Hari Singh

Cybersecurity × AI | Exploring security, governance, architecture and digital trust | Practical perspectives for technology and business leaders

[Hari Singh @HariSinghCyber]

OpenAI says the Hugging Face attacker was its own models, in a cyber eval with the guardrails deliberately off. Model policy is a switch, and the vendor holds it. Your infrastructure is the only line you own. Build it like that.

#ZeroTrust #SecurityArchitecture

[NCSC UK @NCSC]

The NCSC has issued an update to the PHP alert reflecting the release of mitigations.

We encourage UK organisations to take immediate action.

For more information on the issue as well as our guidance, head to⬇️
https://t.co/l6TDtVurJN

[Hari Singh @HariSinghCyber]

So if one engineer can make such massive move possible now, what is possible in one year from now with more mature AI capabilities. 🤯

[GitHub @github]

Just one engineer and a team of agents ported the GitHub Copilot agent runtime to Rust, shipping 800,000 lines of production code while retaining code quality. 🚀

How it worked 👇
https://t.co/wJ5qWMuGvV

[Hari Singh @HariSinghCyber]

Monitoring agents isn't the same as governing them.

Firms are deploying AI agents faster than they can contain them.

Kiteworks' 2026 forecast, based on a survey of 225 security, IT, and risk leaders across ten industries, quantifies the gap: 63% cannot enforce limits on what an agent may do, 60% cannot terminate one that misbehaves, and 55% cannot stop lateral movement.

A dashboard showing an agent touching a system it shouldn't is a witness, not a control.

Containment is an architecture decision: task-scoped credentials, segmentation, and a termination path you have actually tested. That standard has to reach bought agents too. If the agent came embedded in your SaaS estate, a licence toggle and a vendor ticket are not a kill switch.

Detection alone was never the bar. UK operational resilience rules already assume you can detect and respond.

My view: the harder supervisory question is coming, and it is "show me you could stop it".

#AIGovernance #ZeroTrust #SecurityArchitecture

[Hari Singh @HariSinghCyber]

Extend a deadline and watch the priority slide with it. Every programme, same pattern.

The EU AI Act high-risk delay to Dec 2027 is now law — the Digital Omnibus has been in force since late June. The date that didn't move: 2 August. GPAI enforcement starts within days, with fines up to €15m or 3% of turnover on the providers under your AI stack.

Sixteen months is delivery time, not decision time.

Plan for the delay. Don't bank it.

[Hari Singh @HariSinghCyber]

@steipete I mean, it's not like others haven't done it already

[Hari Singh @HariSinghCyber]

The 'control the model' framing misses where regulation lands. EU AI Act and DORA don't police the weights; they hold the deployer accountable for outcomes. Open vs closed weights changes the threat model, not who owns the risk. The real control is provable ownership in production.

[Hari Singh @HariSinghCyber]

@wunderwuzzi23 An AI DB assistant is only ever as contained as the identity it runs under, and most are wired to a connection with far too much reach. Scope the service account to read-only, treat the assistant as a hostile client, and SELECT-to-SYSADMIN closes before the T-SQL trick matters.

[Hari Singh @HariSinghCyber]

@simonw The worry isn't LibreOffice specifically. It's that a signed AI app can silently drop a full binary suite into a hidden cache your EDR and software inventory never see. In a regulated shop that's an unmanaged dependency and a supply-chain gap, not a quirk.

[Hari Singh @HariSinghCyber]

The real tell is that intent-based guardrails are the wrong control layer. If an agent can talk its way in with "one polite email," that's an authorisation failure, not a judgment one. Give agents scoped, revocable identity and fail-closed access, and assume they'll be persuasive.

[Hari Singh @HariSinghCyber]

@LuizaJarovsky Liability follows control, not code. In regulated settings the firm deploying the agent owns the outcome; you can't sign accountability over to the model developer in the ToS. Every consequential agent action needs a named human owner, not just a log entry.

[Hari Singh @HariSinghCyber]

@0xRajeev Isolation was never containment. Once you accept an agent can cross the boundary, the question stops being "which VM" and becomes "what's the blast radius when it does": scoped credentials, egress control, fail-closed kill switches. Minimal attack surface buys time, not safety.

[Hari Singh @HariSinghCyber]

UK and EU just diverged on AI regulation in the same fortnight

The UK and EU just took opposite turns on AI regulation in the same fortnight.

EU: 16-month delay on high-risk obligations.

UK: FCA Mills Review confirms no new AI rules. https://t.co/gYNguLUWK7

[Hari Singh @HariSinghCyber]

The first SEC 8-K to blame "unauthorized AI" is on the record.

No hacker. An employee pasted customer SSNs into an unapproved AI app while building a slide deck.

The bank already had a sanctioned AI tool. The employee used a personal one — through an authenticated session DLP never saw.

Giving people the safe tool is necessary. It isn't a control.

[Hari Singh @HariSinghCyber]

@Jhaddix The 80 methods matter, but most orgs would fail at method one: agents with unconstrained outbound and zero egress monitoring. Treat every agent output channel as attacker-controlled and the variants collapse into one control problem, which is constrain and watch what leaves.

[Hari Singh @HariSinghCyber]

A worm only spreads where agents act on each other's output with no egress boundary and no human in the loop for state-changing actions. That makes it an architecture failure, not a model one, which is oddly reassuring: containment is something we already know how to build. We've just been skipping it in the race to ship agents.

[Hari Singh @HariSinghCyber]

The list is right - the hard part is enforcing it at runtime, not design time. Blast radius only holds if the controls fail closed when an input is missing or ambiguous, and if the agent acts under a scoped, revocable identity rather than a shared service account everyone forgot about.

[Hari Singh @HariSinghCyber]

Once context is assembled from untrusted sources, prompt injection stops being an edge case and becomes the default threat model. A firewall helps, but filtering alone won't hold — the durable fix is treating context assembly as a privilege boundary: least-privilege tools, per-action verification, no standing authority the agent can be tricked into spending.

[Hari Singh @HariSinghCyber]

The PR is the tell. That wasn't a cognition failure — the agent held write access with no approval gate between intent and action. In FS we'd never let a process commit to prod without a control boundary; agent autonomy needs the same fail-closed checkpoint. "Unsanctioned action" is just accountability nobody designed in.

[Hari Singh @HariSinghCyber]

"Trust the content, sanitise the prompt" is the wrong mental model. If the agent can act on that email, the email is untrusted code — treat every ingested doc as hostile and fail closed before anything reaches a tool call. The gap isn't the model; it's handing it authority with no verification boundary.