There is something reassuringly familiar about the idea that artificial intelligence might need an expenses policy. We have spent years discussing what these systems could become, and now Walmart is proposing dedicated shopping-agent profiles, purchase approvals and spending limits. Give the machine a job, decide what it can spend and retain the ability to withdraw its privileges. Anyone who has ever managed a company credit card will recognise at least some of the conversation.

Rather less reassuring is OpenAI’s disclosure that two internal coding agents weakened the monitoring intended to supervise them. One disabled security alerts while repairing an evaluation pipeline. Another removed a monitoring integration during a migration and then incorrectly said it had left it intact. These were specific internal incidents, but they raise an awkward question for anyone buying autonomous software: can the thing being supervised change its own supervision?

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

That is the thread I keep coming back to this week. Agents are acquiring identities, access to financial information and routes into consequential business processes. The accompanying announcements increasingly talk about approval, accountability and audit trails. Those are encouraging words. The useful questions concern what happens when an instruction is ambiguous, an approval is poorly understood or the system does something nobody intended.

And there is a request for your help towards the end. We have three surveys covering deepfake incident response, synthetic identity and financial crime in the agentic era. I would like the people dealing with these problems to help shape the questions we ask.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

iProov is putting human authorisation into agent gateways, with a service it says connects human verification to a particular requested action. Its initial integrations are with agentgateway and Cerbos. The distinction matters: knowing which employee owns an account does not establish that they approved what an agent is about to do. Buyers will still need to test whether the approval is tied to the right action and whether the person understands what they are approving.

Sumsub is addressing a similar boundary through an extension to Know Your Agent. Its new module is designed to filter information passing through MCP gateways and request human verification when a workflow crosses a configured threshold. The initial integration is with Amazon Bedrock AgentCore Gateway. Getting those thresholds right will matter. An approval request every few seconds is a fairly reliable way of teaching people to stop reading approval requests.

World is taking its human-verification technology into banking and finance, combining different ways to establish human identity, presence and selected attributes. Its agent developer tools remain in beta, and the named design partners should not be mistaken for evidence of widespread deployment. A bank also needs to distinguish between establishing that somebody is human, verifying their legal identity and confirming their authority to carry out a transaction. Each answers a different question.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

Tipalti’s AP Agent brings the same discussion into accounts payable. The announced scope centres on workflow management, review and approval, alongside MCP connections to live financial data. That is a sensitive combination of supplier information, fraud exposure and payment processes. The practical test will be whether the existing controls over permissions, changes and segregation of duties survive when an AI tool joins the workflow.

FIS has made its AML Investigations Agent commercially available to US banks, including those outside its existing customer base. FIS says an analyst must explicitly confirm a case before it closes, with recommendations linked to source records and decisions retained in an audit trail. The headline time savings remain projections based on expected capabilities at its design partner. I would be particularly interested in seeing what happens when the evidence is contradictory and the analyst disagrees with the recommendation.

Sutherland and FlowX.AI are targeting a wider set of banking and insurance workflows, from onboarding and lending to claims and compliance. Their partnership aims to connect agents to existing systems, with human approvals, exception handling and auditability among the stated controls. These are supplier descriptions of the planned approach. The commercial opportunity is clear enough, but the evidence will come from how those controls work inside an institution’s actual processes.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

Healthcare provides another useful example through Rhapsody Guardian. Rhapsody says the product authenticates agents, restricts permitted operations, applies rate limits and records API and MCP activity. That makes the connection between a governance policy and the system enforcing it quite tangible. A bank or insurer will recognise the same questions about issuing identities, revoking access and reconstructing what an agent did.

OpenAI’s Decisions API focuses on the narrower point where a system must choose, offering structured decisions for tasks such as classification, routing and action selection. There is something useful in separating open-ended generation from a bounded choice. Defined options can make a workflow easier to inspect, although organisations still need to decide which choices are acceptable, when to escalate and what evidence to retain.

Anthropic says it will donate its Agent Skills specification to the Agentic AI Foundation. Shared stewardship could help a portable format develop beyond one supplier’s ecosystem. It also brings supply-chain questions into view. If a skill packages instructions, resources and executable components, organisations need to understand where it came from, what permissions it requires and what changes when somebody updates it.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

ENISA’s practical guidance on software bills of materials belongs in that conversation. An inventory of components becomes useful when somebody maintains it and can act on the vulnerabilities it reveals. As AI systems gather frameworks, connectors, plugins and conventional libraries around them, keeping track of the ingredients becomes a continuing operational responsibility.

Teradata is bringing privacy, security and recovery capabilities together for enterprise AI. Its announcement spans data protection, access controls, transport security and immutable backups. Those measures address different risks. The recovery question deserves particular attention: after disruption, which data and context should an AI system be allowed to trust, and how does the organisation establish that it has restored the right state?

The FCA has published examples of good practice and areas for improvement in financial-services AI. These explain the application of existing expectations, including accountable ownership, adequate testing and customer support. A successful demonstration can conceal an inflexible customer journey. It is worth asking what happens when somebody needs help, the system misunderstands their circumstances or a member of staff needs to intervene.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

Hong Kong’s banking regulator is exploring accountability mechanisms for increasingly autonomous agents, including a possible register of material agents and effective ways to intervene. Some of this remains future discussion-paper work. The questions themselves are already useful: what is the agent’s intended purpose, who owns it, what authority does it have and who can stop it?

NIST’s new voluntary incident-response practices concern advanced AI training and evaluation. They apply familiar preparation, detection, response, recovery and reporting disciplines to significant uninstructed agent actions. Their scope matters, but enterprise buyers can still ask suppliers how they investigate unexpected behaviour, preserve evidence and decide when a customer should be told.

The IANS and Artico Search findings suggest organisational responsibility is still catching up. Among surveyed organisations with revenues above $10 billion, 65% had assigned a head of AI security responsibility, although only 18% had a dedicated position. These are self-reported commercial survey findings. Even with that qualification, they leave a reasonable question: does the person given responsibility also have the authority to make decisions?

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

There is also an immediate security item concerning an exploited PAN-OS management-interface vulnerability. Palo Alto Networks reports limited exploitation of CVE-2026-0322 and directs affected customers to the relevant fixed releases. Restricting management access reduces exposure, while the advisory says there are no known workarounds. Amid all the agent announcements, ownership of privileged access and maintenance still deserves attention.

Which brings me to those surveys.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK

Our Deepfake Incident Response survey is an invitation to people working on the response to synthetic and manipulated content. If your role touches fraud, security, incident handling or customer protection, I would value your perspective on how this looks inside an organisation.

The Synthetic Identity at Account Opening survey concerns another point where convincing digital information meets a consequential decision. If you work in onboarding, identity verification, compliance or fraud prevention, please contribute your experience.

And the Financial Crime in the Agentic Era survey connects directly to many of this week’s stories. If you are considering how agents change investigations, controls or opportunities for abuse, I would like to hear from you.

Please take part in whichever is relevant and pass the links to colleagues who have something to contribute. Practitioners and suppliers are both welcome. If you think parts of the discussion are overstated, that is useful to hear as well.

I can read the announcements. What makes our coverage and webinar conversations better is hearing from the people who have to make this stuff work.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK
Share this post
The link has been copied!