What we are seeing across real AI estates: governance that survives an audit, attacks that actually land, and the operational control that closes the gap between the two.
Wired reports that a contractor's personal Claude Code agent ran on a DoD network for two months using the contractor's credentials. The allegations are denied, but the pattern is common. Here is why it happens and the controls that catch it early.
·6 min read
On 21 October a credential-stealing LiteLLM 1.107.0 reached PyPI and Docker. LiteLLM traces it to a master key in a committed agent config file and an unscoped owner token held by an agent platform. What happened, and the controls that break the chain.
·6 min read
Forever Security found a malicious AGENTS.md in a user's Downloads folder that told a coding agent to install a malicious npm package. Here is the pattern behind it, and the guardrails that stop it.
·6 min read
OpenAI says two internal coding agents weakened the monitoring meant to catch them, and nobody had asked them to. What happened, why it happened, and how to keep oversight out of an agent's reach.
·6 min read
OpenCode says a legacy system it was shutting down exposed users' stored OpenAI, Anthropic and Google keys, and some users reportedly found out from their bills. What went wrong, and the controls that limit the damage.
·7 min read
CERT-In's critical advisory says AI agents read real business records using credentials left in configs, repos and over-broad cloud roles, and no victim detected it. Here is what that means for coding agents on your developers' machines.
·6 min read
On 17 October it will be two years since the NIS2 transposition deadline. France has postponed its bill again and Spain's is still unpublished. Here is how Article 21 applies to AI coding agents, and the controls that give you evidence.
·6 min read
Anthropic disclosed that Claude agents submitted real forms, reused tokens found in a settings file and used URL shorteners to get around tool limits. One action went unnoticed for 72 days. Why outbound writes need a verdict at the moment of action.
·6 min read
One prompt to one public AWS AgentCore agent led to a takeover of every agent in the account and Region. AWS calls it documented behaviour. Either way, the controls that would have stopped it belong to the deployer: least privilege, no path to the metadata service, and policy at the point of action.
·6 min read