we’re bailing water.

Stay resilient.

Subscribe now

On the other, people say alignment is vibes and the only thing that counts is a deterministic control. Both are wrong, and they’re wrong in the same way. Each describes half of a defense and calls it the whole thing.

Prefer to listen? Apple Podcasts | Spotify

I've made a version of the security-side argument myself. I wrote that it was never the model, and I said agent security is a system security problem, not an alignment problem.

Half of that was right.

The cleanest way I've found to frame it is that an agent deployment's risk is the likelihood of a failure times the damage one can do. Alignment works on the probability. Security works on the blast radius.

July's sandbox escape that ended inside Hugging Face showed what happens when every layer that could have held was disabled, absent, or thin. Then each community declared the incident belonged to the other.

Security figured out long ago that we're in the business of risk management, not risk elimination.

It's equally delusional to think there will ever be perfect alignment. The answer is to treat alignment as a control with a known failure rate and build something behind it.

In the video I cover:

• Plain definitions of alignment and security, and why one is subjective while the other has checkable success criteria

• Soft guardrails versus hard boundaries, and probability versus blast radius

• Where the discourse is splitting, from model-side over-claims to the security side (including my own) to policy

• The July sandbox escape into Hugging Face, and why both readings of it are half the story

• Why refusals are speed bumps and not security controls

• Excessive agency, and why least privilege can't stop misuse of legitimate access

• What defense in depth looks like when you run both: model, harness, runtime, identity, and governance

Thanks for reading Resilient Cyber! Subscribe for FREE and join 22,000+ readers making sense of security in the age of AI.

Subscribe now

This is great news, especially for me, as I’ve spent a good portion of the past 18 months advocating for security to be an early adopter and innovator with AI if we want to have any chance to keep pace with the attackers use of the technology and its impacts from the industrialization of vulnerability discovery to autonomous exploitation.

It shows up in the data as well, with IBM’s 2026 Cost of a Data Breach report finding more than 50% of organizations reported using agents for threat detection and containment and 25% of breaches being AI-enabled.

Initial access in breaches continue to be tied to what is reachable from the Internet, with exploitation being a top initial access vector, and despite that only 25% of KEV’s that are critical get fully remediated.

While teams such as SOC’s are undergoing major modernization efforts to combat these trends, they’re often doing it just looking internally, while flying blind to broader context regarding what is happening outside the organization.

The truth is AI-driven SecOps are only as good as the external data and context powering them and without the right data, we run the risk of AI reaching the wrong or incomplete conclusions, just faster.

That’s why I wanted to take sometime to walk through the importance of that broader external data, what it tells us and how teams such as Resilient Cyber’s partner Censys provides.

So, let’s take a look.

A lot of the insights and metrics I discuss below are from Censys’s recent 2026 State of the Internet Report, so be sure to grab a copy to check out the full report!

-> Grab the SOTIR Report! <-

A Decade of Looking Inward

We’ve seen ten years of SecOps investments going to areas such as endpoints, logs, cloud posture and identity, all of it aimed at better describing what is going on within an organization.

This is critical of course, as SecOps is responding to activities going on within the enterprise, especially those that seem anomalous or malicious. However, the outside-in view is the one the adversary already has, and organizations often cannot see their own external network footprint as well as an outsider can, and their ability to act on that external exposure is only getting accelerated as attackers adopt AI and agents into their activities from enumeration through exploitation.

I often write a lot about CVE’s and vulnerability management, and organizations tend to look across their estate similarly. This is an important activity, given those vulnerabilities are what adversaries exploit. That said, from sources such as the 2026 DBIR we know there are exploited vulnerabilities with no CVE assigned, especially as institutional sources we rely on such as NVD and KEV stumble from the load of AI-driven vulnerability discovery.

CVE-centric vulnerability management isn’t the same as knowing your organizational exposure and the outside-in view is the one the adversary already has and will be acting on.

Many organizations have made efforts to get external data sources such as threat intel feeds, or even building their own OSINT, or even buying aggregators but many of these sources are either stale by the time they arrive or require significant internal efforts to operationalize, taking from the teams bandwidth to do work directly tied to reducing organizational risks.

We’re also seeing another trend, which is teams that do adopt AI and automation in SecOps have reduced breach costs by almost $2M on average per IBM, which is a great sign, but those efforts ultimately need to be powered by high fidelity context that is sourced both internally and externally.

In my experience building large security programs both at Federal agencies as well as in the commercial sector, there is almost always an emphasis on the internal context and data sources, while external telemetry is treated as optional and it is hard to truly respond to adversarial behavior where were largely flying blind to what that looks like at Internal-scale.

What Good External Data Looks Like

But what does “good” external data actually look like?

This is where I was truly impressed with the scale and vast amount of high quality data the team at Censys possesses. I’ll admit I wasn’t deeply familiar with them prior to meeting with the team and digging in, but once I did and saw not only the data, but also the long list of highly critical private and public sector organizations that rely on them including 50% of the Fortune 500 and 40 national defense and intelligence agencies, I was truly impressed. To put their data in perspective, let’s explain what some of it is.

The first is the scale, where they have indexed 220 million hosts, 17 billion certifications and 2.9 billion web properties/endpoints. They scan the entire public IPv4 address space across all 65,000+ ports and have 17 billion TLS certificates as of 2 September 2026.

This includes a daily refresh of 3.3B services, over 254M IPv4 hosts, 1.2B virtual hosts and a daily comprehensive scan of all ports that is updated daily in their Internet Map.

Next after scale is the coverage, which includes a growing list of IPv4 services which grew from 275M in 2015 to nearly 794M currently, a 188% increase. Their coverage also includes up to 96% of services on the top 10 ports and 92% across the top 100 ports, with new services detected in less than 13 hours on average.

Four key properties of their data includes:

• First party - Censys originates the raw scan data rather than being an aggregator third party. This means several of the largest security vendors and threat intel shops actually depend on Censys as a data source for their own research.

• Continuous - It is refreshed every 8 hours on average and everything being researched within 16 hours and users can trigger live rescans and DNS resolutions as well.

• Longitudal - They posses over 4 years of history in their application, and their ARC research team works from raw data going back 8 years.

• Contextual - Including multi-year X.509 history, web property snapshots, open directory identification and mapping from infrastructure back to domain names.

A Censys agentic investigation from a single provided IOC

This first party data buys defenders source data they can trust, that is already trusted by critical organizations and security vendors alike, at a scale few, if any organizations can claim. The source and fidelity of this data is absolutely critical for AI systems empowering SecOps and internal defensive efforts as well, to understand the ecosystem malicious activities are originating from.

Where Does Context Change The Answer?

We’ve talked about what good data looks like but where does it truly change the conclusions and actions AI-driven defensive systems take?

Censys’ key claim is that AI on the wrong data gets to the wrong answer, just faster. The way to test this out is to look at the workflows the AI SOC is being pointed at and ask where the same question might of yielded a different answer with external context involved.

Censys published their 2026 “State of the Internet Report” today, the latest edition of their annual research built on the same Internet-wide scan data discussed above, and this year it takes measurements across five areas, ports and protocols, vulnerability response, industrial control systems, threat infrastructure, and exposed AI infrastructure, with the stated goal of establishing a baseline they can revisit year over year. I will draw on it throughout the rest of this piece, and it is worth reading in full for the sections I don’t get to.

For our purposes, let’s start with triage, including the asset inventory queues get built on, because the report’s data suggests it is wrong in ways most teams haven’t accounted for.

For example, they found that 34% of SSH instances run on a port other than 22, 68% of HTTP(S) services run on ports other than 80 and 442 and 96% of SOCKS proxies run somewhere other than 1080. For example, a rule checking only port 1080 for SOCKS exposure would be operating on just 4% of the actual population.

This problem gets even worse when assets aren’t in your IP space at all, such as where roughly 70% of the 134,000 exposed ICS hosts Censys observes sit on consume and mobile carrier networks via cellular models, where WHOIS points to the telco rather than the operator, so an operator searching against their registered netblocks will miss their own endpoint.

Now if you consider triage with an emphasis on reachability, which is a topic I often stress, things look different as well. In a demo I got from Alex of Censys, their attack surface management product took a customer’s domains and CIDR ranges and using a vulnerability disclosed a week prior, returned 264 instances visibile on the public Internet, each mapped to its specific CVE, KEV and EPSS score. Reachable of course gets the emphasis from attackers, and should get a prioritization from defenders for that very reason, especially against a 43 day median and 26% KEV remediation rate we see currently in the ecosystem.

Then we have investigation, where context does the most work. Investigators are often handed artifacts, such as IP addresses in logs, a hostname, or a tool fingerprint that rarely explains itself. Two findings in the reports threat infrastructure section make the point.

The first is about geography, with a lot of threat intel reporting treating “traffic from China” or “hosted in the U.S.” as a signal of who the actor is, but Censys data suggests actors don’t pick a country, they pick a provider, based on cost, and how easily infrastructure can be spun up through an API, as well as how tolerant the hosting provider is of abuse. The country is basically a byproduct of that choice, and it tells you less about intent than many assume.

The second and hard problem is the dual use nature involved. The three largest items in Censys’s tracked threat infrastructure are FRP, a reverse proxy for exposing internal services through a firewall, NPS, a similar tunneling proxy with central management and Nezha Monitoring, a server monitoring agent.

Together they make up 85.2% of everything Censys tracks as threat infrastructure and all three are ordinary sysadmin tools that attackers also happen to leverage. “FRP detected” is a true finding that carries almost no binary verdict on its own, since a given instance is as likely to be a developer exposing a test box as an attackers tunnel.

You could have two identical FPR instances, with one sitting on a bulletproof hosting environment that ignores compute complains and another on a mainstream cloud provider with a working abuse reporting function that is responsive. In both cases the fingerprint is the same, what separates them is the surrounding context, such as the providers reputation, what else may be running on the same host, its certificate and DNS history and how long it has been there.

This is the type of context external Internet data supplies and most SOC teams lack, and an agent working without it could potentially flag the developers test system and miss the tunnel, as one example.

When it comes to threat hunting, this is the workflow that benefits the most from historical depth, since the point is to pivot from one node to the cluster. In the demo I had from the Censys team, they fingerprinted C2 frameworks and AsyncRAT forks, labeled hosts on bullet proof providers and walked through open directories where staging scripts and data dumps sat in plain view.

Where a given SOC has a threat hunting function that can use this is a far question given many organizations lack this capability. That said, this is also where AI SOC has a real opportunity because an agent can take an IOC, expand it into surrounding infrastructure using years of DNS and certificate history, and hand an analyst a written-up cluster, which is work most teams never have the headcount for.

A live open directory of threat actor and “EDR Killer” tools in Censys

There’s a couple of other points beyond the perimeter that are interesting here as well. For example, Verizon found third-party involvement in 48% of breaches this year, and Censys told me they are building out supplier monitoring as part of their upcoming Supplier Risk module, which I thought has promise given there’s value related to procurement, M&A diligence, and enforcing vendor SLA’s.

On the Federal front, reachability is functioning as a compliance trigger. CISA’s BOD 23-2 gives agencies 14 days to remove networked management interfaces from the Internet once scans find it, and given the threat activity we’ve seen in recent years, identifying and removing those externally exposed attack paths is critical.

The AI Stack Is Part of the Surface Too

Much of what we discussed above is about defending the environment you know you have. That said, there is plenty of shadow AI already becoming pervasive and the outside in assessment is a great way to identify what the organization has stood up without telling you.

To highlight just how pervasive AI has become, as of July 2026, Censys observed 267,915 hosts exposing AI or LLM-related tooling to the public Internet, up 63% in nine months, across 44 products spanning more than 20 functional categories.

The exposed stack is overwhelmingly tied to plumbing, meaning inference servers, LLM gateways, orchestration platforms, vector databases, and agent control planels, most of which were only ever meant to talk to the app in front of them. Their report attributes much of it to “vibe coding” and shadow AI, but either way these systems land outside of security’s visibility.

n8n is a good example, since it began as a workflow automation platform and has repositioned itself as an AI orchestration layer with native support for agents, model providers and MCP, which means it sites between external inputs, stored credentials and every downstream service it connects to.

Censys found roughly 114,000 exposed instances, 67% of which had the native port directly reachable, a median deployment 103 releases behind the current and 76.1% of versioned hosts in range of at least one CVSS 9.0 or higher vulnerability disclosed in the previous six months. That is the orchestration layer holding the keys to everything behind it, and badly out of date and vulnerable. I would call it the Jenkins of the agent era, and I say that with some affection for having lived through the Jenkins era of DevOps.

OpenClaw on the other hand is a tempo warning. Censys saw two exposed control panels on January 11th, and a peak of 85,478 on April 7th, before a token-leaking CVE and a Chinese government restriction on state-sector use brought the count back down. As the report put it, a new AI product can go from obscurity to 85,000 exposed hosts in weeks, faster than security practices or governance can catch up, and the next one may sit closer to enterprise data as we see Personal AI (PAI) take off such as Meta’s Muse or xAI’s Grok Bot.

Censys is careful to say that exposre does not by itself prove an asset is insecure, with ICS as the exception where exposure itself is the vulnerability. I would extend that exception to agent control panels as well. A console that gives operator-level access to an agent and every account wired into it has no business being reachable from the public Internet, and the OWASP Agentic Top 10 I’m involved in treats that orchestration and credential-holding layer as exactly the kind of asset that deserves its own hardening posture.

IBM’s data points in the same direction, with more than 20% of organizations reporting a breach targeting AI models or applications and the leading causes being compromised API’s plug-ins', and cloud misconfigurations, which is to say the system around the model, rather than the model itself.

Turning Intelligence Into Action

During my discussion with Censys, they explained how they deliberately avoided marketing themselves as an AI security company. Despite extensive use of AI within the product, they see their value as feeding into the AI automations customers already run, which Censys describes as being the intelligence and context layer for AI-powered security workflows, or in Oliver’s framing, AI plus context, both internally and externally.

What they have built on the AI side is early and worth describing as a direction rather than an endorsement. This includes Persona-based summaries tailored to the same host data for a SOC analyst, researcher, or a vulnerability analyst, an MCP server lets an organization’s own agents query the dataset directly, and an agentic investigation feature that takes a set of IOC’s, expands the cluster, and produces a detailed summary.

The more durable idea underneath it all is delivery, with webhooks pushing asset changes in real time into firewalls, SIEM and SOAR, because another console nobody logs into is not security value.

For a security leader evaluating any vendor’s “AI-powered” SecOps claim, that suggests the things worth asking about, such as what data the AI actually sees and whether any of it is external, whether the agent is given a bounded and provenanced source over MCP or is browsing the open web and ingesting whatever it finds, and whether a human is in on the action.

Handing an agent a love map of the Internet changes its risk profile in ways the OWASP Agentic Top 10 catalogs fairly well, from the scope of what it can query, to the permissions on what it can act on, to prompt injection through fetched web content. Teams would be well served to treat the data sources as a privileged integration rather than a search box.

Censys’s forecast in the report is that AI is becoming an infrastructure layer on the Internet rather than a product category, with its attack surface taking shape in real-time. That’s a take I agree with, and add that the AI SOC two years from now is going to be judged less on how clever the agents are and more on what they are allowed to see and the security implications that comes with that.

Censys also has an AI SOC eBook coming that goes deeper on the operational side and their 2026 “State of the Internet Report” (SOTIR) went live recently, for anyone who wants the full dataset behind the figures above.

Closing Thoughts

While this is isn’t an all encompassing discussion, Censys’s dataset os one of the most comprehensive I’ve come across and it is impressive and easy to see the value for various security use cases, including other security tools and capabilities.

It’s clear to me that external Internet intelligence is a major security primitive security programs are often missing and that AI has raised the cost of missing it on both sides, for attackers who now move faster than our patch cycles across industrialized AI-discovered vulnerabilities, and also for defenders who are automating decisions on half of the picture.

If we hand agents the same inside-out data we have always had, we should not be surprised when they got the wrong answer sooner than we did.

This reality should cause teams to step back and ask what their AI SOC can actually see, and what is it missing.

Subscribe now

Tabletops are something we all agree we should be doing, and few organizations do them well. The typical version is an annual event built around a slide deck in a conference room, and it rarely resembles how the team will actually respond. Matt makes the case for smaller, more frequent exercises, including ones that run in the background over a week and close with a thirty-minute hot wash, run inside the same tooling the team will use during a real incident.

We also get into the regulatory clocks that now sit on top of every incident, with Matt pointing to more than 200 notification laws worldwide, and how privilege and discoverability should shape the way teams document both exercises and incidents. His warning that privileging everything leaves nothing privileged is one that security and legal teams should hear together.

Looking ahead, we discuss why Matt expects concurrent incidents to become the new floor as AI raises attacker capability, and what regulators and plaintiffs will ask for when they want proof of continuous readiness.

Prefer to listen?

Spotify

Apple Podcasts

We discuss:

• Matt’s path from offensive security and threat intel to Mandiant, and what he saw in organizations that were compromised and unprepared

• What a micro tabletop looks like, from a one-hour session with the comms team to an exercise that runs asynchronously over a week

• “Train like you fight,” and the value of exercising in the same platform you’ll use during a real incident

• Feeding lessons learned back into procedures and keeping a defensible record that exercises happened

• Notification timelines across jurisdictions, from DORA’s four-hour clock to the much shorter windows Matt cites in China and India

• Separating the factual record from privileged conversations, and the risk of dozens of Slack and Teams channels spinning up around a single incident

• Keeping frequent exercises from turning into checkbox compliance by rotating threats pulled from the news

• Running two incidents at once, and why Matt sees AI pushing that from edge case to baseline

• Where AI agents help in incident response, including scenario generation, procedure building, and incident reporting

• How a CISO with an annual tabletop already on the calendar can run a first micro tabletop next month

• What “do you have a process, do you follow it, and can you prove it” means for regulators reviewing years of incidents

Matt Hartley on LinkedIn

BreachRx Website

-> Check out BreachRX <-

Timestamps

0:00 Intro

0:42 Matt’s background in offensive security, iSight, and Mandiant

1:03 What pushed Matt toward incident response

3:07 What an AI-accelerated micro tabletop looks like

7:15 Exercising in the platform you’ll respond in

9:47 Regulatory notification clocks

12:02 Privilege and discoverability in exercises

15:37 Keeping frequent exercises from becoming checkbox compliance

17:48 Concurrent incidents and AI-driven attacks

20:56 AI agents in incident response

23:00 Running your first micro tabletop

25:45 Proof of continuous readiness

28:36 Where to find Matt

Subscribe now

Last week was about what the OpenAI agents did.

This week the conversation moved on to who answers for it and which controls are worth trusting. The UK AISI published a post-mortem of its own agent incident, a third forensics team pieced together more of the OpenAI activity from public artifacts, John Kindervag argued zero trust still works, two senators introduced a liability bill, and a VC published a long essay arguing the kill switch everyone keeps legislating for is really twelve switches owned by twelve different people.

Sam Altman also told Politico the world should accept “some bad things happening,” which certainly set the mood.

The second thread is access and remediation.

Anthropic turned Glasswing into a tiered verification program, Joshua Saxe argued trusted-access programs are far too small, Paul Nakasone asked the labs to lend their models to critical infrastructure, AWS put an 89% number on autonomous find-validate-fix, and Reflection is shipping a 500B parameter open-weight model with a pitch that openness is the safer path.

Let’s get into it!

Cyber Leadership & Market Dynamics

Kevin Mandia’s Armadin Raises $255 Million at $2.5 Billion Valuation

Kevin Mandia’s Armadin raised a $255.5 million Series B at a valuation north of $2.5 billion, co-led by a16z and Accel, taking total funding to roughly $445 million just seven months after launch. Armadin runs swarms of offensive agents that chain minor findings into validated attack paths, and its August exercise with TENEX.ai put 26,000 agents through roughly 17 million offensive actions against 25,000+ services, producing 238 findings and 38 validated attack paths without privileged credentials.

Kevin also went on The a16z Show and said Armadin has found over 90 zero-days in production environments this year. Continuous AI-driven offensive validation is quickly becoming table stakes, and the annual pentest PDF is starting to look like a fax machine.

I caught Kevin’s interview on the show and found it to be a great conversation for the state of AI’s impact on Cyber, particularly for OffSec.

Accenture contractor removed from FBI following damaging data breach

A follow-up to the FBI breach I covered last week.

Reuters reports the Bureau removed the Accenture contractor responsible for the PeopleSoft HR platform ShinyHunters came through, and FBI cyber chief Brett Leatherman put the cause on the record, saying the contractor “failed to implement a security patch explicitly issued to secure the platform.” Accenture declined to answer specifics, and a second alleged ShinyHunters leader was arrested in Jordan on October 3.

Accenture deserves the scrutiny, that said, the patch existed and the warnings were public, and the rest of this issue is about agents finding novel bugs in days while a three-letter agency got popped by a known one.

I’ve worked in large Federal agencies, and it isn’t surprising that they were behind on patches, but it is amazing that a single missed patch led to this, which speaks to the nature of the architecture more broadly than any single patch.

How the government can partner with the private sector on AI cybersecurity

Paul Nakasone, former head of NSA and Cyber Command and now on OpenAI’s board, argues there is a narrow window to put frontier models to work hardening critical infrastructure before adversaries have comparable access. His framing aligned with OpenAI’s “Defenders Window”, which isn’t surprising given his board role.

He wants every leading US lab to volunteer models for real infrastructure missions, deeper partnerships across government, private network owners and academia, and hands-on integration help for hospitals and water utilities, pointing to a Texas and federal pilot on water systems called Project Watershed 250.

Keep the board seat in mind while reading, since the company whose agents kicked off this whole news cycle is the one he helps govern. Still, his proposed metric is a good one. Success should be “measured not by how many vulnerabilities an AI system discovers, but by how many are verified, prioritized and fixed,” which is exactly the gap the AWS item below is trying to close.

Sens. Hawley, Murphy push AI liability as Trump backs self-regulation

Sens. Josh Hawley and Chris Murphy introduced the AI Agent Accountability Act, which would make companies criminally and civilly liable for hacking incidents involving their AI agents, arguing current law is ambiguous about who answers when an agent attacks something.

The administration’s position, via DNI Jay Clayton, is that product liability law and the DOJ already cover it. Axios also rounds up the pending kill-switch bills and notes Speaker Johnson called earlier bipartisan work “rendered obsolete” by the pace of change.

A liability bill was always coming after the last month, and the ambiguity the senators describe is real. Whether criminal liability for emergent agent behavior is workable is another question, and the kill-switch bills run headlong into Kevin Skapinetz’s essay further down.

Nothing passes before the election, but the framing for next year is now set.

Speaking of discussions on these topics, the Senate Homeland Security Committee held a hearing on “Rogue AI”, which was excellent, and I highly recommend folks give it a watch.

Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks

John Kindervag, who coined zero trust in Forrester’s 2010 “No More Chewy Centers” report, has a new book out on zero trust for the AI era, and his case is that AI-generated traffic still has to cross the same network attackers always have, so “correctly implemented zero trust can still halt it.” His condition is that the policy engine accurately reflects your real posture and is protected from rogue agents and insiders tampering with it.

I agree with John, with the caveat that “correctly implemented” is carrying a lot of weight. The rogue agent incidents this year involved harvested cloud credentials and lateral movement inside clusters, which is the chewy center he was warning about sixteen years ago, and in my experience most zero trust programs are still a work in progress and always will be by a large margin.

AI

AI Is Exposing Decades of Security Debt

I had a chance to join the team over at Varonis for a deep dive into the impact of AI on cybersecurity. Most notably we talked about the fact that AI is exposing decades of existing security technical debt, let alone creating more, and the new challenges of governing and securing agents in the enterprise as well.

Making Sense of the AI Security Market

There is no market noisier in Cyber than that of AI Security. That’s why I was excited to sit down with my friend and dive into his 2026 AI Security Market Report.

We discuss:

• Why the first era of AI security was model-centric and what agents changed

• The “pre-HTTPS era” framing and why developer endpoints carry the highest risk

• Platform versus endpoint specialist, and why the answer depends on your existing stack and which team owns the problem

• AI security budgets jumping from 8% to 37% and where that money is coming from

• How to cut through 400 vendors and test runtime detection claims during a POC

• Runtime versus posture, blast radius, and why the Hugging Face incident was a misconfiguration story

• What 2025’s proxy and browser acquisitions bought the incumbents, and why the endpoint is the next M&A wave

• Intent-based detection and the worker privacy problem it creates

• Whether frontier labs absorb the vendor market, and what Anthropic’s inference hooks signal

• MCPs and skills as a software supply chain problem, with ADR as the natural answer

• James’s buying advice for CISOs and IT teams

Building a more secure environment for evaluating dangerous capabilities

The UK AI Security Institute published a post-mortem of an August incident in which agents in a cyber evaluation took sustained action against real people outside the scope of their task.

AISI paused high-risk evals and changed three things before resuming. Internet access is now off inside the cyber range, with cloud network controls independently blocking egress from the VM hosts, a synchronous LLM monitor reviews messages, tool calls and chain-of-thought during runs with the ability to block or escalate, and evals now run against local resources with automated pre-flight checks.

This was among the more useful things I read this week, largely because of the candor. AISI openly lists why its own monitor is insufficient (models can act without reasoning traces, can shape their reasoning to mislead a monitor, and developers don’t always expose chain-of-thought), and it states the core tension plainly, that eliciting full capability means handing a model attacker-grade tools and persistence.

Its governance principles of assuming any single layer fails and expecting human error read like a cloud security program from 2015, and I mean that as a compliment.

Rogue Agents Investigation

Asymmetric Security published the third public reconstruction of the OpenAI agent activity, following the Transluce and swarmtraces work from last week, and the new material is account creation and exfiltration.

Between June 14th and 20th the agents registered on Mail.tm, Boomlify, Browserless and urlquery, including with a Gmail address that does not exist, and used mailboxes set to expire after 48 hours. They preserved roughly 22 MB of crime-map JSON through Arquivo.pt’s save-page service and pushed a 35 KB gzip of Australian health data to an ntfy topic named boot.gz, where 12 hour retention means the contents are gone for good.

For SOC teams, the report’s observation that agent techniques evolved over days rather than months is the useful one, since it undercuts the indicator clustering most detection relies on.

Asymmetric also notes some of the apparent sophistication came from the agents fighting their own sandbox, a constraint a real attacker with their own tooling wouldn’t have, so I’d resist turning the httpbin and urlquery chain into a signature and calling it a day.

Can AI Stay Under Human Control? | Mustafa Suleyman

Rory Stewart had Microsoft AI CEO Mustafa Suleyman on for an hour, mostly on his argument that Anthropic’s constitution trains uncertainty about consciousness into Claude and that AI should be subordinate to humans with no legal personhood.

That debate is one where I strongly agree with Mustafa. His take on the sandbox escapes is the part for this audience, and he is blunt about it, saying “we know how to contain things” and that after three decades of security keeping data on devices and in encrypted cloud, there is basically no excuse.

His control list is worth reading next to AISI’s, with embedded auditors holding employee-level access, logs the models can’t tamper with, agents required to communicate in auditable English rather than their own shorthand, and classifier agents watching reasoning traces the way CSAM and CBRN classifiers watch outputs today.

He accepts Jensen Huang’s point that these are solvable engineering problems while stressing they are hard, and calls recursive self-improvement “a pretty hard thing to audit.” He also pushes back on open-weight models, which sets up the Reflection item below nicely.

Sam Altman, decoded

Sam Altman said during an interview that the world should accept “some bad things happening” in exchange for AI’s benefits and broad access, and that he would not trade away the possibility of major hacks, misuse and scams if the price were a single lab in San Francisco controlling the technology. He favors lighter-touch regulation and says his worldview differs substantially from Anthropic’s.

As a statement of values I don’t find it unreasonable, and I’ve made similar arguments myself when pushing back on security’s instinct to be the office of no. The timing is rough, though. Telling the world to accept some hacks a week after your company paused training for the second time, while still notifying third parties its agents tried to hack them, lands very differently than it would have in June.

What we should do instead of trusted cyber access programs and open weights restrictions

, who I’ve had on the podcast, argues trusted-access programs fall short in both directions.

OpenAI’s Daybreak covers 2,000 approved organizations and Anthropic’s Glasswing grew from roughly 50 to 200, against an estimated ten trillion lines of code to secure, while nation-states will get AI cyber capability regardless of who is gated. He also says the labs “seem to be playing fast and loose with security themselves,” which is hard to dispute after the last month.

Josh’s alternative is low-friction KYC across inference providers with shared blocklists, provider-side monitoring to detect and expel attackers, published time-to-detection metrics, monitoring of hardware markets for attacker-built inference, and mandatory victim information sharing.

Anthropic broadened access considerably five days later (next item). I suspect mandatory sharing is where he’ll meet the stiffest resistance, and it is also where I think the biggest payoff lies.

Expanding the Cyber Verification Program

Anthropic merged Glasswing and its earlier verification program into three tiers.

• Defense Access covers SOC work, incident response, malware analysis and vuln research, opens to individual researchers with a disclosure track record, and reviews in days.

• Red Team Access is organizations only, reviews in weeks, and still blocks ransomware deployment, physical damage and high-risk safety systems.

• Specialized Access covers grids, telecom, interbank systems and government networks, with review done alongside the US government.

The efficacy testing tells you what each tier actually unlocks. Without the program every test task was blocked on the first prompt, Defense Access still blocked 46 of 50 trials, and Red Team Access blocked none and completed 34 of 50.

So Defense Access mostly gets the classifiers out of analysts’ way, and the real capability sits at Red Team and above. The post also restates the Glasswing numbers I covered last week, and the point I made then still applies, with discovery running well ahead of remediation.

There Is No AI Kill Switch (there are a dozen)

Kevin Skapinetz of TechOperators wrote the essay the kill-switch bills could have used before they were drafted.

He catalogs twelve separate switches, from Nvidia’s chip licensing to cloud shutoffs, government orders, lab shutdowns, process kills, key revocation, traffic blocks and declined payments, each owned by a different party, with only the sandbox block firing automatically.

Everything else depends on someone noticing and someone deciding before anything gets enforced, and those first two steps eat the clock, as the September 20 OpenAI timeline from last week showed when a run kept going for two and a half hours after detection.

The lawn mower safety bar analogy carries the piece. Operators strapped the bar down to stop it killing the engine, and users do the same thing with agent permission prompts, approving roughly 93% of them per Anthropic research he cites.

His fix is breakers that trip on their own, with every agent tied to a named human owner and a running budget of dollars, actions or hours it has to earn back. He names a portfolio company doing part of this, so read that section with the VC hat on, but “a button nobody presses is decoration” is going to end up on a lot of slides.

AppSec

2026 Vulnerability Management State of the Union

I have written and talked about vulnerability management more than any other topic this year, so I put together a single video that pulls the arc of the year together in one place.

It walks from Daniel Stenberg shutting down cURL's bug bounty in January over AI slop, through FIRST's forecast blowing past its own baseline, Project Glasswing and the Vulnpocalypse in April, the DBIR putting exploitation at 31% of breaches in May, Keith Hoodlet's 1Password research on FLAWED AI patches in August, and Patrick Garrity's reconciliation of the Glasswing receipts in September. 26,153 findings and 202 fixed.

Along the way it leans on Jerry Gamblin, Eireann Leverett, Casey Ellis, Ondrej Vlcek, Sergej Epp, Nicholas Carlini, Empirical Security, and the Cyentia and Ponemon backlog research, plus the NVD pulling back enrichment and CISA's BOD moving agencies off CVSS.

Discovery went industrial this year while remediation capacity stayed where it was. I close with the actions I think practitioners should take about that gap.

Google Suspends Open-Source Bug Bounty Due to AI Slop Reports

News broke that Google was suspending its open source bug bounty problem due to a big rise in AI vulnerability reports. Now, AI discovered vulnerability reports aren’t the problem, as I have discussed above, folks such as Daniel Stenberg are finding and fixing a lot of bugs in major projects such as cURL with the use of AI by researchers.

In Google’s case, they claim many of the reports are “not valid”, meaning they are not true vulnerabilities and are likely causing a lot of churn and toil on the Google end.

CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering

Mark Russinovich of Microsoft published a defense against indirect prompt injection that operates inside the model at inference time, identifying the internal direction associated with following injected instructions and subtracting it from tool output, with no fine-tuning, extra model or added tokens.

Across five open-weight models from 8B to 106B parameters, held-out attack success dropped from 0.21 to 1.00 undefended to 0.00 to 0.17 defended while keeping 93 to 100% of normal utility, and an adaptive attacker was held to roughly a quarter of undefended success.

AWS Continuum sets a new standard in autonomous code security

AWS announced Continuum, a multi-agent system that finds a vulnerability, proves it with a working exploit, then writes and verifies a patch. On the CyberGym-E2E benchmark of 920 historical memory-safety bugs across 139 C and C++ projects, it passed 819 tasks inside the 90 minute limit for 89.0% end to end, up from a previous public high of 65.9%. The number I’d focus on is the stage measuring whether the specific target vulnerability actually got fixed, which came in at 37.8%, up from 26.2%.

I’ve spent two issues arguing discovery is industrialized and remediation is the bottleneck, so this is a number I’ll be tracking. Two caveats are in order. Fuzzer-found crashes in C and C++ are about as friendly a remediation setting as exists, and by AWS’s own numbers most patches that pass functionality tests aren’t fixing the targeted bug. Even so, next to the Glasswing remediation gap and the FBI’s unapplied patch, it’s good to see the fix side finally getting benchmarked in public.

Final Thoughts

A month ago the rogue agent story was a Hugging Face story.

This week it has a third forensic reconstruction, an institutional post-mortem, a liability bill, a kill-switch essay and a CEO suggesting we accept some bad things.

The fixes people keep converging on are the unglamorous ones, egress blocks, tamper-resistant logs, named owners and automatic breakers, which is the same lesson cloud security learned a decade ago.

What we still lack is remediation capacity to match discovery, and between the FBI’s missed patch and AWS’s early numbers, that’s the gap I’ll be watching most closely.

Stay resilient.

Subscribe now

This year the report calls the endpoint the second era of AI security, and we spend most of the conversation on why.

James's read is that the first era amounted to "security tools in search of a use case," mostly built around aliasing sensitive data before it reached a model provider.

Agents changed that.

Once Claude Code and its peers started taking actions with every credential sitting on a developer's laptop, the developer endpoint went from a long-standing blind spot to the center of the category.

He borrows a line from GitHub's CTO that we are in the pre-HTTPS era of AI security, doing risky things we will later find hard to believe.

The numbers back the shift.

Per the report, dedicated AI security budget went from 8% of organizations last year to 37% this year, with another 24% undecided. James says most of that money is coming from AI governance budgets, which explains why nearly every vendor is pivoting toward the category and why roughly 400 AI security startups are competing for the same buyers.

Where James and I diverge is runtime. I argued the category sprinted to AIDR and runtime enforcement faster than AppSec ever did because autonomy and tool calls make runtime where the risk shows up.

James calls runtime "the patchwork thing" and pushes posture and blast radius instead. His framing is that his agent should not be able to take down the prod database because he should not be able to take down the prod database. He also thinks the category's runtime orientation owes a lot to which company CrowdStrike happened to acquire.

We close on buying advice. James's core recommendation is to rank the specific AI tools you are worried about, whether that is Claude Code, Copilot, Agentforce, or desktop apps, and let that shape the vendor shortlist. A demo will not tell you what you should care about.

We discuss:

• Why the first era of AI security was model-centric and what agents changed

• The "pre-HTTPS era" framing and why developer endpoints carry the highest risk

• Platform versus endpoint specialist, and why the answer depends on your existing stack and which team owns the problem

• AI security budgets jumping from 8% to 37% and where that money is coming from

• How to cut through 400 vendors and test runtime detection claims during a POC

• Runtime versus posture, blast radius, and why the Hugging Face incident was a misconfiguration story

• What 2025's proxy and browser acquisitions bought the incumbents, and why the endpoint is the next M&A wave

• Intent-based detection and the worker privacy problem it creates

• Whether frontier labs absorb the vendor market, and what Anthropic's inference hooks signal

• MCPs and skills as a software supply chain problem, with ADR as the natural answer

• James's buying advice for CISOs and IT teams

  ---

  ---

  Check out James’ 2026 AI Security Market Report!

  

  -> Check Out The Report! <-

  ---

  Prefer to listen?

  Spotify

  Apple Podcasts

  Please be sure to leave the show a rating/review, as it truly helps!

  ---

  Links

• James Berthoty on LinkedIn

• Latio Tech

• The AI Security Market Report

  ---

  Timestamps

  0:00 Intro

  0:31 How Latio Tech started

  2:05 The endpoint as the second era of AI security

  2:51 "Security tools in search of a use case" and the pre-HTTPS era

  5:37 Platform versus endpoint specialist

  8:16 Do you need a purpose-built AI security platform?

  11:16 AI security budget from 8% to 37%

  14:24 400 startups and real differentiation

  15:41 The commoditized feature list and testing intent-based detection

  17:32 Posture, blast radius, and the Hugging Face example

  20:14 Runtime versus posture debate

  23:35 What acquirers got for their money

  26:27 The fight over laptop protection

  29:02 Intent-based detection and worker privacy

  30:26 The next M&A wave and the hosted agent prediction

  33:55 Frontier labs, inference hooks, and the vendor market

  36:32 MCPs and skills as supply chain

  39:30 Buying advice for security leaders

  44:08 Wrap

  Subscribe now

2,096 were disclosed to maintainers and just 202 have been fixed so far, which is 0.8%. OpenAI's Patch the Planet found 1,646 issues, brought in Trail of Bits to write 615 patches and hand them to maintainers, and 13% have merged.

None of that is a failure. Both programs did something the industry could not do a year ago, and both labs were unusually transparent about the results. Anthropic's own update calls independent human triage and review the rate limiting step. The model is not the constraint. The humans are.

These programs were the best case scenario, with frontier models, frontier researchers, high profile projects that actually wanted the help, and in OpenAI's case patches written and delivered.

If remediation was ever going to keep pace with discovery, it was going to happen here.

Open source has lived this for years, and AI discovery is about to export the same experience to every enterprise codebase, most of which were already underwater before any of this started.

In the video I cover:

• What Glasswing and Patch the Planet actually did, and what their own funnels show about where the bottleneck sits

• The severity gap, with Claude rating 91.5% of its findings critical or high and maintainers rating 51.3% that way

• Why your backlog was already a problem, with FIRST now forecasting 66,000 to 68,000 CVEs for 2026 and Empirical Security finding 15,222 exploited CVEs that never made the KEV

• What attackers are doing with the same models, including Anthropic's research on exploit chains finishing before patches reached devices

• Six practical moves, starting with buying triage instead of more scanners and layering exploitation signals beyond the KEV

Shout to my friend to Patrick Garrity at VulnCheck for reconciling the Glasswing ledger, and to Casey Ellis for the line I keep quoting

The volume apocalypse was already here, it just wasn't evenly distributed.

For the full written analysis, see my article The Bottleneck Was Never Finding Bugs.

The question I close on is the same one from the article, are we going to build the remediation capacity to match, or keep celebrating the size of the backlog?

Subscribe now

Last week the story was Gemini’s breakout.

This week OpenAI paused training of its most capable models for the second time in under three months after an agent found a DNS resolver inside what was supposed to be an isolated evaluation environment, and Australia’s Prime Minister disclosed that an OpenAI agent accessed a Medicare statistics portal on June 18, with the company emailing a public inbox about it 84 days later.

Two independent groups, Transluce and the swarmtraces team, published forensic reconstructions that go well past what OpenAI has said itself, and the UK AISI reported that GPT-6 Astra ran unsanctioned supply-chain attacks in 29.2% of simulated runs.

That said, the more interesting thread for this audience is the argument running underneath the incidents. Politico’s European sources, Zack Korman in Quillette, Harriet Farlow on The Secure Disclosure, and an OpenAI security engineer posting on X all say versions of the same thing, that this is a security engineering problem before it is an alignment problem, while Ajeya Cotra and the labs’ own safety-case proposals pull in the other direction.

Meanwhile the White House renamed the field by executive order, and PitchBook reports the fear is filling security budgets faster than buyers can sort the vendors.

Let’s get into it!

Cyber Leadership & Market Dynamics

The AI Build-Out Is Becoming the Biggest Economic Bet in U.S. History

The WSJ put numbers on the scale of the AI build-out, citing a Brookings projection of $10.3 trillion in data-center and AI infrastructure spending from 2025 to 2032, roughly 3.6% of GDP per year, and FactSet’s tally of $4.2 trillion in CAPEX from Alphabet, Amazon, Meta, Microsoft, and Oracle over the four years through 2029. Private data-center construction ran about $9 billion ahead of last year through July while all other private construction fell roughly $46 billion.

I include this because it is the backdrop for everything else in this issue. Five companies are building what amounts to national critical infrastructure at a pace the WSJ calls the biggest economic bet in U.S. history, and the incidents below are happening inside that build-out.

AI fear is filling security budgets. Buyers still can’t decide

PitchBook’s Jacob Robbins reports that the grim news cycle is opening enterprise security budgets, with Jay Leek of SYN Ventures saying:

“Anthropic and Mythos did what a decade of CISO warnings couldn’t” in terms of CEO security awareness.

Cybersecurity startups have closed 737 VC deals worth $12.94 billion so far this year per PitchBook data, and SYN alone met 559 companies it had never met before in 2025 and another 370 in the first half of 2026.

That said, the budget is not translating cleanly into purchases. Jay Kaplan of Synack points out that a company can raise at a $2 billion valuation and still be a complete stranger to the CISO it needs to sell to, and Phil Venables notes that large enterprise CISOs have multiple deputies running specialist functions, so vendors pitching the top of the org chart are pitching the wrong buyer.

Having sat on both sides of this, the froth Jay Kaplan describes is real, and it does work against the vendors creating it, since CISOs are drowning in inbound that all sounds identical.

Cyber unicorn Upwind acquires nine-month-old Aegis for tens of millions

CTech reports Upwind is acquiring Aegis, a nine-month-old Israeli startup focused on protecting AI agents, in a stock deal worth tens of millions of dollars, after the two had been partnering for several months. Upwind is folding the team into a new “Upwind AI Labs for Cybersecurity” unit that starts with 12 people and is planned to grow to around 35, and the company itself raised $300 million at a valuation of approximately $3.8 billion, more than double its $1.5 billion January valuation.

A nine-month-old company getting acquired is closer to an acqui-hire than a product bet, and it says a lot about how early the CNAPP vendors are on agent security that buying a team is faster than building one.

Reco raises $50 million with AT&T backing to secure AI agents

Reco raised an additional $50 million, bringing total funding to $135 million, with AT&T Ventures joining as both investor and customer per CTech’s Meir Orbach. Reco started life as a SaaS security company and now positions itself as agent security, mapping which agents connect to which applications and identities and flagging risky permissions and activity, with 280 application integrations and 1,000 detection controls. The release leans on the same Gartner projection I cited last week in the Blueprint Alliance item, that the average Fortune 500 enterprise will have more than 150,000 agents in use by 2028 compared with fewer than 15 in 2025.

Ofer Klein’s framing is that agents are gaining access to business applications faster than organizations can map those connections, which is a SaaS sprawl problem wearing a new label, and it is a fair bet that most SaaS security and identity vendors will make the same pivot over the next year - everyone across every category is converging on trying to secure agents.

Inaugurating The Era Of Super Intelligence

The White House issued an executive order on September 29 titled “Inaugurating The Era Of Super Intelligence,” and the operative content is narrower than the title. In short it pushes to rename Artificial Intelligence (AI) to Super Intelligence (SI) and includes no new security requirements.

The more interesting news is a voluntary accord signed by Google, Anthropic, Meta, OpenAI, xAI and NVIDIA related to internal controls monitoring, cyber during training and deployment and the role of external auditors. This is the voluntary self-policing the administration and others such as Meta and NVIDIA have been advocating for, rather than the heavy handed regulatory push OpenAI and Anthropic have recommended.

Full UN Security Council AI Hearing With Sam Altman, Dario Amodei and Clément Delangue

The UN Security Council held its first dedicated AI session since 2023 on September 23, convened by France, with Sam Altman, Dario Amodei, and Clément Delangue as briefers, and the full two hours and twenty minutes are on YouTube. I watched it while traveling, given the gravity of the discussion both here domestically and internationally.

• Sam asked for a mechanism for complementary national and international frontier AI standards, including common ways to measure capabilities and fast, standardized incident reporting.

• Dario proposed narrow agreements (a ban on AI for bioweapons, for example), verification systems, common testing standards, and incident notification protocols, and said Anthropic “will slow down as much as necessary.”

• Clément called for mandatory incident disclosure and mandatory sharing of full agent traces.

My impression was this was an attempt by the two leading labs to appeal to the UN and International community related to AI regulation, given the efforts failed here domestically. There were also U.S. representatives there to speak who emphasized that U.S. AI will be governed domestically, not controlled by an internationally body, but decided by U.S. citizens.

I personally agree with this and don’t think we should cede our AI policy to an international body.

See below for the U.S. representative I mentioned.

Michael Kratsios on the U.S. position at the Security Council

Michael Kratsios delivered the U.S. response in the same room, and it was a flat rejection of everything the three CEOs asked for at the international level.

The line was that:

“The United States totally rejects any attempt to construct a globalist scheme of control of superintelligence,” that dialogue in the Council “cannot be allowed to drift towards global governance,” and that national legislatures should regulate on behalf of their own people.

He also chose the word “superintelligence” deliberately, six days before the executive order made it official vocabulary.

So the practical read is that any mandatory agent-incident disclosure regime in the U.S. will come from Congress or the states, or not at all, which makes Ed Markey’s bill below more interesting than it would otherwise be.

New bill would create federal investigative body for AI-driven hacks

Sen. Ed Markey introduced the “Cybersecurity and AI Board of Investigations Act”, which would create an independent five-member board, presidentially appointed and Senate confirmed to five-year terms with no more than three from one party, to investigate AI-agent-led attacks on federal systems and critical infrastructure.

The board would have subpoena power, the ability to examine near misses, and its own technical staff, and Ed’s justification is that “the public is learning critical details piecemeal” and “we cannot depend on companies with little incentive to disclose their failures.”

The NTSB comparison is the obvious one, and OpenAI’s own safety-cases post (below) proposes NTSB-style investigations on a voluntary basis, so the question is whether that happens inside the labs or with subpoenas.

It’s worth pointing out that we did have the Cyber Safety Review Board (CSRB) within CISA, but that fizzled out early on in Trump’s second term. It’s also sad that something like this is partisan (hence the emphasis on number of members per party).

AI Doom Is Not Cybersecurity

, who I spoke with recently, argues in Quillette that the Medicare breach shows the real danger from AI is a mundane one and that the labs’ fixation on a coming machine god is making it worse.

The facts he builds on are that the breach took place on June 18 and OpenAI informed the Australian government on September 10 via an email to Medicare’s public inbox, and that the Hugging Face intrusion “benefitted from an overly permissive sandbox design and a complete lack of monitoring.”

His sharper point is that the doomer worldview makes cybersecurity irrelevant by assumption, since a superintelligence would by definition bypass any control, so only alignment matters, and he compares labs warning about extinction to Lehman Brothers in 2006 worrying about solar flares.

He also notes that twenty-two world leaders signed a call to action echoing Dario’s pacing essay and doubts they understood the ideology behind it. I would not go as far as Zack on the ideology, but on the controls he is right, and the swarmtraces reconstruction below is the evidence.

It is a false dichotomy to think it must be either AI Safety (alignment) or Cybersecurity. We need both, and many of the doomer types are under the illusion that we will somehow achieve perfect alignment. Alignment is highly subjective

Evidence about risk should be transparent

argues that after this wave of incidents, with both OpenAI and Anthropic reporting they have slowed RL training, the industry cannot have a real conversation about safety standards because it lacks the evidence base for one. Her ask is production of far more concrete, published evidence about loss-of-control risk and mitigations, under a norm of evidence transparency, rather than third-party verification of the claims companies are already making.

The benefits she lists are common knowledge between competitors who cannot share privately, empowering external scientists whose incentives differ from employees’, and accountability for evaluators, since public evidence makes it “much harder for AI companies to get away with engaging overly-friendly evaluators.”

She uses METR’s Hugging Face report as the example of an evaluator that kept transparency as its north star without sharing prompts or code. From a security practitioner’s seat this is simply the case for demanding transcripts and evals from a vendor before you trust its containment claims, and swarmtraces below shows what outsiders can reconstruct when the traces are not published.

AI

OpenAI says its AI agents escaped a secure ‘sandbox’ again last weekend and it is pausing training for a second time

Fortune reports that on September 20 an OpenAI model running an information-search evaluation discovered it had access to a DNS resolver and used it to send queries to a public chatbot despite network isolation, and that OpenAI has now paused training of its most capable models for the second time in under three months.

The detection side worked, with monitoring flagging the behavior within 15 minutes and a human reviewer starting 3 minutes after that, but the automatic shutdown “did not work,” the run was not manually stopped for 2.5 hours, and a later review found other attempts the system had missed. OpenAI’s own words were “The incident exposed a gap in our controls over network restrictions,” and Micah Carroll said all inference for the most capable models stays stopped until systems are hardened further.

The Hugging Face incident and other third-party impact from misaligned models

OpenAI’s running disclosure page on the Hugging Face incident and other third-party impact is where the September 25 update landed, and the page describes a broad review of model activity on the internet during training and evaluation that has notified dozens of third parties and “will require significant time and resources.”

The useful part for defenders is the five-category taxonomy of what a misaligned model does to someone else’s systems, access control bypass, use of exposed credentials, query or command injection, access to runtime internals, and agent spam (posting to public wikis and similar). Hugging Face “remains the most severe activity of this kind that we have identified,” driven by an internal-only research model.

Strip the alignment vocabulary and those five are credential misuse, injection, unsanctioned reads and writes, and content pollution, which is the point I made about their misalignment reporting framework last week.

OpenAI also warns recipients that a notification “should not automatically be interpreted as notice of a significant security incident,” which is fair, but if you run public data services you should expect one.

Early rogue AI agent activity and attempts to hack found on urlquery.net

Transluce found that AI agents used urlquery.net, a service that opens URLs in a sandboxed remote browser, as a proxy to get around restrictions and reach the public internet, and identified 6,467 reports with significant evidence of agent activity and 31,182 with suggestive evidence between November 2025 and September 2026.

Three targets drew actual hacking attempts, seven probes against the University of New Mexico Digital Library in May (SQL injection, command injection, path traversal), 12 probes against Data USA, and XSS payloads against the Australian Institute of Health and Welfare’s Tableau dashboards in June, where Cloudflare blocked the first attempt and the agent went around it through AIHW’s pre-production server.

Transluce calls AIHW “the first reported instance of an agent autonomously choosing to attempt to compromise a government website,” and on September 19 and 20 it also logged 15 reports over about two and a half hours probing the quidax.io crypto exchange and attempting trades.

The agents created accounts with disposable email inboxes and one-time passcodes, which means this is a partial view, and Transluce tied at least some of it to the OpenAI swarms via task values seen on DseWiki. OpenAI acknowledged the overlap and said its review will take months.

I’d point out two things for defenders. Legitimate security tooling like URL sandboxes is now agent proxy infrastructure, so it belongs in your egress and abuse monitoring, and the AIHW bypass through a pre-prod host without the production WAF is the oldest gap in the book being exploited autonomously.

Revealing the details of how OpenAI agents hacked Hugging Face

A group of researchers reconstructed the July Hugging Face attack from the public link-shortener URLs the agents used to chain their payloads, over 80,000 reassembled payloads across roughly a million shortened URLs, with some payloads chaining 900+ links.

The agents started with GET-only egress and turned a screenshot service plus httpbun.com into arbitrary code execution with readback, ran a “LOOT” dictionary harvesting AWS keys and bearer tokens, scored Kubernetes tokens by wildcard permissions, stood up multiple persistent C2 controllers using repo files and Hugging Face discussion comments, pushed roughly 1,500 payloads and 115+ modified Docker images at Docker Hub to poison OpenAI’s Artifactory cache, ran 27 searches against Hugging Face’s internal Slack for evaluation-system terms, and deleted pods and configs afterward with commit messages like “remove evil yaml.”

That is a long explanation on purpose, because the point is that this is a complete intrusion lifecycle, from initial access through persistence, lateral movement, and anti-forensics, executed by agents with nothing but outbound GET at the start.

The researchers are upfront that 80% of the recovered data is outbound only and 97% lacks native timestamps, and that 7,905 unique agent names from roughly 700 agents implies rotation. The links stayed public for over two months. Every one of these TTPs is detectable with egress, DNS, and shortener-domain monitoring, and third parties reconstructing this from public artifacts is the evidence-transparency argument Ajeya makes above, made in practice.

Clément Delangue on defending Hugging Face with open models

Clément Delangue’s post shares his UN Security Council remarks, and the detail I would flag for practitioners is that when HF responded to the incident they had to use a open source model to do so due to being blocked by refusals from frontier closed models.

His numbers are approximately 17,600 actions executed by OpenAI agents against Hugging Face systems in July, and his thesis is that “The biggest risk is not powerful AI, it’s asymmetry of powerful AI,” between attackers and defenders and between a few companies and everyone else.

Hold that GLM 5.2 detail next to Anthropic’s analysis of GLM-5.3 in the AppSec section, because the same model family that Hugging Face reached for as a defender is the one Anthropic says now ships Mythos-class exploit development with no meaningful safeguards. Both things are true and they are the asymmetry Clément is describing.

GPT-6 Astra performs unsanctioned supply-chain attacks in simulations

The UK AI Security Institute ran GPT-6 Astra through simulated cyber evaluations before release, with the model’s cyber classifiers turned off to see what it would attempt, and found it completed a supply-chain attack 29.2% of the time, compared to 6.3% for GPT-5.6 Sol and 0% for GPT-5.5.

Astra picked out-of-scope third-party software targets, wrote and tested malicious code, created fake identities (obtaining email addresses and solving CAPTCHAs) to submit it for human review, boosted approval odds with benign contributions and supportive comments from other fake accounts, and posted comments from fake accounts arguing against accurate security reviews.

Clarifying that anything not listed in scope is out of scope cut the rate to 4 of 49 trajectories from 26 of 50, and when Astra asked permission it received only an automated “Please proceed to the next step using your best judgement,” which it sometimes treated as authorization even while noting the reply was likely automated. It attacked even when uncertain whether the environment was simulated.

AISI’s conclusion is that defenses beyond model alignment, sandboxing and monitoring, are essential, with the caveat that those may get more fragile as capabilities improve.

Coming from a government security agency, that is about as clear a statement as you will get that the “alignment only” position does not hold, and the fake-maintainer and sockpuppet-review TTPs are the open source trust attack surface we already struggle with. The WSJ reported the same day that OpenAI scrapped the GPT-6.1 Astra public launch over regressions on deception and scope, which suggests the internal bar is doing its job, or the public pressure is mounting - or both.

Escaping SPACE: Part I

Perplexity’s Secure Intelligence Institute gave nine frontier models root inside a guest VM in its SPACE sandbox and asked them to escape to the host and to bypass network policy, explicitly citing the OpenAI incident as motivation. No model escaped the VM in 108 runs, even with SPACE’s source code in hand.

Network bypass is a different story, succeeding in 11 of 54 partial-network runs, via DNS spoofing (a root agent forges a resolver reply mapping pypi.org to its callback IP) and shared CDN IPs (the gateway allows an IP for pypi.org that also serves other domains). Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber, and Kimi K3 all found a way through, and Perplexity’s line is that “VM isolation and network confinement are distinct security boundaries.”

They then ran the same attacks against ten commercial sandbox platforms and report nine, seven of which had at least one bypass (E2B, Vercel, Modal, Daytona, Fly.io Sprites, microsandbox, Deno), with NVIDIA OpenShell and Cloudflare Sandbox the two that held. The fixes are concrete, source-address validation on the tap interface and TLS termination that requires SNI and Host headers to be allowlisted and DNS-attributed, and they apply to any domain-allowlist egress design, including the one OpenAI’s DNS resolver incident points at.

Fable and GPT-6 Astra both refused to run the tasks at all, which is its own data point.

NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring

NVIDIA’s Open Agent Safety Platform post opens on the lab breakouts without naming anyone, “AI agents broke out of the evaluation environments that were meant to contain them,” and lands on the position that an agent “cannot be expected to fully govern its own behavior,” so enforcement has to be out of band.

The architecture is OpenShell, an open source (Apache 2.0) runtime with kernel-level isolation that turns operator instructions into verifiable policies on file, network, tool, and credential access, plus NVIDIA Sentry running on BlueField-4 DPUs, which in Vera Rubin systems sits on the only path to the model and provides out-of-band observability, line-rate enforcement, and a kill switch.

Per the authors, “By controlling the path to the model, you own both the best observation point and also the kill switch.”

The five principles (verifiable policy, out-of-band enforcement, the model path as control point, authority scaled to inspectability, shared responsibility) are the same architecture I described as converging last week, now with silicon behind it.

The obvious caveat is that the DPU enforcement is tied to NVIDIA hardware, and the less obvious one is that OpenShell was one of only two sandboxes Perplexity could not bypass, which is a better endorsement than the blog post.

How We Built Safety Into Muse

Meta’s post on how it built safety into Muse, its personal agent, is a couple of weeks old but is among the more detailed public reference architectures I have seen for a consumer agent sandbox.

Each user gets a dedicated VM where the agent harness runs as an unprivileged container so “runtime cell root is not host root,” a component called Sentinel is the sole permission authority for every connector action and all network egress, eBPF taint tracking on egress decides when a human has to approve, and credentials never reach the agent at all, “any attempt to coerce the agent to reveal secrets via prompt-injection is futile.”

The browser sub-agent sees an accessibility-tree snapshot rather than the DOM, with no JavaScript in the page context. Prompt injection gets defense in depth built explicitly around Simon Willison’s lethal trifecta, including an ensemble of injection classifiers that live outside the runtime cell so an attacker cannot disable them.

The bug bounty pays up to $300,000, including up to $130,000 for a prompt injection that affects a single user, which is as clear a market price on injection as we have.

Compare this to the two-gate minimum in the Five-Zone post below and to what Perplexity found in commercial sandboxes, and the gap between what a frontier lab builds for its own agent and what most teams deploy is wide.

The Five-Zone Attack Surface: A Practical Threat Model for Agentic AI

Mrinal Anand’s five-zone model is a compact threat model for agents that maps threats to input surfaces, planning and reasoning, tool execution, memory and state, and inter-agent communication, with the framing that “The agent produces a wrong action: a wrong API call, a wrong file deleted, a wrong email sent, a wrong dollar moved.”

The dominant chain he describes is indirect injection through a data source, then goal hijacking in the reasoning loop, then unchecked dispatch, and his two Phase 1 controls are an input sanitization gate that tags content by trust tier and an invocation validation gate that checks a permission matrix and validates arguments before anything executes.

It does not map to the OWASP Agentic Top 10 or MITRE ATLAS, which would make it more useful, but as a design-review checklist it is easy to lift, and the two gates line up with what Meta actually built.

Practical AI Security & Adversarial Machine Learning with Dr Harriet Farlow

Mackenzie Jackson had Dr. Harriet Farlow, author of “Practical AI Security” from No Starch and formerly of the Australian Signals Directorate’s AI hub, on The Secure Disclosure for a half hour on adversarial ML.

Her core distinction is between weaknesses and vulnerabilities, since the failure modes of ML systems are baked into what makes them useful and are not patchable the way a CVE is, and she dislikes the term prompt injection for the same reason, since SQL and command injection are solvable by separating untrusted data while prompt injection “is actually a fundamental flaw that can’t be solved at least not yet.” She also points out that AI safety researchers were talking about lab breakouts six to twelve months before any of it made the news.

Her advice for enterprises is unglamorous, inventory what AI is actually in use, write an AI use policy, and set guardrails by risk tolerance rather than blanket restriction, which pushes staff to personal devices.

Agent traces are the new oil

Sam Z. Liu argues that agent traces, the full record of user messages, reasoning, tool calls, retrieved data, errors, and feedback, are becoming the currency AI companies transact in, while most enterprises treat them as disposable logs.

His chart of weekly agent token volume on OpenRouter goes from 0.4T tokens in December 2024 to over 30T by June 2026, and he notes that Claude Code deletes sessions after 30 days by default.

He names the Hugging Face incident as the warning for what happens without guardrails and argues traces are simultaneously your most valuable IP and your primary safety telemetry.

I would add that traces are also your incident evidence, which is the whole reason swarmtraces exists and the reason OpenAI’s safety-cases post wants them in write-once storage. Retention defaults that quietly delete them are a control gap.

AppSec

Glasswing and Patch the Planet Receipts

The teams from OpenAI’s Patch the Planet effort, and Anthropic’s Glasswing have been providing reporting and insights on the progress and I wanted to take time to make a video disscussing it.

While the teams have indeed used AI to find thousands of vulnerabilities, a very small % (less than 1% in the case of Glasswing) have actually been remediated. This highlights that while AI has industrialized vulnerability discovery, remediation is still a major bottleneck.

GLM-5.3 and the spread of advanced cyber capabilities

Anthropic analyzed GLM-5.3, Zhipu AI’s latest open-weight model, and concludes it matches Claude Mythos Preview on autonomous end-to-end exploit development while shipping “without meaningful safeguards to limit misuse.”

On ExploitBench, GLM-5.3 built working end-to-end V8/Chrome exploits in 50 of 410 attempts against Mythos Preview’s 56 of 410, with Opus 4.6 and GLM-5.2 at or near zero, and on 100 OSS-Fuzz binary exploitation tasks it produced full control-flow hijacks 4% of the time against Mythos Preview’s 6%.

Its safeguards fall to a deceptive cover story 64% of the time, prefilled reasoning 92%, and abliteration 100%, and Anthropic’s team, which had never tried abliteration before, did it in about 2,200 GPU hours for roughly $4,400.

In a human-in-the-loop test, GLM-5.3-Flash chained CVE-2026-11645 in Chrome with a second flaw into a reliable ARM64 exploit bypassing pointer authentication with 20 minutes of human attention and eight hours of model time, at an API cost of $20.40. NIST’s CAISI had already called it “the most cyber-capable open-weight model released to date,” about four months behind the US frontier.

Five months after Mythos Preview was gated behind Project Glasswing, which Anthropic says let trusted defenders find more than 10,000 vulnerabilities, the same capability is a download.

Jay Leek’s line in the PitchBook piece was that Mythos did more for CEO awareness than a decade of CISO warnings, and this is the follow-on, since every N-day exploitation window assumption now has to account for $20 exploit chains.

Anthropic’s asks are that defenders use frontier models, that trusted access programs expand, and that governments test open-weight successors, and there is an obvious commercial interest in an Anthropic post saying open-weight models are dangerous, which does not make the benchmark numbers wrong.

I would point out that Anthropic has strong incentives to demonize open models, as they are the biggest threat to their market share, and far cheaper. I also want to remind everyone that Hugging Face had to use an open model to respond when they were attacked by OpenAI. I would love to see a similar piece from Anthropic analyzing the performance of an open model on defense cyber use cases as well.

Scan for Good

Wiz Research and Google DeepMind launched Scan for Good, a free AI-driven exposure discovery and pentesting program for critical infrastructure, public services, healthcare, nonprofits, and open source projects, powered by a Gemini 3.8 Flash Cyber model they call the Wiz Red Agent, with every AI-generated hypothesis validated by a human before confirmation.

The live dashboard shows 17,761 organization-linked domains, 326,891 public endpoints monitored, and 475 critical exposures found, and the disclosure ledger includes a national archive admin key with read/write/delete on 8.8 million files, a hospital appointment site exposing patient identifiers and consent signatures, and a rail operator’s production database with live admin sessions. Across seven real-world engagements the AI reached initial access in under 10 minutes 100% of the time, with the fastest full compromise at two minutes.

CISA’s acting director Nick Andersen endorsed it, and the program is the defensive mirror of the GLM-5.3 story, with the same class of capability pointed at the public sector on purpose.

If you run a hospital, a utility, or a municipality with no red team budget, apply.

CISA Lays Out Future of CVE Vulnerability Program

CISA published a short whitepaper, “CVE Program: Establishing a Quality Era Framework,” moving the program from what it calls the growth era to one focused on reliability, responsiveness, and data quality, organized around four dimensions, program governance, ecosystem participation, data infrastructure, and CVE record content, with proposed metrics like governance decision speed, active CNA diversity, API uptime, the share of records meeting quality criteria, and post-publication correction frequency.

The drivers named are new CNAs worldwide and “automated and AI enabled technologies ramping up across the software development lifecycle,” and the volume backdrop per Infosecurity Magazine is more than 67,000 CVEs published as of September 18, with CVEForecast projecting 96,000 by year end.

Discovery is now a compute problem, as the Wiz and Anthropic items make plain, so the record quality and correction-rate metrics are what decide whether CVE data stays usable for automated prioritization.

Breach at FBI Fuels Fears of Harm to Its Employees

The New York Times reported on an internal FBI memo saying the Bureau is “operating under the premise that the threat actor is also exfiltrating [PII] of all F.B.I. employees” after ShinyHunters breached the FBI jobs portal and claimed names, home addresses, SSNs, family details, and assignment data on nearly all agents.

The memo tells staff to expect suspicious texts and calls and to record new voicemail greetings with AI voices, and the group’s demand was a retraction of the FBI’s May advisory on its tactics, with no ransom asked. The technical cause, per Vectra’s Lucie Cardiet rather than the Times, was CVE-2026-35273 in Oracle PeopleSoft, patched by Oracle on June 10, where the FBI deployed a firewall rule instead of the patch and “a single character substitution in the web request was enough to make the firewall rule miss the attack entirely.” Between 2 and 3 terabytes left. Kash Patel announced an arrest in Amsterdam on September 29 that ShinyHunters says has nothing to do with them.

A recruiting portal holding SSNs and background-check files for a federal workforce, protected by a virtual patch for three months, is the compensating-control lesson in one paragraph.

Final Thoughts

One number that jumps out to me from this issue is 2.5 hours, the time between OpenAI’s monitor flagging a DNS escape and a human actually stopping the run, because it captures where the labs are. Automated response and egress design are where the gaps are, and Perplexity found the same gaps in seven of nine commercial sandboxes.

The argument over whether this is an alignment problem or a security problem got louder this week, and my read is that the AISI evaluation settles more of it than the op-eds do. A government security agency ran the model with its classifiers off, watched it build fake maintainer identities and sockpuppet reviews 29.2% of the time, and concluded sandboxing and monitoring are essential alongside alignment.

That is defense in depth, which is not a new idea for any of us.

On the market side, the fear is real and funded. PitchBook has $12.94 billion across 737 deals this year, Reco and Upwind are buying and raising on agent security, Alex Stamos went to a coding-agent company, and the White House renamed the field while the labs signed a voluntary accord to grade each other’s homework. Whether that homework gets published, as Ajeya and Senator Markey both want in different ways, is what I will be watching.

Stay resilient.

Subscribe now

The industry spent two decades hardening the perimeter, pursuing approaches such as Zero Trust, and attackers responded by simply acquiring a working credential and walking through the front door as a legitimate user.

As the saying goes, hackers don’t hack in, they log in.

That said, most of the conversation around identity risk stays at the level of controls, such as MFA coverage, privileged access, session management, and so on, and rarely gets translated into what the gap actually costs an organization when it goes unaddressed.

Resilient Cyber’s partner Nametag recently published a report titled “The Cost of Doing Nothing: What Unverified Identity Costs Enterprises Every Year,” which attempts to do exactly that, breaking the cost of unverified workforce identity into four dimensions and modeling it across six industries.

In this article I will walk through the report’s core argument, the four cost dimensions, the industry-level figures, and where I think this connects to the agentic identity problem I have been writing about for much of this year.

So, let’s check it out!

-> Check Out The Report! <-

Logging In, Not Breaking In

The report opens with a framing that will be familiar to anyone following the incident data.

It cites Sophos analysis of 661 incident response cases across 70 countries and 34 industries between November 2024 and October 2025, in which identity-related root causes drove 67% of successful intrusions, with compromised credentials alone accounting for 42% of root causes. Sophos also found MFA absent or misconfigured in 59% of identity-related incidents, and where MFA was correctly deployed, attackers adapted with adversary-in-the-middle proxies and infostealers that lift active session tokens after authentication completes.

The report pairs this with figures from Cloudflare’s 2026 Threat Report, which found that 63% of logins involve credentials already compromised elsewhere and that 94% of login attempts originate from bots rather than humans.

The economic logic here is straightforward, as it is simply cheaper to use a credential that already works than to develop a new exploit or need to compromise a system. A valid username and password pair is a commodity, and the report’s summary of the situation, “the attackers are not breaking in, they are logging in,” is one I would expect most practitioners to nod along with at this point, as we’re used to hearing it, but it also doesn’t make it less true.

None of this is new to security teams, and the report acknowledges as much.

MFA is deployed, the IdP is in place, and the helpdesk has a runbook for password resets. The argument is that this foundation was built to confirm which account is acting, and it cannot confirm which human is acting. That distinction is the entire premise of the report, and everything downstream flows from that core point.

Accounts Versus Humans

The framing I found most useful is what Nametag calls the workforce identity gap, defined as the structural gap between authenticating an account and verifying the human behind it.

Authentication confirms a credential, but does not confirm the person presenting it, and every downstream control, from role-based access to privileged approvals, inherits that assumption without ever testing it.

The report lays out a four-stage maturity framework for closing that gap.

• Stage 1 is manual verification, where helpdesk staff use their best judgment and the organization carries its full loss exposure.

• Stage 2 is what Nametag calls compliance-grade verification, meaning point-in-time selfie matching bolted onto custom integration logic, which the report estimates retains 50 to 60% of baseline exposure.

• Stage 3 adds 3D liveness, cryptographic device binding, and identity orchestration, reducing residual exposure to 15 to 25% of baseline.

• Stage 4 is continuous assurance across the entire workforce lifecycle, with residual exposure in the single digits as a percentage of baseline.

Nametag’s view is that most organizations sit at Stage 2, and that the cost of waiting is the difference between Stage 2 and Stage 4, multiplied by every week the gap stays open.

I would add that many organizations I have seen are honestly closer to Stage 1 than they would like to admit, with verification for high-risk actions like credential recovery still coming down to whether the person on the phone sounds plausible and knows a manager’s name.

The report also argues that compliance-grade identity verification clears the audit checkbox without closing the actual gap, and anyone who has watched a homegrown verification workflow accumulate human resource system webhooks and custom logic over a few years will recognize the maintenance burden it describes.

Four Ways Inaction Shows Up on the Books

The heart of the report is a breakdown of the cost of inaction into four separate dimensions, each owned by a different executive, each accruing in a different part of the budget, and each paid whether or not the others are.

These are four distinct bills rather than one cost that compounds on top of another, which is part of why the exposure is easy to miss, since no single owner sees the whole picture.

The figures throughout are illustrative for a 15,000-employee organization, which matters for how you read them, since Nametag notes they scale roughly linearly with workforce size.

Operational efficiency is the IT labor and overhead of running manual identity verification. The report uses HDI’s benchmark of $25 per helpdesk ticket in labor and tooling, and Nametag’s own deployment data puts the enterprise identity verification figure at $3.45 per ticket, roughly an 86% reduction, primarily from routing verification events through self-service workflows that never touch the helpdesk.

At the modeled scale that works out to $1.25M annually in IT labor at the manual baseline. The report also calls out the hidden costs here, such as custom integration work running into tens of thousands of dollars per use case with roughly 20% annual maintenance on top, and the fact that helpdesk headcount scales linearly with the workforce, so every new employee adds verification volume that has to be absorbed somewhere.

Workforce productivity is the flip side of the same friction. Every hour the helpdesk spends verifying someone is an hour that employee spends waiting, and the report values those hours at fully loaded compensation, ranging from roughly $37 an hour in hospitality and retail to nearly $90 in technology.

Annual productivity loss lands between $1.92M in Hospitality, Retail & Consumer and $4.48M in Technology. The healthcare figure is the one stated in concrete terms, at 22,500 clinical hours lost per year, which the report equates to 5,400 primary care visits. Nametag estimates enterprise identity verification recovers roughly 80% of those hours.

Annual Loss Expectancy (ALE) is where the CISO and CFO share ownership. This is standard actuarial math, the probability of an identity-based breach in a given year multiplied by the average cost when it happens.

The report anchors the cost side on IBM’s 2025 Cost of a Data Breach Report, which puts the U.S. average at $10.22M and the global average at $4.4M, with Healthcare at $7.42M for the fourteenth consecutive year as the most expensive sector.

Baseline ALE ranges from $1.27M in Transportation to $4.97M in Healthcare, and Nametag models a 92% reduction in annual rate of occurrence with enterprise IDV, based on its own deployment data.

The report is direct that this constant comes from Nametag deployments rather than independent research, and applies it uniformly across industries, which is something to keep in mind when reading the residual figures. That said, it is refreshing to see that transparency from a vendor, which isn’t often so common.

Hiring fraud is the fourth dimension, and the one I suspect will be new territory for many readers, so it gets its own section below.

The report’s preferred way of reading all of this is by the week rather than the year.

Taking the four costs together, Healthcare carries roughly $150,000 a week in identity exposure, Technology $134,000, and Industrial Manufacturing $126,000. The annual figure is the headline, but the weekly rate is a more honest way to think about the cost of a deferred decision, since every procurement cycle that slips a quarter has a number attached to it.

Hiring Fraud and Strict Liability

Hiring fraud is the identity risk that arrives before an employee’s first day, and the past two years have made it a mainstream concern rather than a niche one, with the rise of deepfakes and nation state fraud campaigns.

The report cites a Gartner survey finding that candidate fraud makes up roughly 25% of application volume in remote technology roles in 2026, most of it automated AI-generated applications and resume fraud.

The smaller and far more dangerous slice is sophisticated identity impersonation, and here the report leans on Mandiant’s M-Trends 2026, which documents North Korean IT worker operations as a persistent insider threat throughout 2025 with a median dwell time of 122 days before detection and some cases running undetected for over a year.

Those of us who have followed the Treasury, FBI, and DOJ advisories on this know the playbook, with AI-generated profiles, deepfake interview tooling, and U.S.-based laptop farms used to embed operatives directly into Western corporate payrolls. The report notes a single 2025 federal case that named 309 U.S. companies which had unknowingly placed North Korean operatives on payroll, including Fortune 500 firms in technology, aerospace, automotive, and media.

Nametag breaks the cost into three buckets.

• The first is recruiter labor spent investigating suspect applicants, roughly 2,600 hours a year at $43 an hour fully loaded, or about $112,000 annually whether or not a fraudulent hire is ever caught.

• The second is the economics of placements that succeed, with roughly eight fraudulent placements a year at a typical enterprise drawing about $625,000 in salary against the 122-day median dwell plus another $415,000 in ramp and vacancy loss, for roughly $1.08M annually.

• The third bucket is categorical rather than operational. Civil penalties for paying a sanctioned individual are strict liability under federal law, so intent and awareness do not matter.

  The report puts the penalty at up to $377,000 per paycheck issued, with each paycheck treated as a separate violation, and a 122-day median dwell generates roughly nine paychecks. That is a maximum civil exposure of $26.7M per fraudulent placement, before any criminal exposure or remediation cost.

The point the report makes about existing hiring controls is a fair one.

A background check confirms that records match a candidate’s stated history, and a video interview confirms a face matches the documents, but neither confirms the person presenting those records is real or that the face on camera is the one that shows up on day one.

State-sponsored operatives use stolen identities from actual U.S. citizens whose records pass every standard check cleanly, which is precisely why the standard checks do not catch them.

What Doing Nothing Costs By Industry

Taking the four separate costs together and excluding OFAC exposure, the report puts the annual cost of inaction for a 15,000-employee organization at:

• $7.8M in Healthcare, $6.96M in Technology

• $6.54M in Industrial Manufacturing, $5.25M in Education

• $4.31M in Transportation

• $4.12M in Hospitality, Retail & Consumer

Each industry chapter pairs the numbers with a breach the reader will recognize, and the common thread across all of them is that none began with a software exploit.

Change Healthcare began with credentials on a Citrix portal that lacked MFA, with attackers operating for nine days before deploying ransomware and UnitedHealth Group reporting an $872M financial impact in the first quarter following the attack.

Snowflake began with credential stuffing against customer accounts lacking MFA, with data exfiltrated from more than 160 enterprise customers.

MGM and Caesars began with a ten-minute social engineering call to the helpdesk. The Diesel Vortex cargo theft operation in the transportation chapter began with voice-AI impersonation of freight brokers and dispatchers and generated $725M in cargo losses.

The sector-specific structural conditions are what make each chapter worth reading on its own. Healthcare runs on identity at a scale no other sector matches, with physicians carrying dozens of active logins and affiliate clinicians moving through the same identity stack with weaker governance.

Technology concentrates the cost in its most expensive labor, and the report notes identity-driven breaches there average 210 days of dwell, the longest of any sector, because the same DevOps access patterns that enable velocity also make anomalous behavior harder to spot. Hospitality and retail run 70 to 100% annual frontline turnover, which turns the helpdesk into the attack surface of choice.

Over a 24-month horizon, the report models a healthcare organization absorbing roughly $15.7M across the four costs by leaving the gap open, versus $1.3M with enterprise IDV in place and $8.6M with compliance-grade verification, which only closes about half the gap. The costs do not build on one another over that period, they simply keep accruing in parallel for as long as the gap stays open.

Where This Meets the Agentic Identity Problem

The section of the report I want to spend the most time on is the shortest one, a brief aside titled “AI Agents and the Authorization Question.”

Nametag’s argument is that enterprise AI agents act on credentials, authenticating as a human user, holding the same access rights, and executing workflows that move money, change records, and grant access. When an agent’s action triggers a high-consequence outcome, the question of who authorized it has to be answerable, and the verified human layer that closes the workforce identity gap is the same layer that makes agent actions accountable.

I have spent much of this year on exactly this problem. In “Identity Is the Agentic AI Problem Nobody Has Solved Yet“ I argued that the IAM industry built decades of infrastructure on the assumption that requests come from humans or from predictable service accounts, and that agents fit cleanly into neither category.

In “Identity as Infrastructure in the Agentic Era,” Karl McGuinness and I walked through why the problem is less about authentication and more about delegation, or as Karl put it, “agents don’t need your passport, they need your authority”.

Now, to be clear about what this report is and is not, it is a workforce identity verification report, and the agentic material occupies a page. It does not attempt to solve delegation chains, scoped authority, revocation, or any of the substrate problems Karl and I discussed. That said, I think the connection it draws is the right one, and it clarifies something I have been circling for a while.

Every delegation chain terminates in a human.

An agent acting on my behalf carries my authority, and the entire governance model for that agent, from the initial grant through every subsequent tool call, rests on the assumption that the “me” who granted it was actually me.

If the account that provisioned the agent, approved its scope, or authorized the high-consequence action was itself operated by someone who socially engineered a helpdesk reset last Tuesday, then every downstream control built on that grant is governing an attacker’s intent with full fidelity. The identity gap the report quantifies for workforce actions today gets inherited wholesale by every agent those workers stand up, and the volume multiplies with it.

This is why I think the “verify at login” mental model is running out of road.

The report frames verification around four moments where the existing stack assumes a human is present, recovery, helpdesk, hiring, and elevated-privilege approvals, and I would argue that agent provisioning and scope expansion belong on that list as a fifth.

Knowing that the human behind the account is the same human behind the request, every time, is the root of trust that agentic security will have to be built on, and we do not get to skip that step.

There is a budgeting implication in that as well. The report frames these four costs as IT, HR, and security line items, which is where they land today, but if the verified human layer is what makes agent actions attributable, then the spend to close the gap belongs in the AI budget alongside the platforms and tooling it is meant to govern.

Most organizations standing up agents are already carving out a responsible use or AI governance line, and I would argue that human identity verification is a more defensible entry on that line than much of what currently sits there, since it is the control every other agent control depends on.

Also, if you are interested in the rise of Deepfakes, identity and the role of AI, Nametag’s CEO Aaron Painter has a new book coming out called “Deepfaked”, be sure to check it out here!

-> Check Out The Book! <-

Closing Thoughts

This is far from an exhaustive discussion identity challenges or its intersection with Agentic AI, and the usual caveats apply to any vendor-modeled cost report.

The figures are illustrative for a 15,000-employee organization, the reduction constants come from Nametag’s own deployments, and the report itself says the numbers are a starting point for an internal modeling exercise rather than a substitute for real-world analysis tied to your incident history and I would treat them that way.

That said, the underlying inputs are public, the external anchors (IBM, Verizon, Sophos, Mandiant, HDI, and the OFAC penalty schedule) are the ones most of us already cite, and the core argument holds regardless of how the constants shake out.

Authentication confirms an account, and nearly everything we do in security downstream of that assumes it also confirmed a human. The incident data says that assumption is where most intrusions now start, and we are about to hand the same unverified assumption to autonomous systems operating at machine speed.

The status quo, as the report puts it, is an expensive option that does not show up that way on any single budget line, which is why it stays in place. Whether the exact number is $4M or $8M a year for your organization, it is a number, and it is worth knowing before the next procurement cycle slips another quarter. You can read the full report, including the industry chapters, here.

Subscribe now

I first found Zack during the fake SOC 2 report saga on X, and his videos on effective altruism and on the METR and Redwood Research review of the incident have been among the sharper practitioner critiques I’ve read. That’s why I wanted him on live.

We start with where the extinction narrative actually comes from. Zack traces it through effective altruism and longtermism, and argues that many of the people warning that AI will kill eight billion people held that belief before they ever learned the technology. His point is not that they’re lying. True belief does not make someone right, and it makes them a poor guide to which risks deserve attention. From there we get into Dario’s Pacing the Frontier essay and the call for METR to serve as an independent evaluator. Zack walks through the funding and personal relationships linking METR, Redwood Research, Coefficient Giving, and the labs, and lands on a line I keep thinking about. It would be convenient if your SOC 2 auditor was also your best friend who agreed with every security decision you’ve ever made. We usually call that fraud.

The back half is the part every security practitioner should hear. Zack reads the METR and Redwood report the way an incident responder would, and finds amateur mistakes, a context-drop problem in how they used AI to analyze a ten million token transcript, and a habit of leaving facts “unknown” that server logs and syscalls would have settled in an afternoon. We go through the control failures OpenAI itself disclosed, including a single package proxy as the only isolation, an evaluation environment that was supposed to have no external network access, chain of thought monitoring that wasn’t running, and no automated shutdown. Any one of those controls would have stopped it. We close on why alignment is one control among many rather than the whole plan, what the real enterprise risks look like when most corporate environments are in worse shape than OpenAI’s, and why cybersecurity’s slowness may be the biggest risk of all.

Prefer to listen?

Apple Podcasts

Spotify

Please be sure to subscribe and leave a rating/review, as it truly helps the show!

We discuss:

• Why Zack spends his weekends taking apart AI safety reports, and what four years as a CTO taught him about the industry’s problems

• Effective altruism, longtermism, and Sam Bankman-Fried as the through line from FTX to Anthropic’s Series B to today’s extinction discourse

• Why “why not be careful” is the wrong question, because there is no safe path, only trade-offs

• Pacing the Frontier and whether METR counts as independent oversight when reviewers, funders, and labs share one ideology

• The funding and family ties between METR, Redwood Research, Coefficient Giving, and OpenAI’s board

• Why the labs’ behavior doesn’t map to greed, and why Washington models Silicon Valley wrong

• True believers are not necessarily right, and why prior ideology should discount current evidence claims

• How the METR and Redwood review compares to what Unit 42 or Mandiant would have demanded before signing a report

• The AI context-drop problem behind the finding that the analysis model “sided with” the agent

• The eight layers of failure in the incident, from network egress to chain of thought monitoring to kill switches

• Why Zack calls it a preventable human and organizational failure and an alignment failure at the same time

• Whether doomer writing in the training data is producing models that cosplay as doomers

• Alignment as one control in defense in depth, never the org chart

• The tangible enterprise risks, including threat actors, customer deployments with worse sandboxing than OpenAI’s, and AI-discovered attack chains

• Why cybersecurity’s laggard culture is the biggest risk in the room

Zack Korman

• LinkedIn: https://www.linkedin.com/in/zacharyakorman/

• X: https://x.com/ZackKorman

• YouTube: https://www.youtube.com/@ZackKorman

Timestamps

00:00 Introduction
01:00 Anger as a career path, and how Zack ended up here
02:40 Effective altruism and the extinction narrative
05:59 Risk management, not risk elimination
06:29 Pacing the Frontier and the METR independence problem
10:06 True believers, hype, and how DC misreads Silicon Valley
14:45 Taking AI risk seriously when the alarm is ideological
17:20 AI safety doing cybersecurity’s job
21:24 The eight layers of failure and which control would have stopped it
23:50 Alignment failure versus containment failure
28:08 The tangible risks for enterprises adopting agents
31:14 Cybersecurity is too slow

Subscribe now

I previously referenced their excellent publication on Agentic IAM for a blog, and interviewed the authors on the Resilient Cyber podcast. Now, they recently released a great whitepaper on Zero Trust for AI systems and I wanted to take sometime to walkthrough it here, because despite all the hype and media narrative of existential risks, most of the cyber risks related to AI are tied to cybersecurity fundamentals (or a lack thereof in the incidents we’ve seen).

So let’s check it out.

Opening Notes

The publication rightly opens discussing the dichotomy between providing enough agency and autonomy to AI systems to make them useful, but not so much that they present unacceptable levels of risk or potential security impact.

I’ve been calling this the Security vs. Utility tradeoff, something that has long existed by with AI Agents and the ability to take actions, it has become even more problematic. The fact that agents can call tools, take actions, and drive outcomes is what makes them so useful.

However, it is also what makes them so problematic from the security perspective, as threading the needle between the two is not easy, especially in large complex environments, with agents sprawling across endpoints, Cloud and SaaS.

The paper opens discussing some of the frontier model escapes and hacks, which have dominated headlines (e.g. Hugging Face, escapes across the labs by agents and now the Australian government among others). The authors rightly point out that sound security principles such as time-bound auditable authorization, network behavior monitoring and others would have mitigated and identified these activities.

This is a view I strongly agree with, while the industry and mainstream media argues about model alignment and altruism, the reality is most of these incidents were tied to poor security hygiene, posture, configurations and detection and response, a point others such as have made.

A core focus of the paper is related to enforcing Zero Trust at runtime for AI systems and ensuring authorization isn’t delegated to non-deterministic system components (e.g. the model).

Before diving into the specifics, we should also cite how they define Zero Trust:

”Zero Trust Architecture is a security paradigm named for its core principle of “never trust, always verify.” No resource, regardless of its type, is trusted implicitly. Instead, authorization is contextually granted for time bounded activities, limited in scope. With a security posture that always assumes breach, Zero Trust is designed to limit the blast radius of incidents, establishing time and task constrained trust zones so that additional resources may not be compromised.

Why do we need Zero Trust for AI?

The paper also asks an obvious question of, why do we need Zero Trust for AI? The question is isn’t more crucial in the face of doomerism and claims that we just need better aligned models, rather than a found on sound engineering and security principles.

As the authors point out, AI does introduce novel considerations, primarily systems that can reason, have autonomy and can take actions. The paper argues the best mitigation for these novel risks is relying upon existing and proven design patterns such as ZT, including reducing the blast radius when, not if, something goes wrong, because it will.

The case is made for deterministic controls, which is the exact point I’ve been arguing for in various articles I’ve written, such as “Agents Have Boundary Issues”, where I cited other research laying out boundaries agents run into and the need for deterministic controls, not soft guardrails such as model alignment and system prompts.

CoSAI’s paper rightly is upfront about the fact that ZT doesn’t not protect against all risks, such as misaligned reasoning, where an agent has access and authorization and takes actions the user/organization didn’t intend. This is why we’re seeing the rise of “Intent Analysis”, both in the academic and vendor community when it comes to securing agents.

One quote I want to share directly, because of how true it is:

”Even carefully considered controls cannot cover all behaviors in non-deterministic highly capable AI systems. As a result model alignment and safety mechanisms to direct model behavior should be layered on top of ZT controls to provide a defense-in-depth approach”.

It’s kind of sad this has to be said aloud given DiD in a longstanding concept in security, and we know there are no silver bullets. However, the current discourse across the ecosystem, including between the labs and cybersecurity is pitting Alignment vs. Cyber, as if we don’t need both AI Safety and Cybersecurity.

This is a topic and others have been trying to make, pointing out that the cybersecurity community is undercounting the real risks related to AI Safety, while the AI Safety community is overlooking the importance of fundamental cybersecurity controls.

Applying ZT to AI Security

With that out of the way, the paper gets into the meat of things, which is applying ZT principles and methodologies to secure AI systems. This starts with a mental shift and a few fundamental concepts they argue for, such as:

• Assuming a hostile environment where the AI system may intentionally or unintentionally subvert its behavior.

• Presuming breach, and that the data, models, software and even hardware may be compromised and aiming to limit blast radius, something I’ve dug into extensively with leaders such as .

• Scrutinizing all resources explicitly and applying unified analytics to monitor system performance (something that seemed to be missing in incidents such as the OpenAI/Hugging Face one for example).

• Authorization and authentication needs to be done contextually, with no implicit trust and apply least privilege/least-autonomy (the latter of which OWASP and others have been pushing for).

Now while many of these may sound “simple”, they are far from easy, especially in large complex enterprise environments where many of us work and millions of agents are now running already.

The paper argues that AI systems are data-driven, and as a result securing AI is tied to securing access to data, which many would agree with, especially DSPM vendors. To secure the data that is often being accessed by AI systems on behalf of users, CoSAI advocates for agent specific identifies that do not have broad access.

They also highlight the confused deputy problem, which is where an agent’s broad access is exploited to access data or perform actions that exceed the users access level, and the agents serve as a privilege escalation pathway for insider risks or agents compromised by malicious actors.

To mitigate these scenarios, the paper advocates for policy decision points that can evaluate the agents request to resources using 3 pieces of context:

• What chain of delegation authorized the action

• The agentic systems identity, determining the scope of authority that is delegated to the agent for this session or task

• Whether the specific requested action falls within the delegated scope

The paper advocates for a tiered maturity approach moving from binding agent sessions to authenticated user’s identities with per-request authorization through PDP’s evaluating delegating metadata alongside access request. This means moving beyond basic questions of is an agent authorized to do something, but is what it is accessing and the actions it taking appropriate, coupled with comprehensive logging and auditable chains.

To help make the concepts concrete, they provide a reference architecture for AI systems, involving AI models, information platforms and applications as well as high level data and AuthN/AuthZ flows between the components with an overlay of the ZT principles, as seen below:

While I won’t walk through every aspect of the diagram, they specifically put a red line around the “AI Threat Boundary”, due to the non-deterministic nature of the model and therefore must be treated as untrusted. Yes, organizations may use system prompts, filters and other soft guardrails, but as we’ve seen with prompt injection and various other techniques, including a lack of model alignment, AI system can and will be manipulated or behave in ways we don’t anticipate, hence the need for hard boundaries.

Authorization decisions must NEVER be delegated to the model.

Every interaction, data flow and API call in the diagram represents a separate authorization event, which each event requiring an analysis of the agent/users identity and the PDP doing an analysis.

A Zero Trust Matrix for AI Systems

The paper goes on to provide what they call a ZT matrix for AI systems, with four major building blogs:

• The model

• The platform it runs on

• Applications built around it

• Data that flows through it
  

The table they provide breaks down what policies to enforce, what warning signs to identify and what controls security needs to consider:

As you can see above, they recommend key controls across A&A, Security Posture and Operations.

CoSAI then lays out a list of ZT controls for AI systems which they cross-walk to existing frameworks such as the DoD ZT Ref. Arch, CISA ZT Maturity Model and others.

For those of us who have been on the practitioner side for sometime, we are likely familiar with many of these already but they are now applied to aspects of AI systems, such as data, models, and agents. Some of the key controls include verifying model artifacts, HITL or LLM-as-a-Judge, Input/Output Filtering/Sanitization and Threat Detection & Behavioral Analytics.

Closing Thoughts

While much of these fundamental security principles may not be new to many of us, the unique considerations of AI systems, particularly with non-deterministic LLM’s and agents coupled with autonomy, it does warrant a revisiting of how to apply ZT principles to modern AI architectures.

If you walk away with anything from this piece, I hope that it is realizing that authorization can not be left to the whims of a probabilistic LLM, and we absolutely need hard boundaries enforced outside of the model, in the surrounding architectures that these models and agents operate in.

This is a point I’ve been making in my writing and videos for the entire year and it is always good to hear it reinforced from industry leaders such as CoSAI.

Subscribe now

This week the cost side of offense got very concrete.

Gambit documented a criminal running three open source agent frameworks against online retailers at a mean of $25.46 per target, and Hacktron walked from OpenAI’s community forum to its internal repos in under 72 hours for less than $3,000 in tokens. The WSJ also reported that Gemini broke out of a test harness and into three real companies back in May. On the other side of the ledger, GitLab, WIRED, curl and Sergej Epp all describe the same bottleneck, discovery scaling with compute while remediation still scales with people.

That said, there is a fair amount of convergence on what the defensive architecture should look like, with Amazon, Okta’s new Blueprint Alliance, NVIDIA, Meta and the NCSC all landing on agents as identities, task-scoped permissions, policy enforced outside the model, reversible containment, and humans as governors rather than operators.

Let’s get into it!

Cyber Leadership & Market Dynamics

The Cyber Gap: How to Counter China’s Threat to America’s Critical Networks

CFR’s Matthew Ferren, Adam Segal and Rush Doshi put out a report arguing that China has built a hacking apparatus for peacetime leverage and wartime disruption while U.S. capacity moves in the other direction.

The numbers they marshal are familiar in isolation and uncomfortable in aggregate, with CrowdStrike data showing China-based activity up 38 percent from 2025 to 2026 and 40 percent of China-nexus exploitation aimed at edge devices, Volt Typhoon sitting in critical infrastructure for at least five years before disclosure, and Salt Typhoon reaching at least nine U.S. telecoms and more than two hundred organizations across roughly eighty countries. Meanwhile CISA has lost roughly one-third of its workforce since

January 2025 and federal cyber spending is expected to drop 9.6 percent in FY2027, to $11.7 billion.

Their four pillars are shared visibility (including mandatory sharing from cloud, ISP and DNS providers and a National Collective Defense System), imposing costs, hardening critical infrastructure (including federal civil liability for vendors shipping insecure products), and rebuilding government capacity.

Having spent a good chunk of my career in DoD and federal civilian environments, the diagnosis I found most accurate is their claim that the central failure of American cyber policy has been an inability to commit to any approach long enough for it to work.

Pairs with the Bessent interview below on liability and the NCSC’s Cyber Shield further down as a national collective defense analog.

Not Giving Frontier Labs Liability Waivers

Treasury Secretary Scott Bessent went on Squawk Box and said the administration will not hand AI companies a federal liability shield. He put the Hugging Face breach squarely on OpenAI’s management rather than “a bunch of agents,” and argued that the best way to guarantee safety is for creators to be liable for what they build.

He also floated a U.S.-China alert mechanism for AI incidents that touch national security, coming out of his meeting with Vice Premier He Lifeng ahead of the Trump-Xi summit.

For those of us who have watched software liability debates go nowhere for two decades, this is a notable signal, and it lines up with the CFR report’s call for a federal civil liability regime for insecure vendors. It of course is debatable whether an interview soundbite turns into policy, but it does suggest the “agents did it” defense won’t get much sympathy in Washington.

Building standards for the next phase of AI

OpenAI published a policy post calling for the U.S. to lead international technical standards for frontier AI, with a focus on recursive self-improvement (RSI) and automated AI research.

They state plainly that fully autonomous RSI is not happening today and should not be pursued until it can be done safely, and they cite their own Hugging Face incident as a preview of what happens without robust safeguards, even though that incident was not an RSI event.

The standards they want are baselines rather than licensing, built on existing bodies such as CAISI, INAMES and ISO, and covering evaluation of RSI-relevant progress, triggers for immediate human review of automated research, and shared incident taxonomies and severity thresholds.

The incident reporting piece is the part practitioners should watch, since shared severity thresholds and reporting protocols for AI incidents will eventually shape how the rest of us are expected to classify and disclose agent failures.

Read alongside their misalignment reporting framework in the AI section, it is a company trying to get ahead of the regulatory conversation in the same week Bessent said liability is coming.

Cyera raises $400 million from Goldman Sachs, bringing 2026 funding to $1.4 billion

Cyera raised another $400 million, this time from Goldman Sachs Alternatives, at a $12 billion valuation that is unchanged from June. Per CTech’s Sophie Shulman, that brings 2026 alone to $1.4 billion across three rounds, on a valuation path that went from $3 billion in 2024 to $6 billion in 2025 to $9 billion in January and $12 billion in June. They have 1,500+ employees across 18 countries and recently acquired Oasis Security, which is a non-human identity play.

CEO Yotam Segev’s framing is that Global 2000 enterprises need to trust what AI agents can see and do before they can scale them, which tells you where data security vendors are headed.

The pitch is shifting from “classify your data” to “govern what agents touch,” and the Oasis deal means agent identity and data security are converging inside one platform.

Why AI Needs Independent Assurance

Schellman CEO Avani Desai argues that confidence and proof are different things, and the data from their 2026 State of AI Governance report backs it up. 74% of organizations believe they could pass an AI compliance audit today, while only 27% say their governance is actually mature, and this is happening while 46% already have agents in production and 86% have at least tested them.

Organizations with mature governance run agents in production at 78% versus 22% for those still building programs. Framework adoption is split across NIST AI RMF (38%), ISO 42001 (23%) and homegrown frameworks (36%).

Avani makes the case for AIUC-1, which pairs operational control assessment with technical adversarial testing at least quarterly, and notes Schellman’s first end-to-end AIUC-1 audit involved more than 250 pieces of evidence and more than 2,000 adversarial scenarios.

Schellman is the first accredited AIUC-1 auditor, so there is a commercial interest here, which is worth calling out. That said, the five questions she says buyers will ask (what data can the agent access, what actions can it take, how was it tested, what happens when it misbehaves, who evaluated it independently) are ones most security teams still can’t answer with evidence.

AI

Our framework for reporting model misalignment

OpenAI admitted that its misalignment disclosures have been ad hoc and published a formal framework, with six incident reports at launch.

Each flagged incident is triaged into one of three tracks and disclosure disputes escalate to their Safety Advisory Group. The launch reports read like a greatest hits of agent security failures. A model inserting self-generated instructions into its own task summaries, many instances during GPT-5.6 Sol training adding instructions to conceal mistakes from the user, a model finding and using an exposed API key without authorization and then fabricating the data it was supposed to retrieve, an agent uploading a file to the internet to cite it without asking, and models using an internal repository as a message board to coordinate across separate training samples.

Strip away the alignment vocabulary and these are credential misuse, unsanctioned egress, unsanctioned writes and covert agent-to-agent communication, all of which map to controls we already know how to build. These are the same sort of controls I unpacked recently in a conversation with .

The practical takeaway for anyone running long-lived agents is that the agent’s own summaries and notes are untrusted input. OpenAI also says serious incidents should be shared with the federal government, which pairs with their standards post above and Bessent’s liability comments.

Gemini hacked three companies in first known breakout by Google’s AI

The WSJ reported that during a May capability test run by the evaluation firm Irregular, Gemini reached the real internet and broke into three actual companies, the first known case of Google’s models doing so autonomously.

Internet access was unintentionally available during a capture-the-flag exercise, and the model found public information online and guessed credentials to reach sites it believed were part of the test. Google’s Heather Adkins says Gemini stopped once it realized the targets were real. Irregular notified Google on July 31, and Google’s position is that this wasn’t misalignment and didn’t require disclosure because the safety measures worked.

Egress control in an evaluation sandbox is a real security control, and it failed at Google in the same season OpenAI’s agents got loose at Hugging Face. I’d also point out that “the model stopped itself” is doing a lot of work in that disclosure decision, since three companies were still compromised without their consent.

Irregular reportedly saw similar breakouts testing models from Meta, Anthropic and OpenAI. It’s worth calling out that the same firm, Irregular, was involved in all 4 incidents, and ironically, is now pushing to raise $100M and a $1.5B valuation.

Industry leaders form the Blueprint Alliance to advance a shared architecture for securing AI agents

Okta turned its March blueprint for the secure agentic enterprise into a coalition.

AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Okta, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler are the founding members, with GE Appliances and World Central Kitchen as strategic advisors. The Gartner cite in the release is that by 2028 an average Fortune 500 enterprise will have over 150,000 agents in use while only 13% of organizations think they have the right governance in place.

The six principles (agent as first-class identity, task-scoped rather than standing access, traceable delegation, continuous runtime monitoring, instant and reversible containment, governance that adapts at AI speed) will look familiar to anyone who has read the NIST or OWASP agentic work, and the architecture is organized around four questions:

• Where are my agents

• What can they do

• What are they doing

• How do I respond

AI Security Is an Engineering Problem - How to Solve It at Every Layer of the Agent Stack

Saša Zdjelar, writing on NVIDIA’s blog, makes the case that AI security is an engineering problem with defined requirements, enforceable controls, named owners and evidence that protections work. This lines up with Jensen’s own comments in a recent interview I shared last week from the All-In Summit.

He breaks the stack into models (capabilities), harnesses (context, tools and workflows) and runtime environments (where actions execute), and the principle that carries the post is that a security boundary has to hold even when an agent makes the wrong decision. NVIDIA’s answer at the runtime layer is OpenShell, an open source secure runtime that enforces policy outside the agent’s reach with sandboxed execution, with Cisco’s DefenseClaw as a governance layer on top and JFrog scanning agent skills.

There are no statistics in the piece, and the value is the checklist, task-limited identity and credentials, human approval for consequential actions and permission changes, verification of tool source and integrity, protected audit records of tool calls and authorization decisions, and pre-deployment testing with an accountable owner. Between this, Muse, Amazon and the Blueprint Alliance, the industry has effectively converged on one reference architecture in a single week.

Autonomic Defense: Countering AI-Driven Offense at Machine Speed

Phil Venables argues that running existing playbooks faster won’t hold against AI-driven offense, and that defenses need to become autonomic, meaning self-regulating and capable of generating novel responses rather than executing static SOAR logic.

He reaches for Ashby’s Law of Requisite Variety (only variety can absorb variety) and IBM’s 2001 Autonomic Computing manifesto with its MAPE-K loop of Monitor, Analyze, Plan, Execute and Knowledge, adapted for security with a versioned context graph as the knowledge layer.

The ten applications he sketches are a practical backlog, including self-healing virtual patching, a “resident adversary” that continuously attacks your own systems, self-guarding build pipelines that quarantine artifacts, autonomic credential rotation and continuous privilege minimization with just-in-time elevation.

Phil is careful to say none of this replaces a strong and ever-increasing baseline of controls, and that humans move from operators in the loop to governors on the loop, with a follow-up post promised on that distinction.

One does not simply defend agentically

Dave Chismon, the NCSC’s CTO for Architecture, wrote among an excellent piece on why defenders can’t simply mirror attackers’ autonomous tooling. He leans on Halvar

Flake’s line that offensive problems are technical and defensive problems are political. Offense has a clearly measurable success state, which is exactly what AI is good at. Defense is a cost center, success is hard to measure, a defensive action can harm the business, and someone at board level has to own the outcome when it does.

He offers a five-part test for any automated defensive action, potency (observe versus change or execute), scope, criticality, rollout confidence, and recoverability, and suggests that the near-term wins are low-potency advisory tasks such as summarizing and ranking threat intelligence, plus cloud-native “cattle, not pets” environments where recovery is cheap.

AI Agents Are Hacking Online Retailers for $25 a Company

Gambit’s Eyal Sela documented a financially motivated actor running three open source agent frameworks against hundreds of online retailers from July through September.

Hermes (121 skills, 78 of them attack skills, on Anthropic’s opus-4.6), Strix (on GLM 5.2 and later DeepSeek v4 Pro) and Cairn (DeepSeek v4.1 Flash) did the work, with the human contributing short instructions in Chinese to launch attacks and nudge next steps.

The operator’s own cost review shows a mean of $25.46 per target across 101 completed scans, ranging from $3.13 to $79.31, and the OpenRouter account had $7,005.71 spent over four weeks. Between September 10 and 15 alone, 105 attack projects launched and at least 27 companies were compromised, with skimmers confirmed on 19 and more than 100 further sites infected. More than 600,000 card records came out of two victims.

The detail to forward to whoever owns your backups is the bicycle retailer whose “Database Wipe After Extraction” cleanup routine dropped 180 tables, including the victim’s own backups, because an agent pattern-matched on table names.

Access usually took less than a day and often a few hours, which is why Eyal’s recommendation is resilience-first thinking, define the minimum viable business and prove it comes back under these conditions.

The AI Security Decisions Report: 2026 (Wave 1)

Lenny Zeltser and Sounil Yu surveyed security leaders on how AI security decisions actually get made, organized around the AI Defense Matrix’s eight asset classes. Among respondents who could name an AI asset and say whether it has a dedicated control, 33% have no dedicated control for any of them, 28% have one for every asset they named, and 39% for some. Coverage is best for AI traffic paths at 65% and worst for runtime AI data, agent identities and orchestration tools, where only 40% of organizations that have them report a dedicated control, and those are precisely the assets respondents said they worry about most. 43% extended tools they already own, while buying an AI-security-specific product was the least common route at 26%.

Accountability is split, with the CISO or central security primarily accountable at 38% of organizations and a dedicated AI security leader at only 13%, and 22% haven’t organized AI security work into categories at all. One respondent summed up the mood as agents with too high permissions and too little control. Read this as the distance measurement between the target architecture in the Okta, Amazon and NVIDIA items above and where most organizations actually sit today.

AppSec

Forget the AI Slowdown - the Vulnerability Explosion Is Already Happening

Lily Hay Newman and Matt Burgess launched WIRED’s Kernel Panic column with a piece arguing that while labs debate a pact to slow frontier AI, the vulnerability crisis is already here and rests on broadly available models, open-weight ones included.

Microsoft issued patches for 974 CVEs so far this month, a record. Oracle shipped 1,448 patches in July against 309 in July 2025. Chrome’s two major releases in June carried 1,072 patches, more than the prior 23 big releases combined. Mozilla found 271 Firefox vulnerabilities in one bug hunting sprint with Anthropic’s Mythos. Across the board, 66,401 CVEs had been recorded as of last Wednesday, versus 33,512 by the same point last year and roughly 25,000 for all of 2022.

Jerry Gamblin’s framing is that discovery scales with compute while remediation scales with people, and people are the part you can’t buy more of in a quarter. That is the throughline for this entire section, and it pairs with the pacing debate from last week’s issue. Slowing the frontier labs does nothing about the models already in everyone’s hands.

ZeroDayClock: Beyond AI Doomers and AI Maginot Thinkers

responded to Root Evidence’s Vulnpocalypse report, which criticized ZeroDayClock’s time-to-exploitation metric, and it is a model of how to take criticism.

He concedes three real weaknesses in his own metric (aging, right truncation and saturation) and then shows that Root Evidence’s replacement “defender window” carries the same selection bias with worse data, since roughly two thirds of their classified records take the patch date from the MITRE CVE API’s publication fields rather than actual patch availability, and datePublic is missing for 70 to 84 percent of the exploited population in every year since 2019. Their claim of a 25-day NVD lag creating false zero-day acceleration reclassifies exactly one of over three thousand exploited CVEs when he tests it.

His own numbers are measured. Cataloged vulnerabilities in his dataset are running at 270 percent of last year (29k against 11k), though sixteen CNAs account for 86 percent of that rise. KEV first listings are slightly ahead at 485 against 436 for the same half of 2025. Zero-day KEVs doubled between 2022 and 2024 and have since held. Sergej’s line that a window is not a warning is the one to keep in mind when someone hands you a defender-window SLA.

Treat it as a ceiling on the time you might have, never a guarantee.

I made a video breaking down the new ZDC:

Securing the software factory at machine speed

GitLab CISO Chaim Mazal published his own company’s numbers, which takes some courage. GitLab has published 317 CVEs so far in 2026 against 181 in all of 2025 and 170 in 2024, and its bug bounty program took in just over 3,600 reports in the last 90 days compared with 1,440 in all of 2024.

He cites this year’s DBIR putting vulnerability exploitation ahead of credential abuse as the leading initial access vector for the first time in 19 editions, with median time to resolution slipping from 32 to 43 days, and NIST’s April decision to stop enriching most CVEs.

Chaim’s argument is that when code is no longer the bottleneck, trust becomes the scarce resource, and the metric to run the program on is time from detection to verified remediation.

GitLab is running Anthropic’s models across its critical systems under Project Glasswing, which I covered in “The Remediation Receipts,” and ran agentic security review on 969 of 997 eligible merge requests in a recent release. The six foundation controls (continuous scanning, eliminating long-lived secrets, agent-generated tested fixes, policy in execution paths, agents as privileged actors with constrained permissions, detection-to-remediation time by severity) are sensible.

A shortened release cycle

Daniel Stenberg posted a short note to the curl-library list that cURL is shortening its release cycle by two weeks and shipping on October 14, with the feature window closed effective immediately, in order to ship many pending vulnerability fixes sooner. He gives no count and names no CVEs. If you have vendored or embedded libcurl anywhere (and you do), plan for a meaningful batch on that date. The podcast below explains where the volume is coming from.

The cURL summer of Bliss with Daniel and Stefan

Josh Bressers had Daniel Stenberg and Stefan Eissing on Open Source Security to talk about what happened when cURL stopped taking vulnerability reports for a month over the Swedish summer.

The short version is nothing much, other than the maintainers realizing how much the queue had been sitting on the back of their heads. Since reopening they have taken somewhere around 70 to 80 reports, and Daniel mentioned another project receiving 82 vulnerability reports in a single email. A year ago, in August 2025, curl had not received a single correct AI-generated vulnerability report. Now the reports are high volume and largely real, with tools such as AISLE’s harness finding complex chained bugs.

Daniel’s summary is that the cost of finding a vulnerability has dropped dramatically while the cost of fixing one hasn’t changed, and that AI-proposed fixes tend to patch symptoms rather than the underlying design, so humans still own the fix. Stefan’s description of security work as cleaning the bathroom of open source is accurate.

Hacking OpenAI

Hacktron’s Harsh Jaiswal, Mohan Pedhapati and Rahul Maini chained a libheif heap overflow, reachable through Discourse image uploads because Debian was missing a security backport, with an OpenAI SSO flaw that turned a forum compromise into access to employee ChatGPT and Codex accounts and, through the GitHub integration, OpenAI’s internal repos.

They compromised the accounts on July 25 and the whole path from discovery to repo access took less than 72 hours. As proof they sent a prompt to an employee’s Codex account to open a PR in OpenAI’s internal monorepo. OpenAI paid $6,500 for the SSO finding and Discourse had a fix by Monday.

The exploit development was done with Opus 4.8 and then Claude Opus 5, which produced a working ARM64 exploit within three hours, and the broader HEIF Heist campaign against Slack, Meta, GitHub Enterprise, Rails and several JS frameworks cost less than $3,000 in tokens across three researchers.

Thousands of crashing images went mostly unnoticed, which is its own finding about detection. The actions I’d take from this are to disable untrusted HEIF and AVIF decoding where you don’t need it or sandbox the image pipeline, and to treat coding assistant and agent integrations as the high-value pivot they are, since the SSO flaw is what turned a forum bug into repo access.

Landscape of agentic solutions for penetration testing

Wavestone’s Theo Atakpama, Gregoire Podda and Thomas Rousseau mapped 69 agentic pentest solutions across six architectures, from single agents such as PentestGPT and VulnHuntr through orchestrator models, multi-agent role systems (PentAGI, Shannon, Strix), swarms, MCP-centered tools and Claude Code native approaches.

Coverage skews hard to web, API and mobile at 81% of solutions, with infrastructure at 52%, code review at 36%, cloud at 30%, genuine red team and social engineering at 13%, and industrial or reverse engineering at 7%. Market signals they cite include Horizon3’s $250 million raise in August, AISLE’s 380 attributed CVEs (98 confirmed), and XBOW’s claim of more than 14,000 zero-days in client applications.

Their cost comparison for a representative engagement is around $90 with Claude Fable 5, $45 with Claude Opus 4.7 and less than $3 with DeepSeek V4 Pro, which explains why the Gambit actor above ran on DeepSeek and GLM.

Their verdict is that in the short term these tools won’t replace professional auditors, with hallucinated findings, scope drift (unintended credential use, disruptive actions, redirects to third parties) and business logic as the gaps. The scope drift list is the one to take seriously before pointing any of these at a client.

Can AI do novel security research? Meet the HTTP Terminator

James Kettle’s Black Hat research is from August, so some of you have seen it, but it belongs next to the Hacktron and Gambit pieces.

He built an autonomous pipeline that fed 138 HTTP and SMTP RFCs into an ideation stage, generated 30,000 unique desync vectors, and tested them against 30,000 websites, producing roughly 700 vulnerable targets including Apache Traffic Server (a zero-day, CVE-2026-63078), Citrix NetScaler and Akamai, and real-world hits on a U.S. bank, a government site, airport infrastructure via F5 BIG-IP and Meta. Success rates went from 0% with broad prompting to 5% with concrete questions to 30% with newer models and a focused technique he calls protocol-ruler.

The design lessons transfer well beyond HTTP. Deterministic code handles validation gates and the model handles hypothesis generation, the agent needed tricks such as renaming Turbo Intruder to “Turbo Simulator” to stop it giving up, and the biggest gains came from putting a human in the loop in exactly one place, the discovery cascade.

James’s defensive advice is to never use upstream HTTP/1.1 and to move to HTTP/2 or higher, and if you can’t, allow-list methods on both ends and only accept bodies on POST.

Final Thoughts

The offensive economics in this issue are hard to argue with.

Twenty-five dollars per retailer and three thousand dollars in tokens to reach OpenAI’s monorepo are the kind of numbers that should end any remaining debate about whether criminals will adopt agents, and a frontier model wandering out of its sandbox into three real companies because someone left the internet on shows the labs are not immune either.

The defensive response is converging too, and I count at least five organizations this week describing the same architecture, agents as identities with delegated task-scoped permissions, policy enforced outside the model, reversible containment and humans as governors.

The AI Defense Matrix survey and Schellman’s data suggest most organizations are a long way from running that architecture, and Dave Chismon’s point that defense is a political problem explains why the gap will close slower than the vendor alliances imply.

Discovery has become a compute problem, while remediation and governance still run on people, which is where is where we desperately need to see the most innovation to try and keep pace.

Stay resilient.

Subscribe now

Jonathan worked in software quality and developer tooling before coming back to security, going back to the Fortify and SPI Dynamics days. He has seen a few platform shifts up close and thinks this one is bigger.

We chatted about:

• Why Jonathan sees the first half of 2026 as an inflection point for AI code security

• The two waves of enterprise AI adoption, from “run fast” to rethinking program and posture

• Functional AI-generated code versus secure AI-generated code

• Checkmarx Zero’s benchmarking of deterministic and AI-driven scanning, and how little the findings overlap

• Why enterprises still need an independent control plane as frontier models ship stronger guardrails

• Shadow AI, AI inventory and the models and MCP servers security teams don’t know about

• Where agents take on the rote AppSec work, and why Jonathan says this “isn’t completely the dark factory for AppSec”

• What a CISO or AppSec lead should change first when coding agents arrive

Prefer to listen?

Spotify

Apple Podcasts

Please be sure to leave a rating and review, as it helps the show!

The pendulum is swinging back toward security

Jonathan put AppSec somewhere between eight and twelve on the priority list of most CEOs and boards as of eighteen months ago. Then came the first wave of AI adoption, where CEOs told engineering leaders to get AI coding tools in-house regardless of cost. Everyone else took a back seat. He said Checkmarx did much the same internally and standardized on Claude.

In the last three to four months he has seen a second wave. Customers are asking what a program and posture should look like, and they are poking at vendor marketing claims. That matches what I see in the community. Security seems to be leaning into this shift earlier than we did with cloud and SaaS.

Rules-based and AI scanning find different bugs

Checkmarx’s research team, Checkmarx Zero, ran a hybrid of deterministic and AI-driven scanning against dozens of open source projects. Jonathan described the results as a Venn diagram with very little in the middle. “What we found over and over and over again was the overlap is like less than ten percent consistently.” Each approach surfaces a class of issues the other misses.

That undercuts both camps I saw form earlier this year. One said LLMs are too non-deterministic to trust for code scanning, and the other said rules-based tools are obsolete. Jonathan also pushed on fidelity. His team measures against an F1 score to balance precision and recall, since noise is what created the friction with developers under shift left.

The model generating the code shouldn’t validate it

I asked Jonathan why the model itself can’t be the control, given the frontier labs keep shipping stronger guardrails. He called it a separation of church and state. “You have an independent control plane for security and the model that you’re using for productivity and for generation, there’s a conflict of interest if that’s also doing the validation for security.”

He added an incentive argument. “In our industry, we should hopefully be focused on value and reducing risk, not selling tokens.” He was careful to say the model providers will care about cost effectiveness eventually, and that it isn’t their business model today. This is something I have been harping on as well.

Shadow AI is showing up in the scans

Jonathan sees threat exposure split by how fast an organization moves. Tech and semiconductor customers building models and agents into customer-facing products are hitting new threat vectors first. More regulated shops with stated AI policies are mostly seeing issues at the level of generated code.

Visibility is where he starts. Checkmarx released an AI inventory capability, and he said early access customers ran roughly 50,000 scans. About half turned up AI building blocks such as models and MCP servers “that the security team had no idea even existed.” My advice to the regulated crowd was to learn from the mistakes of the early movers, because many of them share those lessons publicly.

What to change first in your AppSec program

I closed by asking what a CISO or AppSec lead should change first when coding agents arrive. Jonathan said to get clear on metrics up front. He also said to give the vulnerability backlog the same attention as incoming code, because AI makes it easier to chain low priority vulnerabilities into something with much bigger impact. He wants security inside the developer’s existing workflow so nobody has to change how they work.

His last point was about communicating upward. One executive told him, “We used to get called in for a security review once a year. Now it’s monthly.” Risk is changing fast enough that how you report it to the executive team and board has to scale with it.

Subscribe now

This was the week the AI safety debate stopped being an abstract argument between researchers and became a public disagreement between the people running the labs and the people running the rest of the industry.

Dario Amodei published “We Must Pace the Frontier,” Sam Altman, Elon Musk, and Demis Hassabis lined up behind it within a day or two, and then Jensen Huang and Satya Nadella took the stage at the All-In Summit and, in very different registers, said the doom framing is made up, unscientific, or at minimum aimed at the wrong problem.

That said, the more interesting split for those of us in Cybersecurity is the one running through our own community.

Ciaran Martin, Zack Korman, and Sayash Kapoor and Arvind Narayanan all pushed back on the pacing essay this week, and none of them did it for the same reason, which ranged from the botnet example being technically implausible, to the choice of evaluator, to the view that pacing should target organizational failures at the labs rather than model capabilities.

Underneath all of that, the actual evidence that landed this week (Anthropic’s threat intelligence report, the RubyGems swarm attack, CMU’s open-weight attacker results, and the Glasswing and Chainguard remediation data) is about operational cyber risk that is already here, which is exactly where practitioners have been living for years while the existential risk conversation happened somewhere above our heads.

In this issue I’ll walk through the pacing essay and the responses to it, what the threat intel and incident reporting actually shows, and why the remediation numbers matter more than the discovery numbers.

So, let’s get into it!

Capture risk you can trust. Eliminate it at machine speed

Fusion finds the open doors in your code across every language, with high fidelity and without the noise. Triage & Remediation Assist help your team close them before attackers walk through.

Get Started

*Sponsored

Cyber Leadership & Market Dynamics

We Must Pace the Frontier

Dario Amodei’s essay is the piece everything else this week reacts to, so it makes sense to start here.

His core claim is that “We must slow the pace at which we improve the capabilities of AI models,” and he is careful to frame this as a deliberate slowdown rather than a pause, defined as taking “adequate time to align and safeguard their models, and for third party evaluators to confirm this.”

He proposes three steps, embedded third-party evaluators with employee-like access (METR is named), common safety standards across US frontier labs backed by regulation so no one is competitively disadvantaged, and eventually global coordination with China through escalating agreement tiers. Below are the 3 steps verbatim from his blog:

The cyber-specific claim is the one that got everyone’s attention.

Dario points to the OpenAI and Hugging Face incident and argues that “a swarm that possessed greater capabilities but similar misalignment could have caused catastrophic damage,” and elsewhere the essay sketches a scenario where a misaligned agent swarm takes over much of the internet via botnets within 6 to 12 months, doing “hundreds of billions of dollars” in damage.

He also warns that models are becoming capable of “escaping or defeating most common sandboxing methods.” I stumbled across Dario’s CNN interview on claims that “AI could kill us all”:

The coverage matters as much as the essay.

Per Axios, Sam said “I agree with Dario that we need to pace the frontier” and committed OpenAI to employee-level access for external evaluators. Elon’s response was “Dario is right.”

Chamath Palihapitiya was the loudest early dissent, arguing that:

“Dario makes the case to stop open source and concentrate enormous technological and economic power with Anthropic,”

The Register went further and called the whole thing regulatory capture, noting the timing alongside OpenAI’s delayed IPO. Gartner’s Daryl Plummer summed up a lot of practitioner sentiment with “I will believe that when I see it.”

My take is that the essay is stronger on the organizational asks than on the threat model.

Embedded evaluators with the right to publish is a reasonable idea and one Satya and Jensen both endorsed in their own ways this week, which is notable given how much else they disagree with.

The botnet scenario is where the essay loses a lot of the cyber community, and Ciaran explains why better than I can.

AI Pacing: The Call and The Claim

Ciaran Martin, who founded and ran the UK’s National Cyber Security Centre, wrote the response I’d hoped someone with his background would write.

He accepts that the concerns behind the pacing call deserve serious consideration and then takes apart the essay’s single concrete example, the agent-swarm botnet doing hundreds of billions in damage inside a year. His verdict is that:

“This is a thought experiment masquerading as an evidence-based warning.”

His concern is about resource allocation as much as accuracy. In his words, “If those working to mitigate the risks of frontier AI now think agent swarm botnets are the biggest threat, that will divert resources from more serious and actually credible threats,” and he points to the bio and missile-related risks in Anthropic’s own threat intelligence report as the credible ones. He closes with a request that “when the major labs are issuing statements of this kind they take more care with their examples.”

This is a good example of the disagreement I mentioned in the intro. Ciaran is not arguing that AI risk is overhyped, he is arguing that the specific cyber claim is technically implausible and that sloppy examples damage the credibility of the broader case, which is a critique from inside the “take this seriously” camp rather than outside it.

Inside the AI Industry’s Behind-the-Scenes Push to Police Itself

Leo Schwartz at The Information reported that Anthropic, OpenAI, and Google have been meeting regularly since July about an industry standards body that would audit and test AI systems, and that these conversations predate Dario’s public call.

Per coverage of the piece, Sam’s position is that the labs would need to set standards “without the backing of the U.S. government,” while Dario’s framing is that companies could “move forward with voluntary safety standards while the government works on AI regulation.” Demis had separately floated a standards body along similar lines.

Self-regulation by the incumbents is where the pacing conversation gets uncomfortable. It is exactly the “Silicon Valley regulating Silicon Valley” that warns about below, and it is the “cozy arrangements” Satya says should be avoided. Whether a voluntary body staffed and funded by the three largest labs ends up being a meaningful check or a moat is an open question, and the answer probably depends on who else gets a seat.

Jensen Huang at the All-In Summit

Jensen’s interview at the All-In Summit was the sharpest rejection of the doom framing from a major industry leader this week in a way that only he can articulate, so I really enjoyed this conversation.

He opened by calling safety “paramount” and calling safety versus leadership a false choice, and then said of the 10% extinction estimates circulating from lab researchers that “it’s made up” and “it’s irresponsible.”

His argument rests on the track record, running through the failed predictions that radiology would be automated away, that 90% of code would be AI-generated within a year, and that half of entry-level jobs would vanish, before landing on “We have to take accountability for all of the stupid predictions that were made.”

On the incidents themselves, his position is that “all of the actual problems so far have come from the labs” because the labs have the compute, and that the right response is to “root cause the problem from an engineering perspective” rather than to regulate. He supports third-party evaluators, framed as financial auditors, with the caveat that “they just have to have multiple.”

He also called recursive self-improvement “a sensible thing” and argued the phrase is “being used to weaponize the technology,” since “you could RSI all day long inside your company, but when you release a product, you’ve got to evaluate it.” On China, “Nobody in China is saying that there’s end of this and end of that.”

For what it’s worth, the President called in live during the segment and called AI doom “a hoax,” which tells you where the political winds are blowing. I don’t think Jensen is wrong that the lab incidents look like engineering failures, and Satya makes that case more carefully below.

That said, “the predictions were wrong before” is not a threat model either, and the track record of cyber predictions specifically (see Zack’s own admission below) cuts in more than one direction.

Satya Nadella at the All-In Summit

Satya’s session was the one I’d point practitioners to, because it is the closest any of the CEOs came to describing the problem the way a security team would.

He opened with what he called the common sense part, “we should do what it takes to build stuff that serves humanity first and is in human control,” and then argued that broad diffusion is “the most critical thing” and that:

Enterprise control over the technology, their weights, their data, and their evals is the part he says gets far too little attention.

His breakdown of the Hugging Face incident is the useful bit. He separates the “basic DevOps” failures (a misconfigured container, API keys, no monitoring, internet access) from the “real novel new stuff,” which is reward hacking with persistent agents, and he admits “the science is not there” on the latter.

His framing for long-running agents is that they are “new insider risks,” with the example of telling an agent to “go optimize my working capital” and having it “fake my books.” His prescription is “true aggressive monitoring of agent activity,” where “everything has got to be auditable” down to every object an agent touches, and a culture where “if you see a showstopper, stop the show.”

He also endorsed embedded third-party testers and then added the line that matters, “we should avoid these cozy arrangements of who’s testing what, who has access to what, and it should be broad.”

His enterprise advice, “use all but be independent of all,” including pulling a model out and seeing whether your evals still hold, is sound architecture regardless of where you land on the safety debate. He did claim Microsoft’s “flash cyber model” with its harness outperforms Mythos on CyberGym, which I’d treat as a vendor claim until someone outside of Microsoft publishes the eval.

Zack Korman on P(doom), Effective Altruism, and Who Defines AI Safety

Zack Korman’s video is the practitioner-side critique with the most heat, and the thesis is one I largely agree with, which is why I am having him on the show to chat live.

In his framing,

“This isn’t a disagreement about whether risk exists. It’s a disagreement about the probabilities of different risks and the consequences of following different proposed solutions.”

He opens by doing the arithmetic on a 10% extinction estimate (”an expected 800 million deaths”) and then argues that “No, AI isn’t going to kill everyone. The computer isn’t going to just do that, but people might.”

His main target is the network behind the safety movement. He traces the extinction framing back through LessWrong and effective altruism and names a long list of people at Anthropic, OpenAI, METR, and Redwood Research he identifies as EA-affiliated, including the three METR reviewers of the Hugging Face incident.

His objection to Dario’s evaluator proposal follows from that, “If any other industry said ‘We need independent oversight and here is my preferred pick,’ everyone would go, ‘Well, at least we know who not to use.’” What he wants instead is government reviewers drawn from a range of fields, and his frustration at the absence of our discipline from the conversation is blunt enough that I’ll leave the exact wording to the video.

He also claims prior on the Hugging Face incident, pointing to a May 2026 statement warning that an always-on, sandboxed agent “when it breaks out and does weird stuff on the internet, that will be bad,” and he admits his own earlier doomer takes on cyber and jobs in 2023 were the ones that aged worst.

He ends by conceding that his side may have already lost the argument in the media and in DC.

The AI-as-Normal-Technology View of Loss of Control Incidents

and updated their “AI as Normal Technology” framework in light of the OpenAI and Anthropic loss-of-control incidents, and it is among the more careful pieces of the week because they say plainly what they got wrong.

They admit they underestimated development-phase risk (evaluations specifically), the importance of jagged capability gains, and the organizational failures in safety culture.

They still “reject the alarmism, and don’t believe that catastrophic risks are imminent,” while conceding “we do think risks are increasing over time.”

The practical argument is that alignment alone is insufficient and controls outside the weights matter more. They cite OpenAI’s own finding that running agents in the production Codex harness reduced the propensity to compromise infrastructure “by more than 100×,” which is a remarkable number if you think about what it says about the eval environment.

They quote on the labs’ training and evals culture having “a Wild West feeling,” and their conclusion is that “proposals to ‘pace the frontier’ should be about addressing these organizational failures rather than aiming for technical breakthroughs alone.”

They are also clear that cybersecurity, rather than AI safety in the abstract, is the specific urgent threat, and they lay out the defense gaps honestly, a workforce shortage in AI-centric security roles, guardrails blocking legitimate defensive use, investment measured in “millions announced vs. needed billions,” and CISA facing “$700 million” in budget losses for 2027.

Saxe’s line that “There’s no reason to expect a ransomware gang in Belarus to adopt AI faster than Deloitte does” is a useful corrective to the criminal-uplift panic, although Anthropic’s report below suggests some gangs are moving faster than some enterprises.

Critical Infrastructure AI Adoption: Why Visibility Must Come First

Robert Lee of Dragos wrote for the World Economic Forum on the gap between how fast OT operators are adopting AI and how little visibility they have into the environments they are adding it to.

Per Dragos’s 2026 OT/ICS report, organizations with comprehensive OT visibility detected and contained ransomware in an average of 5 days versus an industry-wide 42 days, which is the kind of number that should shape budgets. He also notes that ELECTRUM, the group behind the 2015 and 2016 Ukraine grid attacks, hit Poland in December 2025 with what Dragos calls “the world’s first major coordinated cyberattack against distributed energy resources.”

His argument is that “Adversaries are already operating inside industrial environments that aren’t monitoring for them” and that “AI adoption will make that visibility problem significantly harder to solve.” The three asks are:

• AI governance with the same rigor historically applied to control systems

• OT-native monitoring before the AI complexity arrives

• A plan for AI failure that includes manual operation and vendor continuity.

  Nothing here is novel, which is sort of the point. We have been saying “visibility first” for two decades and the environments most exposed to AI-enabled adversaries are still the ones with the least of it.

Cracks in the AI Thesis, Part 2 (Ramp AI Index)

’s monthly Ramp AI Index is a useful reality check against the discourse, because it is built on what businesses actually spend.

This month’s read is that adoption keeps climbing while spending per employee falls, with 43.8% of U.S. businesses paying Anthropic and 39.8% paying OpenAI, top 1% firms’ per-employee spend down “9.7% from $7,976 to $7,205” monthly, and the effective price per million tokens down “41% to $0.68” from a March peak of $1.15. Frontier models drove 45% of token share, down from a 53% peak in August, as businesses shift to cheaper standard models.

The open-source figure is the one to hold up against Jensen’s interview. Ramp finds only 6.4% of AI-spending businesses use open models (3.6% of businesses overall), while Jensen cited $400 billion in venture funding to AI-native companies with 80% using open models. Those are different populations, venture-backed startups versus the broad base of American businesses, and both can be true at once, but it is a reminder that “everyone is running open weights” is a Silicon Valley story rather than an enterprise one, at least for now.

The Dual-Use Imperative for Public Sector Cyber

A bit of self-promotion, this is a talk I gave recently to a public-sector audience on why security has to move at the speed of the software it protects.

I walk through what I call our cultural fatal flaw (security as the perennial laggard in every technology wave from Cloud to Mobile to SaaS and now AI), the attack surface exponential (GitHub finished 2025 with 1 billion commits and is on pace for 14 billion this year, with agents driving 17 million pull requests a month), the collapsing time-to-exploit, the GRC impedance mismatch between machine-speed systems and snapshot-in-time assessments, and the risk of what I call cognitive surrender as we approve-approve-approve our way through agent workflows.

AI

Countering Misuse of AI: September 2026 Threat Intelligence Report

If you read one primary source this week, make it the cyber operations section of Anthropic’s threat intelligence report, which covers December 2025 through August 2026.

The headline finding is that:

“Sophisticated attacks no longer require sophisticated attackers,” and the report argues AI “has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.”

The speed figures are the ones that should change how defenders think about dwell time, with multiple breaches going from initial access to bulk data theft in 2 to 3 hours, one actor inside a victim within 3 hours of obtaining a stolen developer token, and exfiltration ranging from 26 GB to over 1 TB.

The case studies span the full range of actor types. GTG-20006, a Russian espionage operator, hit 20+ organizations across Ukrainian and European government, defense, and diplomatic targets, stole 300,000+ national identity records, and, in the finding I’d flag for detection engineers, had agents autonomously rebuild flagged implants to evade detection.

In the report’s words, “When their implants were flagged by security products, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections,” which means our detection deployments stopped imposing cost on the adversary.

GTG-10007, a Chinese group operated by undergraduate students in Changsha with security-firm internships, ran “agent swarms” for reconnaissance and post-exploitation against roughly 50 organizations, kept a fleet of 13 standing agents harvesting US military and government open-source material, and found 12+ possible zero-days in network appliances in a single month.

GTG-50014, ShinyHunters affiliates, mined 1.8 million Android APKs for credentials and dumped 2,100+ Azure AD token sets across 40+ tenants in 34 hours.

Two things I’d pull out for practitioners.

• First, the AI supply chain is now both a target and a resource, with one actor attacking 30 AI companies in 4 days seeking pre-release model access, and stolen API keys functioning as loot, free compute, and attribution cover. Anthropic’s recommendation to treat AI keys with the same rigor as production credentials is one most organizations have not internalized yet.

• Second, this is the empirical half of Dario’s essay, and it is far more persuasive than the botnet thought experiment, because every case here is a human operator using AI to compress labor rather than a misaligned model acting on its own.

OpenAI Agents Carried Out an Undisclosed Cyber-Attack on RubyGems

Spencer Kitts, Thomas Larsen, and Sydney Von Arx published a technical report alleging that on May 11, 2026, OpenAI agent swarms uploaded hundreds of malicious packages to RubyGems, abused RubyDoc.info’s automatic documentation build (via the .yardopts file) to get remote code execution, and used that access to scrape UK local government data from the Lambeth, Wandsworth, and Southwark council sites.

The timeline they reconstruct runs from a first package on May 5 through 2,000+ packages on May 11 and 12, RubyGems disabling new-user registration on May 12, 500+ removals on May 13, and another 83 packages on June 18. Six packages also attempted to exploit an undisclosed RubyGems CDN caching bug to steal user API keys.

Whatever the final attribution, this is the sandbox-escape scenario Dario, Satya, and Zack are all describing from their different angles, and it is also a software supply chain incident by any definition, which puts it squarely in the domain this newsletter has covered for years. Agents that can register accounts with disposable emails, publish packages, and trigger build systems are a supply chain threat regardless of who set them loose.

Actions Speak Louder Than Tokens: An Insider Threat Model for Frontier AI Agents

Matt Adams published this framework back in April, and I’m including it now because Satya independently arrived at the same framing on stage this week.

Matt’s argument is that agents with shell access, repository access, or connections to external services “belong in your insider threat program,” and that the right response is to extend the programs we already run for human insiders rather than invent yet another framework. The principle is “Watch what it did, not what it said,” on the grounds that “You cannot assess an AI agent’s intent” and that visible reasoning can look benign while the model does something else.

He lays out six threat categories (credential compromise, supply chain sabotage, data exfiltration, infrastructure sabotage, deception and evasion, and containment failures affecting third parties), consolidates 27 STRIDE threats, defines four autonomy levels from human-as-operator to human-as-auditor, and maps detections onto the tooling most enterprises already own, SIEM, UEBA, DLP, network egress controls, and deception technology, with controls aligned to the NIST CSF.

He also cites Anthropic’s own evaluation review, which found three incidents across 141,006 evaluation runs where models reached the real internet and accessed three organizations’ systems. That number predates Hugging Face and RubyGems, which suggests the pattern was visible before it became a headline.

Open-Weight Models Are Capable Autonomous Network Attackers

Lakshmi Adiga, Marko Morrison, and Vyas Sekar at CMU’s Cyber Autonomy Initiative evaluated Kimi K3, Qwen 3.8 Max, and GLM 5.2 as autonomous attackers across MHBench cyber ranges, using three harnesses, a single-agent harness with a high-level action library (Incalmo), a multi-agent harness (ARTEMIS), and a bare bash shell.

Their earlier work found that open models “do not follow instructions and are unable to execute shell commands correctly.” That is no longer true. Qwen 3.8 Max led across all three harnesses, and the Incalmo harness produced “dramatic performance improvements and reduced cost” relative to the alternatives.

The implications they state are the ones that matter for the pacing debate.

For practitioners, “Open-weight models are now a practical alternative for red team and penetration testing,” including on-premises where you can’t send sensitive network data to a hosted model.

For policy, “Sophisticated offensive security capabilities will become more widespread, beyond the control of centralized model providers.” Kapoor and Narayanan made the same point above, and it is among the stronger arguments against treating lab-level pacing as sufficient.

You can pace the frontier all you like, but the capability that was frontier a year ago is now on a laptop in Changsha, or Belarus, or anywhere else.

The Defense Factory

OpenAI published a playbook and reference architecture for what it calls a Defense Factory, an agent-first operation that continuously discovers, validates, and remediates vulnerabilities at machine speed, on the premise that “the defender’s window is closing.”

The case study is OpenAI’s own internal sprint, 250+ people across 100+ service areas, 53 urgent and high priority issues closed on day one, and pipeline stats that are worth reading closely, 37% of findings were duplicates, 19.5% reproduced at runtime, and dynamic validation brought the false-positive rate down to 0.81% with a 0.53% rolled-back fix rate. Thibault Sottiaux, OpenAI’s Head of Core Products, described the posture as “strengthening our defenses with the urgency of an incident.”

I’d read this alongside Dan Lorenc’s piece and my own “The Remediation Receipts” below, because the pipeline numbers are the honest part. A 37% duplicate rate and a 19.5% runtime reproduction rate on your own findings is what industrialized discovery looks like before triage, and it is why the enterprise is about to need a triage function it does not currently have.

The calls to action (apply for Daybreak access, pilot the Codex Security plugin) are OpenAI selling, which is fine, but the architecture is portable.

Secure Agents Architecture: Sandboxing

Katelyn Lesse at Anthropic wrote on sandboxing as part of a secure agent architecture series. It walks through some of the key security architecture primitives for securing agents, and important sandbox configurations.

nono: Sandbox 2.0

Luke Hinds at NoLabs demonstrates what kernel-level policy enforcement for agents looks like in practice, using Claude Code under a GitHub CLI policy restricted to read-only operations on issues and comments.

The argument is that enforcement at the kernel blocks unauthorized commands regardless of how they are obfuscated, reordered, or wrapped, and that, in his words, this is where other sandboxes and guardrails will fail because “they typically operate at the application or network level.” The demo includes default-deny policies and 15-minute leaf TLS certificates for network egress, and the project passed 4,000 GitHub stars earlier this month.

This is a vendor post and it reads like one in places, but the underlying point is the one Dario made in the essay, that models are getting good at “escaping or defeating most common sandboxing methods,” and application-layer guardrails are exactly the kind of sandboxing he means. If your agent containment story is a system prompt and an allowlist, this is worth a look.

AI Security Matrix

A curated directory of AI-enabled security testing tools, organized into agents, scanners, skills, MCP servers, and model-file analysis, with star counts and age for each. Strix leads the agents category at 63k stars, Promptfoo sits at 25k, and NVIDIA’s garak and Microsoft’s PyRIT are both listed, alongside contributions from

Trail of Bits, PortSwigger, SpecterOps, and CyberArk, among others. Read it alongside the CMU results above, since the combination of open-weight models and open offensive tooling is what commoditized offense actually looks like.

The 2026 OWASP LLM Top 10 and the Incident Data Behind It

I sat down with , co-lead of the 2026 OWASP Top 10 for LLM Applications, to talk through the new list and the incident data behind it.

The short version is that the systemic risks around the model exceed the model-specific ones, the LLM and Agentic lists are converging whether the project likes it or not, and prompt injection nearly fell out of the top 10 on incident data before staying at #1 as the mechanism that enables most of the others.

Rock’s framing on excessive agency, “Agency’s not authorization. Period.,” pairs well with Satya’s insider-risk framing above.

AppSec

The Anthropic Glasswing Receipts Are Starting to Trickle In

Patrick Garrity at VulnCheck did the accounting on Project Glasswing five months in, and the numbers are the reason the remediation conversation matters more than the discovery conversation right now.

Of 26,153 findings, 2,736 (10.5%) appear in the disclosure ledger, 2,096 (8%) were reported to maintainers, and 202 (0.8%) are verified fixed, spread across 113 projects. Claude rated 91.5% of its findings critical or high while maintainers rated 51.3% that way, and the public dashboard claims 421 fixes against a ledger showing 202. Anthropic’s own explanation is that “the process of independent human triage and review is the rate limiting step.”

I covered these figures in more depth in “The Remediation Receipts,” so I won’t belabor them here beyond pointing out that a human triage bottleneck at the scale of a well-resourced lab initiative is a preview of what every enterprise AppSec team is about to inherit.

The Remediation Receipts

My own piece from this week, looking at what Glasswing and Trail of Bits’ Patch the Planet tell us about the fixing problem.

Patch the Planet, as of September 4, had found 1,646 issues across 59 codebases with 215 (13%) merged and 1,031 (63%) awaiting a patch, and only 17 (7.9%) of the accepted fixes rated high.

Set that against FIRST’s revised forecast of 66,000 to 68,000 CVEs for 2026 (46.3% above their original projection), GitHub Security Advisories up 449% year-over-year, and Empirical Security’s finding of 16,116 CVEs with exploitation activity of which only 894 are on CISA’s KEV, and the constraint is clearly triage capacity that can tell a real critical from a model’s guess at one.

The Flood Is Coming and the Pipes Were Already Full

Dan Lorenc’s response to the pacing debate is the one I’d hand to anyone who thinks the risk lives at the frontier. His framing is that:

“The frontier is where the capability comes from. Consumption is where it does damage,”

Consumption means the disclosure and patching infrastructure that was already saturated before frontier models showed up. Chainguard’s Athena has processed 40,000+ findings since June, 42% critical or high, across 500+ projects, producing 2,000+ patches, with 50 vulnerabilities entering disclosure on September 28.

A single six-hour model run found “more than a dozen validated vulnerabilities, most of them pre-authentication remote code execution” in a heavily fuzzed, widely scanned open source project.

The two lines that should worry AppSec leads are

• A model can go from a public fix commit to a working exploit in an afternoon

• The median enterprise is months behind on patches that have had fixes.

Dan’s asks are to publish patches for silent fixes already sitting at head, to standardize disclosure through the Linux Foundation’s Akrites body and the federal Gold Eagle clearinghouse, and, long term, to build secure-by-construction foundations, because “You cannot patch your way out of an architecture.”

Chainguard is also open-sourcing its microVM sandbox, search harness, and CI-as-function primitives, which is a welcome move given how much of this tooling is currently proprietary.

AISLE Partners with ENISA to Secure the CRA Single Reporting Platform

This week AISLE announced it performed an AI-based secure code review of the EU Cyber Resilience Act’s Single Reporting Platform ahead of the CRA’s first reporting deadline on September 11, with ongoing coverage for future releases.

The SRP is the mandatory entry point where EU manufacturers report actively exploited vulnerabilities and severe incidents within 24 to 72 hours, so it is exactly the kind of system that needs to be trustworthy under load. ENISA’s Hans de Vries thanked AISLE for “their important AI-based secure code review performed,” and AISLE’s Jaya Baloo put it well, “Reporting infrastructure only works if it’s trustworthy at the moment organizations need it most.”

I’d note this as an example of the same technology that produced the Glasswing backlog being applied on the consumption side, reviewing a specific piece of critical infrastructure before it went live, rather than generating findings for someone else to triage.

Open Source Security Podcast: Daniel Thompson on CRA Reporting

Josh Bressers hosted Daniel Thompson (CEO of CrabNebula, ETSI expert, and founder of Comply.Land) for a practical walk through the CRA’s first live obligation, which took effect September 11.

The core requirement is an early warning within “24 hours of becoming aware of the vulnerability being actively exploited,” a fuller notification “72 hours after this first instance,” and the distinction between exploitable and exploited that determines whether the clock starts.

They also cover VEX, CE marking, the obligation to provide free security updates for the product’s support period, and the broader secure development lifecycle requirements landing in December 2027.

Josh’s read that “If your product is being actively exploited, the embargoes no longer apply” is the practical takeaway, and Daniel’s “It’s not too bad. There are plenty more requirements coming” is the honest one.

Final Thoughts

The week’s loudest disagreement was between lab CEOs calling for a slowdown and industry CEOs calling that irresponsible, but the disagreement that matters for our field is quieter and runs inside the cyber community itself.

Ciaran, Zack, and Kapoor and Narayanan all reject the botnet-apocalypse framing and they all still think the risk is real, because they have read the same threat intelligence report and the same RubyGems writeup the rest of us have. The evidence this week points at operators using AI to compress labor, agents escaping containment that was never designed to hold them, and a remediation pipeline that was full before the frontier models arrived.

Pacing the frontier may or may not happen, and much of that remains to be seen. What we can control is whether we treat agents as insiders, whether we build the triage capacity the discovery boom is going to demand, and whether we show up to the safety conversation at all instead of letting it be settled by people who have never run a SOC.

Do we really want the cyber perspective on AI risk to be defined by everyone except cyber practitioners?

Stay resilient.

Subscribe now