Who Stops It?

If I’m in my bank’s app trying to sort out a payment I don’t recognise, I’d quite like to speak to a person. And I’d prefer to tell the story once. That’s what caught my eye about Bankwest’s AI-assisted chat. Microsoft says the member of staff who takes over gets the conversation and a summary, so they can pick up where the customer left off. Anyone who’s typed the same explanation three times will see the appeal.

I had a rather different reaction to the FCA’s findings from wholesale banks. In one case, inaccurate AI-generated code recommendations made it through human review and led to a loss of service. Somebody had the job of checking the output. I’d like to know what they had in front of them when they did it.

Which brings me to CrowdStrike’s agent kill switch and the UK’s plans for incidents where operators lose control of an agent. Here’s the drill I’d like to watch. An agent starts changing records it shouldn’t touch. Who spots it, who can stop it, and how do they work out which changes to undo?

Agentic Exploits- Deterministic gates for a probabilistic problem

David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.

BrightTALK

When someone needs to step in

Bankwest keeps the handover in the chat

Bee handles routine queries such as password resets. Staff can also use AI to put mortgage jargon into plain English. The measure I’d be interested in is how reliably a customer in distress gets through to someone who can help.

The FCA finds gaps in wholesale banks’ AI controls

The regulator reports sensitive data leaks involving unapproved AI tools. Internal audit teams also found that some conditional approvals went untracked and that training and testing for kill switches were inadequate. In some cases, there was no documented list of who was authorised to use the switch.

US bank examiners start with the consequences

The OCC’s framework asks examiners to assess advanced AI through existing bank risks and scale their scrutiny to the importance, autonomy and complexity of each use. An agent with permission to initiate a payment gives an examiner a very concrete place to start.

The UK prepares to consult on loss of control

The proposals for regulated essential and digital services include notifying other organisations affected by an incident, preserving evidence of what the agent did and allowing government experts to review what happened. That gets quite practical when an agent has acted across systems run by several different companies.

Agentic Exploits- Deterministic gates for a probabilistic problem

David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.

BrightTALK

What we’re asking agents to do

Snowflake wants agents to use the business’s own definitions

Ask sales and finance what they mean by revenue and you may get two perfectly defensible answers. Snowflake’s forthcoming Business Ontology is meant to give an agent the approved definition for the job. Its Cortex AI Gateway addresses which models and tools the agent can use along the way.

Salesforce gives Agentforce Coworker the run of the CRM, within limits

Salesforce is pitching Coworker as a system that can spot work that needs doing and act on it using account, case and pipeline data. The demo I’d like to see is what happens when the CRM says one thing and the account manager already knows something has changed.

OpenAI tests agents on jobs people actually want done

LifeVal is OpenAI’s own evaluation for tasks such as comparing schools or planning care for a relative. I like the choice of jobs. I’d also like to see how an agent fares when circumstances change halfway through, particularly if it’s already taken an action on somebody’s behalf.

Agentic Exploits- Deterministic gates for a probabilistic problem

David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.

BrightTALK

Security and fraud

CrowdStrike expands Project QuiltWorks across Europe

Atos, BT and Orange Cyberdefense are among the new partners. The idea is to match faster discovery of vulnerabilities with the people who can help fix them. The number I’d want to see is the time from finding a serious weakness to verifying that it’s been fixed.

CrowdStrike lines up testing, monitoring and a kill switch for agents

Alongside its new Falcon Guardian controls, CrowdStrike plans to buy Dreadnode for security testing and Fiddler for tracking what agents do in production. Both deals are pending. One test worth watching is what happens to a tool call that’s already under way when somebody hits stop.

A tampered Claude Code extension turns up in Cursor’s marketplace

Microsoft’s analysis found that two tampered versions of the extension attempted to establish persistent remote access. For a security team, removing the extension is one job. Working out what it may already have left behind on a developer’s machine is another.

Europol helps target the machinery behind investment fraud

Authorities seized more than 100 servers in an operation supported by Europol and Eurojust that targeted a suspected supplier of fraudulent trading sites. By the time a payment reaches a bank, the advert, the bogus platform and the pressure from a call centre may already have done their work.

Switzerland adds liveness checks to online identification

FINMA’s revised rules took effect on 1 November. They allow Switzerland’s electronic ID to be used for onboarding and add a check designed to establish whether a live person is present during online identification. I’d like to hear how firms handle the genuine customers who fail that check.

Agentic Exploits- Deterministic gates for a probabilistic problem

David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.

BrightTALK

The work of going quantum-safe

The FCA tells financial firms to start post-quantum migration now

The FCA points to the UK National Cyber Security Centre’s milestones of planning by 2028, high-priority migration by 2031 and full migration by 2035. It’s also trialling a self-assessment with firms. The first job is finding where cryptography is used, including in systems the firm relies on but its suppliers run.

Hong Kong gives banks a toolkit for getting started

The Hong Kong Monetary Authority and the Hong Kong University of Science and Technology have published tools for mapping assets and dependencies, setting priorities and getting suppliers involved. A certificate inventory starts to earn its keep when it tells the payments team which services depend on the certificate they’re about to replace.

If you’ve had to take over from an AI system at work, I’d like to hear how you found out it needed you. I’m particularly interested in the cases where a customer or someone on the frontline spotted the problem first. Those are the examples I’d like to bring into our Research Notes and practitioner conversations.

Agentic Exploits- Deterministic gates for a probabilistic problem

David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what's actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute's recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of "guardrails" language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab's own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.

BrightTALK