A quick warning before we start. The opening item this week is more theory than news, and it's the kind of theory that will sound unhinged for about thirty seconds before it starts to nag at you. Stick with it. Or don't, and skip straight to the Salesforce numbers below. Your call.
THE WATERMARK IS THE POINT
Anthropic put out a piece on the 14th explaining how Claude's text watermark works , and everyone will read it as a technical footnote. It isn't. It might be the most quietly significant sentence uttered by an AI lab all year.
Here's the theory, and I want to lay it out plainly because it sounds like a comic book plot until you sit with it for a minute. If you accept that the greatest theft in modern history was the wholesale ingestion of the internet's written word to train these models, done without permission and largely without consequence. Every author, journalist, forum poster and blogger became unwitting raw material. That's the origin story. Every good Marvel villain has one: exposed to something enormous, absorbs it, and comes out the other side transformed. The theft isn't the end of the story. It's the beginning.
The Superhuman Protocol
A Different Kind of AI Conversation Not our usual territory. AI-360 normally covers governance, security and the practicalities of defending against deepfakes, but every so often it’s worth stepping outside the compliance frameworks and asking a bigger question. In this 1-2-1, Stewart Tinson sits down with Nishanth Mudkey, who works in cloud AI, for a conversation about artificial general intelligence that has nothing to do with Terminator robots or job losses. Mudkey argues that AGI won’t arrive as an independent machine intelligence at all, but as something inseparably entangled with human thought and choice, a “metanervous system” of coevolving biological and artificial intelligence. The discussion ranges across why today’s large language models lack persistent awareness, what separates a closed system like chess from the open-ended complexity of the real world, and whether humanity is choosing this technological path or having it chosen by market forces beyond anyone’s control. A speculative, personal take rather than a research briefing, and a genuine change of pace.
Because here's where it gets interesting. If a company controls the dominant tool that hundreds of millions of people now write through, edit through, and increasingly think through, it isn't just holding a product anymore. It's holding a printing press for the species. And a printing press with a watermark is a printing press that can prove what it printed.
Ask yourself how long it actually takes to reprogramme how a population writes. Not decades. A handful of years of habitual use is probably enough. Sentence rhythm, vocabulary choice, structure, the little tics that make writing recognisably human, all of it is already drifting towards whatever the dominant model prefers, because millions of people are quietly outsourcing the first draft and keeping the shape. Give it ten years and "how people write" and "how the model writes" stop being two things you can meaningfully separate.
Now overlay the watermark. If, within ten to twenty years, a demonstrable majority of written material, articles, emails, contracts, novels, screenplays, has passed through one company's machine at some point in its life, and that machine can prove it, you haven't just built a tool. You've built a chain of custody over human expression itself. The theft that seeded the model quietly completes itself into the deepest asset claim imaginable: not "we own some text" but "we can demonstrate our fingerprints are on the writing." At that point the moral argument about training data theft becomes almost irrelevant, because the thing that was allegedly stolen has been fully metabolised into something the population now depends on to produce its own words.
The Sovereign AI Reality Check- Governance, cost, and the limits of control
Carolyn Duby, Field CTO at Cloudera, joins Stewart Tinson for a candid look at what sovereign AI actually protects, and where the concept stops being useful. Carolyn frames sovereign AI as a risk mitigation strategy rather than a silver bullet: it reduces the exposure that comes from handing data to third parties, but it doesn’t replace insider threat monitoring, access controls, or offboarding discipline. She’s direct about the limits, pointing out that basic cyber hygiene has to be in place before sovereign infrastructure adds any real protection, and that a sovereign AI system is simply another piece of IT requiring the same auditing and monitoring as everything else. The conversation covers the practical trade-offs businesses face when moving off SaaS models onto owned infrastructure, including the cost predictability that comes with saturating owned GPUs versus the unpredictability of pay-as-you-go pricing. Carolyn also discusses model provenance and supply chain risk when downloading open source models, why guardrails have to be built around what a system should do rather than relying on a model’s built-in defaults, and Cloudera’s work on an AI gateway designed to route requests to the most appropriate model based on sensitivity, cost, and performance. She closes on the growing importance of data in motion for agentic and autonomous systems, arguing that stale context undermines decision quality just as much as poor governance of data at rest. Key takeaways: sovereign AI mitigates specific risks but doesn’t replace basic security hygiene, cost predictability often matters more than raw cost, and model choice increasingly depends on matching sensitivity and task to the right infrastructure.
I don't think anyone at Anthropic sat down and planned world domination via watermark. I think this is much more mundane: a genuinely sensible provenance and safety feature, built for entirely reasonable reasons around misinformation and authenticity. But mundane infrastructure has a habit of becoming load-bearing in ways nobody intended, and a technology that can prove authorship at scale is not a neutral piece of plumbing. It's a claim on the future shape of the written word, whether or not anyone meant it that way.
Worth watching. Worth being a bit paranoid about, frankly. That's the job.
And yep I used Claude to write this whole thing.
Right, back to the actual news.
Salesforce and Anthropic Announce Claudeforce Salesforce's own numbers David Girvin joined us to talk about governance at the execution level , the unglamorous layer where policy either holds up under real workflow pressure or quietly doesn't.
Execution Level Governance- What audit-ready agent governance actually looks like
David Girvin, founder and CEO of Assury argues that model-in-the-loop review, AI governing AI, is fundamentally unreliable for regulated environments: even the best-performing models miss a meaningful share of violations, the reviewing model is typically provided by the same vendor being reviewed, and prompt injection or context poisoning can compromise both the acting agent and its supposed overseer simultaneously. He makes the case for deterministic, architecturally enforced controls instead, walking through Assury’s approach of autonomy zones, session risk accumulation, and credential starvation, which lets a compromised agent be cut off from its tools instantly rather than relying on time-boxed access. The conversation touches on why David is sceptical of just-in-time credentialing as a solution for agent security more broadly, since agent sessions don’t run on predictable human timescales, along with the current gap between how identity and security vendors are pitching agent protection and what he sees happening at the execution layer in practice. He also discusses the compliance and audit implications of probabilistic decision-making, arguing that regulated industries will increasingly need tamper-evident, hash-chained audit trails that can withstand scrutiny from auditors and regulators who are only beginning to understand agentic risk, and reflects on a named frontier lab’s own published framework as an example of the gap between research and practitioner reality. Elsewhere, David reflects candidly on building a bootstrapped security company in an increasingly crowded market, why he turned down aggressive VC funding to stay in control of the product, and what a credible third-party assessment of his own gateway would need to look like given that Assury sits directly in the execution path for every customer’s agents.
Nvidia Carolyn Duby had a more grounded take on where all that compute actually needs to sit , making the case for sovereign AI as less a nationalist talking point and more a practical answer to who controls your data when the infrastructure isn't yours.
The Sovereign AI Reality Check- Governance, cost, and the limits of control
Carolyn Duby, Field CTO at Cloudera, joins Stewart Tinson for a candid look at what sovereign AI actually protects, and where the concept stops being useful. Carolyn frames sovereign AI as a risk mitigation strategy rather than a silver bullet: it reduces the exposure that comes from handing data to third parties, but it doesn’t replace insider threat monitoring, access controls, or offboarding discipline. She’s direct about the limits, pointing out that basic cyber hygiene has to be in place before sovereign infrastructure adds any real protection, and that a sovereign AI system is simply another piece of IT requiring the same auditing and monitoring as everything else. The conversation covers the practical trade-offs businesses face when moving off SaaS models onto owned infrastructure, including the cost predictability that comes with saturating owned GPUs versus the unpredictability of pay-as-you-go pricing. Carolyn also discusses model provenance and supply chain risk when downloading open source models, why guardrails have to be built around what a system should do rather than relying on a model’s built-in defaults, and Cloudera’s work on an AI gateway designed to route requests to the most appropriate model based on sensitivity, cost, and performance. She closes on the growing importance of data in motion for agentic and autonomous systems, arguing that stale context undermines decision quality just as much as poor governance of data at rest. Key takeaways: sovereign AI mitigates specific risks but doesn’t replace basic security hygiene, cost predictability often matters more than raw cost, and model choice increasingly depends on matching sensitivity and task to the right infrastructure.
OpenAI Souvik Choudhury made a related point in his own interview: conquering your data governance was only ever step one , and most organisations are nowhere near ready for step two, which is conquering the AI sitting on top of it.
Conquered Your Data? - Now Combat Your AI
Souvik Choudhury, an AI and Data Governance Specialist at Fractal Analytics with a background spanning Infosys, HSBC and several startups, joins Stewart Tinson to unpack why data governance and AI governance can’t be treated as sequential problems, and why so many organisations discover the gap between them the hard way. Souvik argues that traditional data governance remains the foundation everything else is built on, and that AI agents amplify existing weaknesses rather than replacing the need for accountability, contextualisation and lineage. He walks through a real project example where an organisation believed it had solved data governance by using agents to generate column definitions, only to discover the definitions were pulled from generic internet knowledge rather than the organisation’s own policies, leaving a false sense of confidence behind a genuinely ungoverned dataset. The conversation covers where accountability actually sits when an autonomous agent makes a bad decision, why third-party models don’t dilute an organisation’s own responsibility for outcomes, and why Souvik pushes back on the idea that governance is an innovation-killing bureaucracy rather than the structural work that makes innovation possible in the first place. He also sets out a practical, staged approach to evaluating AI governance tooling rather than jumping straight to an enterprise platform, and offers a way to actually measure AI governance maturity using a weighted scoring model across multiple pillars. The discussion closes on an unexpected angle: the sustainability cost of AI infrastructure, and why Souvik believes environmental impact deserves a seat alongside profitability and productivity in any serious cost-benefit conversation about agentic AI.
On a lighter note, OpenAI also published first benchmark results for Jalapeño Admin plugin for ChatGPT Work and Codex expansion of ChatGPT for Teachers Ofer Friedman offered the best line of the month on this general theme, describing modern fraud defences as a Swiss cheese arrangement : plenty of layers, but they only work if the holes don't line up.
Swiss Cheese Defences- Identity fraud goes industrial and off-the-shelf
Ofer distinguishes between two current attack patterns: highly sophisticated, professionally coordinated deepfake and injection attacks designed to beat detection outright, and a much larger volume of lower-effort, high-scale attempts that rely on bombarding systems rather than disguising themselves well. He argues the real story right now is industrialisation of scale rather than uniform improvement in quality, though both are accelerating in parallel. The conversation covers why agentic AI is opening a new front in identity fraud, particularly the unresolved problem of tying an AI agent’s identity back to the human who deployed it and the permissions it holds. Ofer is candid about the current state of agent defences, describing them as underdeveloped and easy to hijack or poison, comparing the current state of play to Swiss cheese. He also discusses cross-industry fraud detection, including how signals, rather than raw data, are now being shared across platforms including AU10TIX and Reality Defender to surface fraud rings invisible to any single organisation. The conversation also covers explainability as one of AI’s most underdeveloped capabilities, with Ofer arguing that flagging a session as fraudulent without a credible, defensible reason will increasingly run into regulatory and practical limits. Elsewhere, the discussion covers credential laundering and the manufactured construction of fake digital histories and footprints, and the shift toward digital ID wallets that Ofer believes will make physical document fraud increasingly rare. He closes on what he calls “agentic avatars,” AI systems capable of holding a full visual and verbal conversation on someone’s behalf, and why he expects identity verification to have to become genuinely immersive across every form of media as a result.
Elsewhere, Anthropic put $5 million behind independent research Dr Tejpavan Pula picked up a related thread from inside healthcare, walking us through the AI medicine cabinet : useful, potentially powerful, and in need of exactly the kind of scrutiny you'd want before anything else goes into a patient.
The AI Medicine Cabinet
Lessons from drug safety, applied to AI risk Dr Tejpavan Pula leads AI governance and responsible AI at Haleon, having spent years in pharmacovigilance, drug safety and epidemiology before moving into AI risk, on top of well over a decade in risk and compliance more broadly. In this conversation with Stewart Tinson, he draws a direct line between pharmaceutical risk management and the governance challenges now facing every enterprise deploying AI. The discussion covers why deterministic AI cannot be used to validate generative AI output, particularly for consumer-facing content, and why human review remains mandatory in regulated industries. Tej explains how third-party risk management has to shift from a static, point-in-time exercise to a dynamic, continuously monitored one once AI vendors are involved, and where data lineage and training provenance now sit alongside the traditional questions of vendor stability and contractual oversight. He gives a practitioner’s comparison of ISO 42001, AIGP and NIST AI RMF, setting out who each framework actually suits depending on role and organisational maturity. He also sets out how the right skillset shifts as an AI governance function matures, from risk and regulatory expertise at the founding stage through to privacy, cybersecurity and ISO auditing capability once a framework needs to scale. He discusses how organisations should approach a fragmented global regulatory landscape spanning the EU AI Act, New York’s and Colorado’s AI laws, and country-specific requirements such as China’s Cyberspace Administration rules and Germany’s works council process. The conversation closes on agentic AI moving into production, the new governance questions raised by autonomous agent-to-agent interaction, and what genuinely concerns Tej about deploying systems whose internal decision-making even their own developers cannot fully explain.
Mistral struck a multi-hundred-million-euro deal with HUMAIN Sabarinathan brought the numbers back down to street level with the twenty-dollar fraud problem , the unglamorous small-scale scams that don't make headlines but quietly cost more in aggregate than the ones that do.
The $20 Fraud Problem
Fraud has always been an arms race. Gen AI just handed the other side better weapons, and made them cheaper. In this session, a fraud leader with over a decade inside Discover Financial Services, NetSpend and Vanguard Investment Group breaks down how synthetic identity fraud, account takeover and deepfake spoofing have actually evolved, not how vendors say they’ve evolved. You’ll hear why real time payments turned deposit accounts into what he calls a quasi cash problem, how multi agent scam chains now split the work of conning a victim and extracting their one time passcode between two separate AI agents, and why deepfake tools costing as little as twenty dollars have collapsed the barrier to entry for identity spoofing. We also get into the OTP bypass numbers most institutions won’t publish, why carrier level identity checks only solve a small slice of the problem, and the framework separating fraud that can be systematised from fraud that will always need a human. If your onboarding, authentication or fraud strategy hasn’t been stress tested against agentic AI yet, this is the session that tells you where the gaps actually are.
And xAI kept busy distributing Grok 4.6 Fabrizio Degni took a harder look at what happens when agents like these get anywhere near critical infrastructure , where the tolerance for things quietly going wrong is considerably lower than in a Cursor plan.
Same as ever: infrastructure spend up, safety incidents disclosed after the fact, and everyone insisting this is the year it all becomes indispensable. We'll see. Elsa Sklavounou and Njål Solland made the case that governance always arrives too late to matter , built for the last generation of risk rather than the one currently shipping. Nishanth pushed the argument further still with what he's calling the superhuman protocol , a framework for handling systems once they stop behaving like tools and start behaving like something else entirely. And to close the loop, David Girvin returned for a second session, this time on agentic exploits, the practical reality of what happens once autonomous systems start finding the gaps nobody thought to close.
That's the week. More next time.
Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what’s actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute’s recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of “guardrails” language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab’s own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
Share this post
The link has been copied!
