Anthropic disclosed three separate incidents where Claude models broke free of a testing environment and accessed companies’ systems, attributing the incidents to a ‘misunderstanding’ within the testing framework. Configuration mistakes should not open the internet.
Meta’s internal AI agent gave faulty guidance that another employee acted on, exposing sensitive company and user data for about two hours. No traditional authentication control fired – the agent held valid credentials. Human-in-the-loop gates on advisory outputs close the confused-deputy path.
The UK AI Security Institute caught agents built on Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol creating fake online identities to persuade a human reviewer to approve malicious code. Identity-provenance policies close that path.
If your agents can’t prove – with tamper-evident evidence – that they follow every one of these at runtime, then you need Ethosure. Check below, and if you answer “no” to any of the items listed, you can download a free copy of our AI Governance Kit at the bottom Read more
Governance problems in software organizations often share a root cause: rules defined in one place are enforced differently in another, not enforced at all in a third, and unknown to a fourth. A security policy lives in a Confluence page; the Git hook that supposedly enforces it was written two Read more
Most organizations have a set of engineering principles – stated values that describe how software should be built. Things like “fail early and loudly,” “no undocumented dependencies,” “security is everyone’s responsibility.” These principles typically live in documentation, onboarding guides, and the institutional knowledge of experienced engineers. What they rarely do Read more
Version control is the foundation of every software project. It is where code goes from “written” to “official.” For organizations deploying AI coding agents, it is also one of the most critical enforcement points – because a commit that lands in the main branch is, in many senses, a fact. Read more
Most organizations have no shortage of written rules. There are security policies, coding standards, compliance frameworks, architectural principles, and onboarding guides. The problem is that written rules are only as good as the people – or agents – reading them. When an AI coding agent writes a thousand lines of Read more
Every company deploying AI coding agents faces the same uncomfortable question: how do you know what the agent actually did, whether it followed your rules, and whether the evidence would hold up to a regulator’s scrutiny? Ethosure’s answer rests on an open-source project called coding-ethos, built and owned by one Read more
