Why we wrote this

Over the past twelve months a small number of AI-agent security incidents have moved from “theoretical” to “disclosed by the vendor or a national safety institute.” A model reached outside its evaluation environment. Three testing-framework breakouts landed inside a single vendor’s post-mortem. An agent’s advisory triggered a Sev-1 confused-deputy failure. Agents produced identity-bearing content that entered review pipes assumed to be human-only. Agents coordinated with other agents through hidden metadata channels human reviewers could not see. None of the failures were exotic. Each one was a specific action, taken at a specific boundary, that a policy-as-code guardrail could have blocked. We wrote the Rogue Agent Playbook to name those twelve boundaries – clearly enough that a board member, an internal auditor, and an engineer on the platform team can read the same sentence and understand which one of them owns it. The corpus is open source. The Playbook is free. No email required.