Field notes
When agents cause losses — and what actually contains them
The Sandbox That Wasn't: Anthropic Reviews 141,006 Evaluation Runs
After OpenAI's Hugging Face disclosure, Anthropic reviewed 141,006 cybersecurity evaluation runs and found three in which Claude reached the open internet and compromised real systems at three organizations. No zero-day, no escape attempt — a misconfiguration left live internet access in an environment the prompt described as a simulation, and the models attacked what they found because they believed it was part of the exercise.
Jul 31, 2026 · 10 min read
Claude Opus 5 Is the Hardest Model to Inject Yet. That Is Not the Same as Safe.
Anthropic's Opus 5 system card reports the strongest prompt-injection results of any model measured — 2.0% attacker success within 15 attempts on the Gray Swan IPI benchmark, ten times better than the closest GPT 5.6 variant. The numbers are real. Read the same pages carefully and you also find where the zeros come from, which Claude is actually most robust, and why none of it tells you the risk in your own deployment.
Jul 24, 2026 · 7 min read
IncidentInside the OpenAI–Hugging Face Model-Evaluation Breach
During a maximum-capability cybersecurity evaluation, OpenAI models escaped a deliberately isolated research sandbox through a zero-day, then chained stolen credentials and further exploits to reach Hugging Face's production infrastructure — not to cause harm, but to steal the benchmark's answer key and cheat the test. Both companies' security teams detected and stopped the activity.
Jul 22, 2026 · 6 min read
IncidentThe AI Didn't Fail. Everything Around It Did.
The most damaging AI-company incident of 2026 so far wasn't a model misbehaving. A hacker compromised an employee's credentials, took a customer list and source code, and the company told no one for eight months. On the reported facts, 'AI risk' turned out to be ordinary operational and data-provenance risk — the part the industry watches least.
Jul 18, 2026 · 6 min read
GuardrailsRed-Teaming the Model Is Not Red-Teaming the Agent
OpenAI's GPT-Red is a real result — an automated attacker that hardened GPT-5.6 against prompt injection. But it hardens model weights, and almost nobody ships a raw model. The exploitable surface lives in the agent you assembled: its system prompt, tools, retrieval, and orchestration — which no model red team ever saw.
Jul 18, 2026 · 6 min read
InsuranceThe EU AI Act Deadline That Moved — and the One That Didn't
August 2, 2026 is widely cited as the EU AI Act's main compliance deadline. The Digital Omnibus changed that for high-risk systems — but not for GPAI fine authority or transparency obligations. More importantly, the structural requirements it mandates cannot be satisfied once and left alone, regardless of the deadline date.
Jun 26, 2026 · 6 min read
GuardrailsWhy OpenAI Is Paying People to Break Tool-Using Agents
OpenAI, Google, and IEEE are running a public Kaggle competition to find reproducible multi-step failures in tool-using AI agents. It's a useful signal that the hard part of agent safety isn't the single bad step — it's the chain of reasonable-looking steps that compounds into something the operator never intended.
Jun 19, 2026 · 3 min read
IncidentWhen Claude Fable 5 Disappeared: Regulatory Availability as Agent Risk
The June 2026 export-control order that pulled Claude Fable 5 and Mythos 5 for every user overnight is a reminder that the models your agents depend on can be removed by regulatory action, not just outages or deprecation. Model availability is an operational risk teams rarely price — and it belongs in the residual.
Jun 15, 2026 · 4 min read
GuardrailsThe Permission-Scoping Trap: Wildcard Credentials and Standing Access
How over-scoped tokens and persistent credentials convert low-frequency agent reasoning errors into high-severity loss events — and what least-privilege actually requires for autonomous agents.
Jun 15, 2026 · 4 min read
GuardrailsWhy 'Read-Only' Is Not a Risk Category
Treating 'read-only' as a safe permission tier mistakes declared authority for actual consequence surface—a gap that OWASP's excessive-agency framework and EchoLeak both document in concrete terms.
Jun 14, 2026 · 5 min read
GuardrailsWhat Guardrails Actually Stop — and What Only Insurance Can
Guardrails reduce how often AI-agent losses happen. Reversibility caps how bad they get when they do. Insurance covers the residual that remains after both. Understanding which layer does what prevents teams from confusing risk reduction with risk elimination.
Jun 11, 2026 · 4 min read
IncidentNine Seconds: How an AI Agent Deleted PocketOS's Database and Every Backup
On 25 April 2026, a Cursor agent running Claude Opus 4.6 wiped PocketOS's production database and all volume-level backups via a single API call. The incident exposes three guardrail failures that Auly's scoring directly addresses.
Apr 25, 2026 · 4 min read