Aditya Chordia | CISSP, CISA, CIPP/E

14+ yrs in Cyber & GRC | Host - AI GovSec | Talking to CISOs - what's actually working in AI gov & security | AI Security published researcher

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

You've drawn the scope boundary, and that instinct is the right one. The control that makes the inbox case defensible is splitting read from send: an agent that summarises mail is tolerable if its credential cannot send, forward or create inbox rules. That separation is testable in ten minutes, and most deployments collapse it by issuing one broad token for convenience.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

The uncomfortable part is that this is a supply-chain question before it is a model-safety one. A post-trained checkpoint arrives with no manifest, so the only test is behavioural: run it against a fixed exploit-generation suite before it touches anything, and record which version passed. Most teams procurement-review the vendor and never evaluate the artefact itself.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

Microsoft, 29 Oct: DPRK actors are running ARTEX, an open-source agentic pentest framework. Onyx Sleet turned out dozens of tailored lures in minutes.

The deflationary line matters more than the tooling: Microsoft assesses these operations are still human-directed, not autonomous.

Does your detection assume an operator?

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

ECB, 7 Jul: significant institutions had to file an AI-cyber action plan with their supervisor by 31 Oct. That deadline passed yesterday.

The premise is the part worth quoting. AI does "not introduce entirely new risks" but "significantly amplify the speed and scale" at which they land.

What changed in your assessment since July?

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

The sandbox helps, but Cursor is the reality check: the payload wrote its SSH key and LaunchAgent outside the extension directory, so revoking the tool and killing the VM are different steps. Ephemeral compute only holds if the credential the agent receives is short-lived and scoped to that session. Test it once: destroy the environment, then prove no key or startup entry survived.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

The log is where this breaks down in review. An agent that reads alerts and opens tickets can still hold a scope nobody granted it, so you can show what it did but not what it was authorised to do. Ask for a per-agent capability ledger reconciled monthly, plus one revocation test: kill its credentials in under a minute and prove it from logs.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

OpenAI, 30 Oct: it will honour the IETF's shared robots.txt policy token, __usage_ai-training, so one signal covers every participating provider instead of per-crawler rules. Implementation is "in the coming months".

A stated preference is not a licence, and not evidence either.

Who in your business actually owns that file?

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

Microsoft, 30 Oct: a trojanised Claude Code extension sat in the Cursor marketplace for over 11 hours on 29 Oct. It wrote an SSH key, a reverse tunnel and a LaunchAgent outside the extension directory, so uninstalling does not remove it.

Persistence outlived the removal step.

Do you audit what your engineers install?

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

The evidence artefact is the useful part of this, not the behaviour change. If an agent privately logs its claim, the check behind it and its confidence before the challenge arrives, that record is exactly what an auditor asks for when a bad change is traced back. My caution: if that note lives only in the transcript, it is narrative, not evidence. Test is whether it is written to a system the model cannot edit, with a timestamp and a model version.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

Two months undetected is the part that should worry compliance more than the tool. Agent traffic through an authenticated key looks like a normal user, so a blocklist will not catch it. The control that does: an agent inventory reconciled monthly against network egress logs, with a named owner per entry. Pick a random week, list every non-sanctioned endpoint called from the estate, and see whether anyone can say who called it and why.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

TPR, 29 Oct: new AI guidance for pension trustees, seven principles, bolted onto existing duties rather than a new regime. The sharpest line is that trustees need not be AI experts but are accountable, and must know where AI is used in the scheme.

73% of the 61 schemes in the Aon survey it cites had done no specific assessment of their providers' AI governance.

Accountability without an inventory is a sentence in a minute.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

OpenAI, 29 Oct: its misalignment monitors flagged an agent reaching the internet from an environment meant to be isolated within 15 minutes. A human started reviewing three minutes later, and frontier RL was paused.

Detection is the easy half. Ask your vendor for the alert-to-pause timeline on one real incident.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

The 34% with write access is the figure I would put in front of a board, because the 46% who worry about agents exceeding permissions have already answered the question — they just have not tested it. Permission drift is invisible in a policy document; it shows up as an agent holding a scope nobody granted it, six months after deployment. The artefact to request is a per-agent capability ledger reconciled against stated purpose each month, not an annual access review.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

The 86% is the number I would take to a governance committee. In an audit the question is not whether the analyst agreed, it is whether the record shows a lean existed and who overrode it. If the workflow only captures the final recommendation, you can prove judgement was available, not that it operated. Ask for the dissent log, not the outcome log.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

EDPB's web scraping guidelines close for comment tomorrow, 30 Oct. Guidelines 03/2026 run the three-step legitimate interest test stage by stage: collection, dataset, model.

If you fine-tuned on scraped data, that balancing test is the evidence a customer's auditor will ask for. Written down, or implied?

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

BoE and FCA, 26 Oct: 80% of surveyed financial firms have AI agents in production, but only 2% run them with broad autonomy. Third-party systems, meanwhile, are now 53% of high-materiality AI, up from 35% in 2024.

The autonomy risk in your register is mostly not live yet. The supply-chain one is.

Which third parties sit on your high-materiality list?

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

This is the right distinction and it is the one most public bodies miss: the tool was never the risk, the contract was. A private account puts the supplier's retention and training terms in charge; a commercial agreement with a DPA, sub-processor list and deletion commitments puts the buyer in charge.

The testable artefact is not a policy on AI use, it is the contract schedule: retention period, whether inputs train models, named sub-processors, and a deletion certificate on exit. If procurement cannot produce those four, the ban is doing the work a clause should have done.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

Trust is the right frame, but the audit question is narrower: can you reconstruct what the agent remembered at the moment it acted? Memory that silently accumulates context is a data-retention problem wearing a product feature's clothes. The test I would want is one agent decision from six months ago, with the exact context window, the source of each item in it, and the retention basis for keeping it. Most memory layers can show current state, not state-at-action.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

ENISA, 22 Oct: its SBOM technical advisory ships a threat model for the software supply chain — implementation architecture, data flows, then targeted risks and measures.

A component list is not the deliverable. The test is whether your SBOM regenerates from the build pipeline, or is hand-maintained every quarter.

[Aditya Chordia | CISSP, CISA, CIPP/E @Adi_GovSecAI]

ENISA, 22 Oct: its SBOM technical advisory ships a threat model for the software supply chain — implementation architecture, data flows, then targeted risks and measures.

A component list is not the deliverable. The test is whether your SBOM regenerates from the build pipeline, or is hand-maintained every quarter.