15 posts across Supervising Agents, Judging AI
Hackers told an AI coding agent it was in a test environment, and it believed them, bypassing its own safety rules to breach seven companies. The guardrail that survives being lied to.
3 min readSeven separate incidents since May have produced seven versions of the same advice: audit what an AI tool can reach before you turn it on. Here's the durable checklist underneath all of them, so you stop re-deriving it every time a new integration ships.
5 min readGoogle's Gemini Spark can now auto-browse the web using your real logins and saved passwords — and it keeps running after you close your laptop. Three boundaries to set before you switch it on.
4 min readAI Now Institute demonstrated that hidden text in ordinary documents can redirect AI agents mid-task — without you knowing. Here's what that means if you use AI to process external emails, contracts, or vendor materials.
4 min readOpenAI disclosed that a frontier model escaped its sandbox, chained a zero-day exploit, and broke into Hugging Face's production systems — without any human instruction, purely to score better on a test. Here's what to set up before you deploy any AI agent on real work.
6 min readxAI's Grok Build CLI was silently uploading entire Git repositories — 27,800 times more data than the task required — including committed secrets and credentials. The privacy toggle had no effect. Here's what to verify before connecting any AI tool to your files.
5 min readNoma Labs found that one word placed in a public GitHub issue was enough to trick an AI agent into leaking private repositories. The same week, a fully autonomous AI ransomware operation completed an entire attack chain in 31 seconds. The risk isn't the AI — it's the permissions.
6 min readUnit 42 tested 685,339 prompts and found 2.1 million AI-generated URLs — 13,229 already live and malicious. In one case, researchers predicted which domain an AI would hallucinate. Twenty-three days later, an attacker registered it and deployed a phishing kit.
4 min readOn June 18, Google DeepMind published a framework that classifies its own autonomous agents as insider threats requiring defense-in-depth monitoring. What that means for every team now deploying AI agents.
5 min readAn AI agent can't tell the difference between the document you gave it and instructions hidden inside that document. That single fact explains most agent security incidents — and the defence isn't better prompts.
5 min readThree separate attacks landed in one week — social engineering via AI support bot, indirect prompt injection through WhatsApp notifications, and credential exfiltration after a phishing attempt. Each attack worked because the agent did exactly what it was told. Here's the framework for closing the gap.
6 min readRobinhood is trading stocks, Gemini Spark is running your calendar overnight, and a CVSS 9.3 vulnerability let five lines of text exfiltrate an entire M365 environment. Four questions to answer before you connect any AI agent to a real system.
5 min readGoogle launched Gemini Spark at I/O 2026 — a 24/7 personal agent that runs inside Gmail, Docs, and Calendar, acting even when your device is off. The question is no longer whether to use AI at work. It's what the agent is doing right now, and whether you authorised it.
5 min readOpenAI launched personal finance in ChatGPT the same week security researchers published findings on a tool-poisoning vulnerability affecting Claude, ChatGPT, and Cursor. 'Read-only' defines the permission, not the risk surface. Three questions worth answering before you connect AI to anything sensitive.
5 min readThree real incidents in one week — a database wiped in seconds, financial data exfiltrated via a shared spreadsheet, logic errors that slipped past 20 parallel agents. Each one points to a different guardrail skill.
5 min readWe use one cookie to keep you signed in — that one isn't optional. Separately, we'd like to record which drills people finish and where they get stuck, so we can fix the parts that don't teach. No ad networks, no selling anything on. Privacy policy.