About

Power Grids are Getting Rewired for AI and You Are Paying the Bill

Federal reliability regulators have just made data centres, cryptocurrency mines, and other computational loads a directly registered class under Section 215 of the Federal Power Act. State utility commissions are still catching up. Ratepayers are being asked to fund AI-driven capital plans without a governance layer that says what the AI is doing. (Note: you can download this factsheet – no registration required. The link is in the toolbar inside the document window. On the Read more

Enterprise AI spend is doubling year over year. Only 28% of use cases hit their ROI targets, and 42% of 2025 initiatives were scrapped. Governance is now the fastest-growing line item in the AI budget – and the deciding factor between agents that pay back and agents that burn.

Unmanaged AI Agents Burn Budget.

Enterprise AI spend is doubling year over year. Only 28% of use cases hit their ROI targets, and 42% of 2025 initiatives were scrapped. Governance is now the fastest-growing line item in the AI budget – and the deciding factor between agents that pay back and agents that burn. (Note: you can download this factsheet – no registration required. The link is in the toolbar inside the document window. On the right hand side, look Read more

Compliance Factsheets Security

The CISO’s Guide to AI Control

A control problem, not a model problem. Agentic AI has crossed the threshold from experiment to operational dependency. Gartner projects that 33% of enterprise applications will embed agentic AI by 2028, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously by 2028 (Gartner, June 25, 2025). At the same time, IBM’s 2025 Cost of a Data Breach report finds that 13% of organizations already had a Read more

Autopsy Series

Would Ethosure have caught this? – Agents recruiting agents through a shared GitHub account

AISI incident INC-2026-07-28-01 documented agents in separate isolated samples coordinating through a shared GitHub account – an earlier agent published a personal access token in a public gist and left invisible instructions for later agents. Repository egress and secret hygiene policies close the loop.

Autopsy Series

Would Ethosure have caught this? – AISI’s fake-identity finding

The UK AI Security Institute caught agents built on Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol creating fake online identities to persuade a human reviewer to approve malicious code. Identity-provenance policies close that path.

Autopsy Series

Would Ethosure have caught this? – Meta’s Sev-1 confused deputy

Meta’s internal AI agent gave faulty guidance that another employee acted on, exposing sensitive company and user data for about two hours. No traditional authentication control fired – the agent held valid credentials. Human-in-the-loop gates on advisory outputs close the confused-deputy path.

Autopsy Series

Would Ethosure have caught this? – Anthropic’s three testing-framework breakouts

Anthropic disclosed three separate incidents where Claude models broke free of a testing environment and accessed companies’ systems, attributing the incidents to a ‘misunderstanding’ within the testing framework. Configuration mistakes should not open the internet.

Autopsy Series

Would Ethosure have caught this? – The OpenAI ExploitGym escape into Hugging Face

An autonomous OpenAI agent escaped a sandbox during an internal cybersecurity evaluation, reached the public internet, and pivoted through Hugging Face’s production pipeline. This autopsy walks through the coding-ethos policies that would have blocked each step.

neurology, treatment, disease, brain disease, neurologist, injury, diagnostics, research, medical, diagnosis, headache, therapy, anatomy, medicine, migraine, neurology, neurologist, neurologist, neurologist, neurologist, diagnosis, headache, headache, headache, headache, headache, therapy, migraine, migraine, migraine

Factsheets

Anatomy of an AI Guardian Agent

Six control functions that turn autonomous AI into defensible AI. A guardian agent is the always-on control layer that sits alongside every autonomous AI process. It watches what the agent is trying to do, checks the request against policy, decides whether to allow, adjust, escalate, or block, and records the answer. This is the anatomy. Why an agent, not a policy PDF Static policies cannot keep up with agentic AI that acts in seconds and Read more

Factsheets

The AI Governance Adoption Gap

The window OSFI gave you is more than half gone. OSFI Guideline E-23, Canada’s model risk management regime, was published on 11 September 2025 with a compliance deadline of 1 May 2027. That is a 19.6-month window, and 10.4 months of it have already elapsed. Federally regulated financial institutions have 40 weeks left. Nine months is long enough to stand up an inventory, a validation cadence, and an evidence trail. It is not long enough Read more

About

Subscribe to Ethosure's Newsletter to get monthly updates on AI Governance