Anyone for Tea?

Five minutes is about enough time to make a cup of tea. In one incident Microsoft investigated, it was enough time for an AI-assisted attack to go from looking for an exposed credential to stealing cloud data. OpenAI says its Control Room can cut off model output for a stopped research job within 35 seconds. Those are two very different clocks. Both make me want to ask what happens between somebody spotting a problem and the system actually stopping.

That question feels worth asking after IBM’s UK sovereignty survey. Some 84% of UK respondents were confident they could show accountability for their AI systems. Just 27% said they’d demonstrated it through testing, audit or another form of review. Meanwhile, the two uses of AI I most wanted to read about this week involve getting investment data into the right format and checking export paperwork before someone sends it. In both cases you can see what the system is there to do and where people still have to exercise judgement.

Execution Level Governance- What audit-ready agent governance actually looks like

David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.

BrightTALK

Two jobs worth automating

Northern Trust puts a number on onboarding data prep. Northern Trust and Microsoft say an agent cut the time needed to prepare institutional clients’ historical transaction data from about two and a half weeks to three days. The 96.5% first-pass F1 score came from seven controlled test cases. Analysts review the output and handle exceptions before clients go live. I’d like to hear how much of the three days they spend on the cases the agent finds difficult.

Lloyds checks the paperwork that holds up letters of credit. Export Assist flags discrepancies before exporters submit their documents. Lloyds is making it available to UK exporters whether or not they bank with the group. A typo can hold up a payment. Catching it before the paperwork goes in is a job worth doing, and the bank’s usual financing and payment controls still apply.

Execution Level Governance- What audit-ready agent governance actually looks like

David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.

BrightTALK

What agents can reach

IBM extends Vault into the working life of an agent. IBM says its work with AuthMind will help teams trace who authorised an agent and see how it uses credentials after they leave Vault. I’d want to see what happens when an agent starts a legitimate job and then tries to reach data it has no business touching.

Nvidia takes agent security into South Korean enterprise work. Hyundai Motor Group is exploring Nvidia’s agent runtime, and AIM Intelligence is integrating it with its own security controls. AIM is also considering a proof of concept in the public-energy sector. That last bit is still at the proposal stage.

OpenAI puts a stop control in the path of research workloads. OpenAI says it can enforce a stop at the point where a research job asks the model for another response. Covered workloads also lose access to inference if the control service goes down. I’d ask the same question of any company buying a system with a stop button. What exactly stops when you press it?

Execution Level Governance- What audit-ready agent governance actually looks like

David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.

BrightTALK

Microsoft shows a backdoor can survive model evaluations. Researchers altered fewer than ten neurons and the model still passed its evaluations. Microsoft describes a lab finding and says it has seen no use of the technique by threat actors. It gives buyers another reason to ask where their model came from and what happens when someone changes it.

Microsoft reports five minutes to cloud data theft in one case. This one was an observed incident. Microsoft timed it from the search for exposed credentials. If your response to an exposed key relies on somebody reading a ticket and finding its owner, five minutes is an awkward number.

Cloudflare tests private authorisation for a post-quantum web. Its research asks whether a site can verify that a trusted issuer has vouched for a client while keeping the issuer private. It’s early work, with a practical question behind it. How much does a website need to know about an agent before letting it through?

Execution Level Governance- What audit-ready agent governance actually looks like

David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.

BrightTALK

What counts as evidence

IBM finds a gap between confidence and proof in the UK. One detail in the vendor-sponsored survey caught my eye. Among UK respondents who had faced a sovereignty challenge, 53% said gathering evidence manually or slowly made it harder to demonstrate control. It’s worth asking who would have to pull those records together in your organisation.

The EU and Japan put frontier AI on the financial cyber agenda. Their financial regulators discussed how frontier AI is changing cyber threats alongside the use of AI within financial firms. The joint statement records a supervisory discussion. For a bank, it’s a reason to get the people running AI governance and cyber resilience in the same room.

The Paris declaration calls for comparable frontier AI tests. Signatories want to publish non-sensitive evaluation findings in a common format and improve how serious incidents are classified and shared. I’ll be interested to see whether two labs can publish results that let a buyer make a meaningful comparison.

Execution Level Governance- What audit-ready agent governance actually looks like

David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.

BrightTALK

Selling agents and selling shares

OpenAI gives eligible US businesses a labelled agent in ChatGPT. In the beta, a shopper can choose to start a separate conversation with a participating business’s agent. The label tells you who you’re talking to. I’d also want to know what happens when the agent gives you the wrong answer about a return or refund.

Salesforce says Agentforce Coworker usage grew 21-fold in three months. The company is expanding Coworker across workplace tools and says it has more than 185,000 users. I’d like to see one customer take a single task and tell us how often it’s completed, how often somebody has to step in and what the whole thing costs.

IBM and Microsoft launch Imagine Enterprise. IBM says it brings more than 6,000 prebuilt agents and other assets to the joint platform, which starts with financial services, insurance and retail. I’d ask for one example a bank can use and a straight answer on how much work it takes to fit it to the bank’s own permissions and processes.

Execution Level Governance- What audit-ready agent governance actually looks like

David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.

BrightTALK

Anthropic launches its IPO roadshow. The company is proposing an offering of 825 million shares at an indicative $70 to $78 apiece and has applied to list on Nasdaq as ANT. The preliminary prospectus is where I’d spend my time. It gives customers and competitors a chance to read what Anthropic itself tells prospective shareholders about the business.

If you’ve put an agent into a regulated workflow, I’d like to hear where you drew the line on what it could do. If somebody has already had to step in, I’d be even more interested in what happened next. That’s the conversation I’d like to have on Research Notes.

Execution Level Governance- What audit-ready agent governance actually looks like

David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury's approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don't run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab's own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer's agents.

BrightTALK