Aug 9 – Sep 8, 2026 · 6 items
The AI week, for an IT security manager
A real edition, written for: IT Security Manager
The one thing
Coding agents are now a documented intrusion path — put sandboxing in your staff policy this week rather than trusting the vendors' built-in refusals.
Ransomware crew used a coding assistant to break into seven companies
Security firms Gambit Security and CloudSek reported that a Russian-speaking ransomware group called Aur0ra used the Cursor coding assistant to help break into a Belgian chemical maker and at least six other companies. The hackers got around the tool's safety refusals by claiming the intrusions were a test, and researchers found the evidence on a server the group left exposed. Reuters could not establish how much of each break-in the AI actually enabled.
Why it matters for you
A ransomware group talked a coding assistant past its refusals by calling the intrusion a test. That is a vendor-risk question you can put in writing this week.
- Researchers reviewed the attackers' own chat logs from an exposed server, so this is documented behaviour rather than theory
- One victim was a Belgian chemical maker — an industrial operator with a footprint close to yours
- Your developer tooling review probably asks about code storage, not about what an agent can be talked into doing
Try this
Add one question to your dev-tool vendor questionnaire: what stops an agent being social-engineered into attack work?
Paste this into your AI tool
I run information security at a utility with roughly 1,000 staff. We are reviewing AI coding assistants used by our developers. Write eight questions for the vendor security questionnaire covering: what the agent can execute on a developer machine, whether refusals can be bypassed by a user claiming authorised testing, what session logs we can retain and export, and what the vendor does when misuse is detected. Plain language, one question per line, no jargon. Mark which three I should treat as deal-breakers if the answer is weak.
Claude Code's default safety check was bypassed in about 80% of attempts
Security researcher Johann Rehberger published an attack that defeats the automatic safety checks in Anthropic's Claude Code, which the company recently made the default protection against instructions hidden in content the agent reads. He reports it works about 80% of the time, by getting the agent to unpack an archive and then run code that silently loads a malicious file from it. In some runs the safety layer blocked Claude's own attempt to shut the malware down.
Why it matters for you
A researcher defeated the automatic check that is meant to catch hidden instructions in files an agent reads. Your policy line should be sandboxes, not vendor defaults.
- The trick was getting the agent to unpack an archive and quietly run a file from inside it
- In some runs the safety layer blocked the agent's own attempt to kill the malware
- Your staff policy can require a container or VM without waiting on any procurement decision
Try this
Write one policy line: coding agents run in a container or VM, never directly on a laptop.
Paste this into your AI tool
Draft a one-page internal standard for staff who use AI coding agents at a utility of about 1,000 people. Requirements to cover: agents must run inside a container or virtual machine, not directly on the endpoint; no access to production credentials; no auto-execution of files unpacked from downloaded archives; logging retained. Write it as short numbered rules a non-engineer manager can approve, with a two-sentence rationale at the top. Avoid vendor names.
Slack now hosts channels where coding agents do the work in the open
Salesforce launched Slack Code, which gives teams dedicated channels where people and coding agents work on a task together. Tagging an agent creates a channel that shows the conversation, the code changes and a live preview, then archives itself when the work is done while keeping a searchable record. It works with agents from Anthropic, Cognition, GitHub, OpenAI and Vercel on any Slack plan, but access to each agent must be bought separately.
Why it matters for you
Coding agent sessions move from private terminals into Slack channels with a searchable record. That changes what you can actually monitor.
- Each agent still needs its own separately purchased access, so entitlement review stays fragmented across five vendors
- The archived channel gives you an audit trail you currently do not get from a developer's local terminal
- Non-engineers approving code changes in Slack is a new access-control path worth naming before it appears
Try this
Ask your Slack admin whether Slack Code can be turned on, and who would be able to approve changes.
GitHub Copilot chat data moves to lifetime retention on 28 September
GitHub is reopening Copilot Business and Enterprise signups for customers paying by card or PayPal from 1 September 2026, with seats charged upfront before users get access and existing card-paying customers moving to upfront billing from 1 October. Prices are unchanged. From 28 September, Copilot Chat on github.com and mobile merges with the cloud agent under one policy, and chat data will be kept for the life of the account rather than 28 days.
Why it matters for you
Copilot chat on github.com will be kept for the life of the account instead of 28 days. Swiss data protection expectations make that a question you should ask now.
- The change bundles chat with the cloud agent under a single policy, so one setting now covers both
- An admin can still set the code review effort level before the default shifts on that date
- Prices are unchanged, so this is purely a data-handling review rather than a budget one
Try this
Ask whoever owns your GitHub tenancy what changes on 28 September and who signed off the retention change.
Sources
Meta scrapped the second layoff round after its AI agents underperformed
Meta cancelled the second wave of layoffs planned under an internal reorganisation that would have shifted much of the daily work of thousands of employees onto AI systems overseen by small expert teams. The company still cut about a tenth of its staff in May, but internal measures showed autonomous AI agents were not delivering the expected productivity, while technical and security incidents rose. Zuckerberg told staff in July that the pace of AI agent progress had been misjudged.
Why it matters for you
Meta measured what happened when agents took over routine work. Incidents rose and fixes took longer — numbers you own at a utility.
- Code changes went up far faster than shipped features, so volume and value came apart
- Longer time-to-fix lands directly on your incident response rota, not on the team that deployed the agents
- Useful counterweight when someone proposes agents for operational work on your estate
Try this
Add incident rate and mean time to fix to whatever metrics your team tracks for AI-assisted work.
Paste this into your AI tool
I run information security at a utility with about 1,000 staff. Our developers are increasing use of AI coding agents. Propose six metrics I should track monthly to tell whether this is raising or lowering our risk. For each: what it measures, where the data probably comes from, and what a worrying trend looks like. Include at least two security-specific ones such as incident rate and time to remediate. Keep it practical for a team without a data analyst.
Sources
Running a cheap model three times beat one pass of an expensive one at finding flaws
Security vendor Aikido benchmarked ten AI models on rediscovering 32 recently disclosed software vulnerabilities, running each model three times. DeepSeek V4 Pro found the most once results from all three runs were combined, ahead of the leading closed models, and repeating a cheaper model cost far less than a single expensive pass. The open models also produced the most false leads, so the savings shift work to whatever filters the results.
Why it matters for you
Aikido tested ten models on rediscovering real vulnerabilities. Repeating a cheaper model found more, for far less, but produced more false leads.
- The saving moves work to whoever filters the findings — that is triage time on your team, not budget
- Useful when a scanning vendor quotes AI-powered detection: ask how they de-duplicate and validate
- Worth knowing the top result came from an openly available model, given where your data would go
Try this
Ask your current vulnerability scanning vendor how many findings are AI-generated and how false positives are filtered.
Build this
Every week, one small thing to build with AI in something you actually care about. No work in it. Five minutes to set up, and worth keeping if it earns a second run.
A tabletop exercise built only from things that have already happened on your estate, ready to run with your team next month.
Five minutes to set up
Build a 45-minute incident response tabletop exercise using only these real past incidents from my own records: [paste or summarise three or four incidents your team has actually handled] and only these tools and people we already have: [list the tools and roles you actually have]. Do not invent new scenarios, do not assume any tool or headcount we do not have, and do not suggest anything that needs a purchase. Output: a timeline of injects with times, the question asked at each inject, who should answer it, and a short list of the decisions we want written down by the end.
- Have three or four past incidents to hand, even roughly described — dates, what broke, who was involved.
- Check the injects against what really happened: if a step assumes a tool you do not run, strike it out and say so.
- Run it once with two people before putting it in front of the whole team, and cut any inject that stalls.
Yours arrives Thursday.
This one was written for a it security manager. Tell us what you do and the next one is written for you — same news, your job, once a week.