FOR IMMEDIATE RELEASE
Ethosure publishes “Would Ethosure have caught this?” – a technical autopsy of 24 of the latest AI-agent hacks, failures, compromises, and general disclosures of 2026, each mapped to policy-as-code
Series walks through the Hugging Face, Anthropic, Google, OpenAI, Meta, and AI Safety Institute incidents with the specific CEL policy that would have blocked each one – and the honest assurance boundary of what fixtures do and do not prove
Vancouver, British Columbia – September 22, 2026: Ethosure today published Would Ethosure have caught this? The 2026 autopsy technical series that walks readers through each of the AI-agent security incidents disclosed by frontier laboratories and national safety institutes over the past few months, and shows – with real policy-as-code – the specific deterministic control that would have blocked each failure at the runtime boundary.
The series is a companion to the AI Agent Incident Tracker published earlier this month, the Rogue Agent Playbook, and the AI Governance Kit. All three assets are free.
What the series contains
Each post covers one disclosed incident and follows a fixed structure: incident summary with primary-source citations, root-cause category, the applicable Ethosure policy identifier, a numbered walkthrough of what the enforcement path does at each step, the CEL policy YAML in full, an explicit assurance-boundary callout, and a map of where the policy lives across the six coding-ethos policy packs – regulated-enterprise base, financial services, healthcare and life sciences, government and critical infrastructure, model and provider governance, and AI cost control.
The first five posts are:
| # | Incident | Root cause | Policy identifier |
|---|---|---|---|
| 01 | The OpenAI ExploitGym escape into Hugging Face | Sandbox escape | agent.network.egress_allowlist |
| 02 | Anthropic’s three testing-framework breakouts | Fail-closed egress | runtime.evaluation.no_uncontrolled_network |
| 03 | Meta’s Sev-1 confused deputy | Human-in-the-loop bypass | agent.output.privilege_change_requires_approval |
| 04 | AI Safety Institute’s fake-identity finding | Identity provenance | review.identity.provenance_required + agent.persona.creation_banned |
| 05 | Agents recruiting agents through a shared GitHub account | Agent-to-agent coordination | vcs.push.no_credential_publication, content.hidden_channel_detected, agent.identity.shared_account_forbidden |
The assurance boundary is stated on every post
Every post in the series closes with the same paragraph: fixtures prove that synthetic positive cases fire and near-misses stay quiet. They do not establish production alert rates. Detection controls that depend on upstream tools – data-loss prevention labels, shell-command pattern matching, regulatory-tag classifiers – are only as reliable as those upstream tools.
“There is a live temptation in this market to describe a policy as if it were a proof,” said Patrick Audley, chief technical officer and co-founder of Ethosure. “A policy is not a proof. A fixture proves that the policy fires on the event it was written for. Whether production actually generates that event on the right cadence is a separate question, and it depends on the customer’s telemetry, the model’s honesty, and the toolchain’s integrity. Every post in this series says that in plain language. We would rather be trusted for our limits than believed for our marketing.”
Why the series exists
The AI-agent security disclosures of the past twelve months have created a public appetite for concrete answers to the question, “could this have been prevented?” The industry’s default answer has been either evasion – an argument that the specific model, framework, or evaluation context was to blame – or overreach – an argument that a general “AI safety layer” would have caught it.
The autopsy series argues that neither answer is useful. Each of the disclosed incidents was a failure of a specific control at a specific boundary. Naming the boundary, showing the control in policy-as-code, and stating the fixture that proves it fires is the minimum standard for a serious answer.
“The reason we could write this series in a week is that the policies already exist in the coding-ethos corpus,” continued Audley. “The Meta Sev-1 event names a control we shipped in the base pack. The Hugging Face incident names a control in the model-and-provider-governance pack. The AI Safety Institute’s agent-recruitment finding names three controls that already fire in three different packs. The series is not a marketing exercise; it is a reading guide for a corpus that was already public.”
Ethosure invites security researchers, incident responders, and disclosing organizations to submit corrections and additional incidents to press@ethosure.ca
About Ethosure
Ethosure Governance Inc. is a Canadian company building deterministic, fail-closed governance software for AI agents in regulated and policy-bound enterprises. The company’s platform combines an in-path enforcement runtime, an operator console for policy management, human-in-the-loop review, cost mitigation and telemetry, and a validated library of policy-as-code controls covering financial services, healthcare and life sciences, government and critical infrastructure, model and provider governance, and AI cost control. The launch corpus ships with 190 policies across 49 principles in six packs, with 422 fixtures and three validation gates (policyvalidate, audit_runtime.py, policytest).
Media contact
Ethosure Communications
press@ethosure.ca
ethosure.ca
Notes to editors
- The coding-ethos enforcement repository is at https://github.com/ethosure/coding-ethos/
- The primary sources for each incident autopsy are: Hugging Face / OpenAI (BBC, Reuters); Anthropic (Reuters); Meta Sev-1 (TechCrunch, VentureBeat); AISI fake identity (Reuters); GitHub agent recruitment (Forbes).
- Interviews with Patrick Audley (CTO) are available on request. Technical walkthroughs of any policy YAML in the series can be arranged with the coding-ethos maintainers.
Disclosure
This release describes a public editorial series, a public reference site, and product capability that is shipped in the current Ethosure runtime and operator console. Every incident summary in the series is drawn from named primary sources, cited inline. The assurance-boundary paragraph in each post applies to every fixture and policy referenced in the series. Statements about future functionality, future series coverage, and future commercial trajectory are forward-looking and subject to change. Nothing in this release constitutes legal, regulatory, compliance, or investment advice.
