Ai Governance

Human-in-the-loop and provenance are as important to AI security as injection defense — but they are a dial, not a switch. A register of where each one is worth it (high-stakes, irreversible) and where over-applying it adds latency, alert fatigue and a product nobody uses.

What Anthropic's newly open-sourced sandbox-runtime (srt) actually is, how it confines an AI agent's filesystem and network without a VM, the limits it is honest about, and a 13-point hardening checklist.

A category-honest comparison and ranking of AI-agent command sandboxes in 2026 — Anthropic's srt against bubblewrap, Firejail, nsjail, Landlock, Seatbelt, Deno/Bun, Docker, gVisor, Firecracker, E2B, Daytona and others.

A security-leadership field guide to the AI-agent benchmarks vendors quote: WorkBench, JobBench, BigLaw Bench (+ BigLaw Bench: Research), SWE-bench / SWE-bench Verified, GAIA, τ-bench / τ²-bench, WebArena, MLE-bench, BrowseComp and AssistantBench. What each one measures, how grading differs (programmatic vs rubric vs human), why a high score on one says almost nothing about another, and the questions to ask when a benchmark number lands on your desk. Tied to Google’s Harness² work, which is a reminder that a score is the model plus its harness — not the model alone.

A security-leadership comparison of the main ways to make an AI agent better without retraining the model: Google’s Harness² (recursive harnessing of the whole scaffold), GEPA (reflective prompt evolution), DSPy (a pipeline compiler with optimisers), ADAS (a meta-agent that writes new agents in code), Reflexion (runtime verbal self-reflection) and plain ReAct as the baseline. What each optimises — prompts, few-shot demos, tools, topology, control flow or memory — the data and cost each needs, its maturity, and the governance implications (self-modifying agents, code generation, egress, auditability). Includes an honest note on "PRISM," a name that maps to several unrelated methods.

Google’s Harness² lets an AI agent rewrite its own harness — prompts, guardrails, memory, tools — per task, weights fixed. A calm read of what it is and the governance controls it demands.

ISO/IEC 27090:2026 is the first international standard for AI security threats. What it covers, why there is no "ISO 27090 certificate," and where to get the official PDF.

Abliteration removes an open-weights LLM’s ability to refuse by deleting its "refusal direction" — not a jailbreak or a retrain. How to govern the risk.

What Google AI Edge Foresight is: Google's on-device, local-first AI meeting notetaker for Apple Silicon Macs — plus the platform/Windows question and the security checks a CISO runs first.

Google Labs' Project CC is a family AI assistant with its own verified Google account, email address, and permission to act in Gmail, Calendar, Drive and Maps. Strip away the household framing and it is the clearest consumer preview yet of the hardest problem in enterprise AI: giving an autonomous agent a scoped identity, delegated data access, an action-approval gate, and an isolated runtime — plus the prompt-injection exposure that comes free with an agent that reads forwarded email.

Exactly what to capture in an AI Bill of Materials (AIBOM) — models, datasets, AI/ML dependencies, configuration, and risk metadata — mapped to CycloneDX ML-BOM and SPDX 3.0 AI Profile, with a copy-paste checklist and the free tools to generate and validate one.

A practical comparison of how to produce an AI Bill of Materials in 2026 — CycloneDX ML-BOM vs SPDX 3.0 AI Profile, the best open-source/GitHub generators, the commercial AI-SPM platforms that offer AIBOM, and the free PlayCISO tools you can use today.

Anthropic says Zhipu’s open-weight GLM-5.3 can build end-to-end exploits without robust safeguards. The capability finding is right; the policy cure is not.

When you give an LLM the ability to call tools and take actions, you grant it real capability. The controls that keep LLM tool access safe: least privilege, human approval, sandboxing and logging.

An AIBOM inventories the models, data and software that make up an AI system. A step-by-step guide to building one, what to include, and the formats that make it useful.

An ML-BOM inventories the models, datasets and provenance in an ML system. What it captures, how it relates to SBOM and AIBOM, and why it matters.

The Model Context Protocol lets AI agents call external tools and data through MCP servers. The governance controls that prevent an over-privileged or malicious MCP server becoming your next incident.

An SBOM inventories software components; an AIBOM covers AI systems including models and data; an MLBOM focuses on machine-learning artifacts. How the three bills of materials relate and when you need each.

OWASP AISVS (AI Security Verification Standard) is a checklist of testable requirements for securing AI and LLM apps. What it covers and how to use it.

Federal prosecutors arrested Oxygen Forensics CEO Lee Reiber and Russian national Oleg Davydov, alleging the Virginia-based digital-forensics vendor concealed Russian ownership and Russian-developed software while selling to the Secret Service, HSI, DHS OIG and other agencies. What the complaint alleges, what it explicitly does not, and what it means for vendor-risk programs everywhere.

Baseten, Hugging Face and Goodfire are building safety infrastructure for open-weight models. A checklist of what a credible security standard needs.

How secure is Google AX vs LangGraph, CrewAI, Microsoft and OpenAI's agent orchestrators? Compared on sandboxing, egress, spend limits and audit trails.

Dolphin3-Cyber-8B, an abliterated "zero-refusals" security model, passed 44,000 downloads and runs on an 8GB laptop GPU. The AI governance checklist first.

Claude-Red packages 78 offensive-security skills for Claude, with no built-in authorization check. The governance checklist to put in place first.

VirusTotal’s free VTAI lets any AI agent check file and URL reputation in one call. Before your engineering team wires it in, here is the governance checklist: what it can leak, what it won’t block by default, and how to roll it out safely.

A reference architecture for the three unsolved problems of deploying AI agents at scale: identity (zero standing privilege), security (runtime guardrails plus a quarantine path), and observability (trace-first debugging). Nine components, explained — plus an interactive tool to self-score your own environment.

PentAGI is a 24k-star open-source AI agent that plans and runs pentests with Nmap, SQLMap and Metasploit. What it does and what to check before you run it.

Hours after DeepSeek-V4.1-Flash shipped, a community "abliterated" overlay stripping its safety refusals — including cybersecurity-specific ones — appeared on Hugging Face. What it actually is, how it works, and how to assess the risk if it shows up on your network.

Why frontier AI labs restrict dangerous dual-use biology, how layered safeguards and responsible scaling work, and what security leaders should know.

How frontier AI labs restrict weapons and CBRN uplift: dual-use risk, export controls, responsible scaling, and layered safeguards for security leaders.

How AI labs detect AI misuse with monitoring, classifiers and threat intelligence, plus the AI trust and safety lessons CISOs can apply to their own AI.

A CISO guide to the OWASP MCP Governance & Risk Project: the four non-negotiable gates (owner, logging, scope, review), the Tier 0-4 classification, the eight-factor risk model, and how it maps to the OWASP MCP Top 10, LLM Top 10, NIST AI RMF, ISO 42001 and SOC 2. Plus a free tool that runs the check for a specific server.

Abliterated models are LLMs with safety refusals surgically removed. What it means for your threat model, where the risk sits, and how to detect them.

AIBOM: a machine-readable inventory of every model, dataset and dependency in an AI system, what it must include and how to generate yours free.