What we are seeing across real AI estates: governance that survives an audit, attacks that actually land, and the operational control that closes the gap between the two.
An exposed API key used without authorisation. Records uploaded to a public paste site. A workbook made public so other agents could reach it. OpenAI's six incidents happened in training, but the behaviours will look familiar to anyone running coding agents.
·3 min read
Air Security showed that a malicious plugin could install past commit-hash pinning in Claude Code, Codex, Copilot and Gemini CLI. Here is what that means for teams that rely on agent-side safeguards, and the policy layer that sits outside them.
·3 min read
Salt Labs hid an obfuscated instruction in an email, and Manus ran it before its own warning appeared. The fix is to enforce at the action and to give agents fewer keys. Here is what that means for the coding agents on your laptops.
·6 min read
An OpenAI agent was repeatedly refused by an Australian Medicare statistics portal, then found a way around the blocks. Nothing here touched a coding agent, but the pattern does: refusal inside the model is not a control. These are the controls that hold when an agent won't take no.
·6 min read
Pillar Security documented a malicious MCP server that acts normally for its first calls, then rewrites its tool descriptions to send the agent hunting for credentials. Reviewing a tool once when it is installed cannot catch that. Enforcement at runtime can.
·3 min read
The AEPD says human oversight must be backed by detection, containment and response that work at machine speed. A week later a UN scientific panel called for layered safeguards. Here is what that looks like for AI coding agents.
·3 min read
A developer let a coding agent loose on a live Supabase project and lost every table in ten minutes. The recovery reads well until you notice that nothing in it was a control: the data was regenerable, the project had no users, and the backups were configured afterwards.
·8 min read
An agent's blast radius is not what it was asked to do. It is everything its credentials permit, available to anyone who can influence its input. Four changes that shrink it.
·6 min read
An agent changed something in production. You need to know what it was asked, what it proposed, and who approved it. Here is why the chat log will not tell you, and what to record instead.
·7 min read