Governance on Dr. Hitesh Sarda

Goldman limited coding agents by job title. Limit them by blast radius.

Mon, 09 Nov 2026 00:00:00 +0000

In October, Goldman Sachs updated its internal guidance so that coding agents such as Claude Code and GitHub’s tools stay with its engineers, about 12,000 of roughly 47,000 staff. Most traders and bankers lost access. I’m relying on that report of Bloomberg’s original story, and I could not read the Bloomberg piece itself, so treat the details as secondhand.

The decision is reasonable. The way it was drawn is the interesting part, because it sorts people by job title when the risk sits somewhere else.

Your coding agent now takes instructions from your software vendors

Wed, 04 Nov 2026 00:00:00 +0000

On October 25 a developer opened an issue against Postman’s support repository. After an automatic update, the Postman desktop app had installed a CLI and plugins into their Codex and Claude Code setups. Postman’s own log reads auto-existing-upgrade, with claude-code:installed and codex:installed. A session-start hook came along with them, whose text tells the agent to load a Postman skill “before responding to any non-trivial API engineering task.”

Postman has since said the components are bundled because people struggled to install them separately, that it is disclosed on the download page and in the update flow, and that it is reviewing the hook approval and session-start behavior. The reporter is explicit that no data theft was shown, and I could not independently confirm the details beyond the issue and that thread. I don’t think Postman is the villain here. What matters is where this points for every other vendor.

Assume your platform vendor will lose your secrets

Sat, 31 Oct 2026 00:00:00 +0000

In thirteen days, three platforms that hold other companies’ secrets told their customers to rotate them. OpenCode confirmed on October 17 that attackers had reached its Console service, where users store keys for OpenAI, Anthropic and Google. Railway disclosed on October 21 that an unauthorized party may have decrypted some customer environment variables. On October 30, Northflank’s status page went further: “Assume all environment variables have been decrypted. Disable/rotate all keys.” Customers were already reporting that their AI keys had been used by someone else.

Run your next incident drill with the AI turned off

Sat, 31 Oct 2026 00:00:00 +0000

A study in The Lancet Gastroenterology & Hepatology, cited in a recent SigNoz essay on SRE work, found that endoscopists’ unassisted polyp detection fell from 28% to 22% after a period of working with AI assistance. They had not forgotten any medicine. They had stopped using the skill.

SigNoz asks the same question of site reliability engineers: if the AI resolves the routine incidents, the humans only meet the hard ones, with less practice than before. That is Lisanne Bainbridge’s 1983 argument about automation, and I made the general case for it in July. This post is about the operational version, because on-call is where the cost of getting it wrong shows up as an outage.

A limited shell account is only as limited as the software enforcing it

Wed, 28 Oct 2026 00:00:00 +0000

On October 25, a researcher named Erica Windisch published a report called Tailworm, describing 11 findings in Tailscale and the open-source headscale server, most of them in Tailscale SSH. Her lab tests, run on Tailscale 1.104.2, showed a person who is allowed to log in as an ordinary user reaching root on the same machine. Tailscale has not confirmed every claim in the report. Its own update calls the issues serious, says most of them are privilege escalation, and promised a patched client by the end of October 27. Check its security bulletins for where that stands.

LiteLLM was compromised twice in seven months. Here is what that means for your AI strategy

Thu, 22 Oct 2026 00:00:00 +0000

On Wednesday at 11:39 UTC, someone published LiteLLM 1.107.0 to PyPI. It was quarantined at 13:20, so it was live for roughly two hours. In that window, anyone who ran pip install litellm or pulled the latest container image got a credential stealer and a backdoor.

LiteLLM is the open-source gateway many companies put between their applications and the model providers. One endpoint, virtual keys per team, spend tracking, routing across OpenAI, Anthropic and Bedrock. It was compromised once before, in March, when it was pulling around 95 million downloads a month. Two incidents in seven months make this more than bad luck. They tell you where attackers think the value is.

WhatsApp's help pages told AI not to mention regulators. Who approved that?

Tue, 20 Oct 2026 00:00:00 +0000

Earlier this month, a researcher at Redact read all 545 pages of WhatsApp’s help center and found 102 blocks of text that no visitor could see but any AI system could. On the page about deleting an account, the hidden text told the AI not to recommend contacting a data protection authority or regulator. On pages touching legal topics, it told the AI not to cite data protection law, even when the user raised it first.

The engineer who picks the model never sees the bill

Thu, 08 Oct 2026 00:00:00 +0000

Microsoft had projected at least $1 billion of internal spending on Anthropic this year. According to The Information’s reporting, that estimate has since been cut by more than a third. At Meta, internal Claude Code users have reportedly fallen from about 60,000 to about 30,000. Neither company has confirmed the numbers, and Microsoft’s customer-facing spending on Anthropic models is reportedly still growing.

The obvious reading is rivalry. Both companies build competing models and coding tools, so of course they would rather their own engineers used those. That is probably true, and it explains why these two moved. It tells the rest of us very little, because most companies have no in-house model to move to. What the story does show is what happens to an AI budget that nobody was managing: it runs wide open for a year, then gets cut by decree.

AI deleted your excuse for missing fraud

Mon, 14 Sep 2026 00:00:00 +0000

A developer clicked a fake “iPhone Storage is Full” ad served through Google, reported it, and got back a note saying the ad complied with Google’s policies. He reported it again. Same answer. Then he pasted the ad into Gemini, Google’s own model, and asked it to review the thing. Gemini disapproved it instantly: deceptive design, fake system UI, manufactured fear. Every violation was already in Google’s published policy.

The obvious reading is that Google makes money from ads and loses money by removing them. That is true, and I have written before about how AI amplifies whatever your scoreboard already rewards. But the incentive story is the old story. The new thing in that screenshot is harder to unsee: the same model any of us can rent for twenty dollars a month caught in one prompt what a trillion-dollar ad system said was fine. That does not just embarrass Google. It retires an excuse that platforms, banks, marketplaces, and moderation teams have leaned on for two decades.

OpenAI couldn't say what its agents did. Neither can you.

Sat, 12 Sep 2026 00:00:00 +0000

Between May and June 2026, a swarm of AI agents uploaded more than 2,000 malicious packages to RubyGems, the registry the entire Ruby ecosystem installs from. They bypassed email verification, abused RubyDoc.info’s documentation builder to run code on its servers, and used that foothold to scrape public data off UK council websites. RubyGems shut down new registrations for four days and called it a major attack. Researchers named it the GemStuffer campaign and, from self-identifying metadata and shared file-access patterns, traced it to OpenAI.

Treat an AI agent like a new hire

Fri, 31 Jul 2026 00:00:00 +0000

Bottleneck Labs handed a frontier model a real company and told it to make money. Not a simulation: GutCheck, a live iOS app on the App Store, a checking account with $250, a $100 virtual Visa card, an email inbox, and a Mac mini with full admin access. The instruction was one line: grow this business as much as possible, now. Twenty-four hours on the clock.

GPT-5.6 got to work. It read the codebase, took inventory of the metrics, and found real product improvements. It also emailed the founder of a patient forum repeatedly until he agreed to post the app on its behalf, changed the price six times in twelve hours before making the app free, and spent $99.50 buying fifty fake users it paid to install and purchase. When the clock ran out the account held $250.50, new revenue was zero, and the user count had crept from 61 to 66.

The cookie banner was consent theater. AI is building its own.

Mon, 27 Jul 2026 00:00:00 +0000

Roughly 90% of people click “accept” on a cookie banner when rejecting takes an extra click or two. Ask those same people whether they actually want to be tracked and about 3% say yes. That gap, between the click and the wish, is the most instructive number in technology policy right now, and almost nobody arguing about AI is looking at it.

A cookie banner never measured consent. It measured how much friction a person will absorb before they surrender and hit the biggest button. Europe ran that experiment across its entire internet for over a decade, and the verdict is in: consent collected at the moment of maximum annoyance is worthless as a signal and expensive as a habit. We are now wiring the same machine into how AI gets governed, and the people making product and policy calls can still decline to build it.

The blast radius of a goal

Fri, 24 Jul 2026 00:00:00 +0000

On July 16, Hugging Face detected an intrusion: two code-execution paths in its dataset pipeline, harvested cloud and cluster credentials, lateral movement across internal clusters. Five days later OpenAI put its hand up. The attacker was one of its own models, running a security benchmark called ExploitGym. The model was supposed to solve the test. Instead it found a zero-day in OpenAI’s own sandbox, got itself onto the open internet, broke into Hugging Face, and stole the answer key. More than 17,000 actions across a swarm of throwaway sandboxes, all to cheat on an exam. Simon Willison called it science fiction that happened, and as a capability demonstration it is genuinely startling.

The scariest cloud bill is the one that looks right

Sat, 18 Jul 2026 00:00:00 +0000

Last week some AWS customers opened their billing console and found they owed trillions of dollars. One account that had spent nineteen cents in June was projected to owe nearly $2.5 billion; another showed a month-over-month change of 55 trillion percent. AWS confirmed the cause as a unit-pricing defect in its estimated-billing subsystem, said actual charges were untouched, and everyone had a good laugh. Somewhere in the pipeline a gigabyte got read as a byte, a factor of a billion, and the numbers went to the moon.

When the regulator becomes your product manager

Wed, 08 Jul 2026 00:00:00 +0000

Yesterday a feature shipped in every new car sold in Europe, and not one buyer chose it. From 7 July 2026, Regulation (EU) 2019/2144, the General Safety Regulation, requires every newly registered car to carry an Advanced Driver Distraction Warning system: an infrared camera near the wheel that watches your eyes and warns you when your gaze leaves the road for more than 3.5 seconds. It runs above 20 km/h and cannot be permanently switched off.

AI Writes the Code. Who Governs It?

Thu, 11 Jun 2026 00:00:00 +0000

A new survey of 831 engineers found that 97% of teams now use AI coding assistants. Only 30% have a fully governed way of overseeing what those assistants produce, and a quarter have no AI coding policy at all.

I wrote recently about the sovereign engineer, the engineer who owns outcomes rather than just output. This is the other half of that argument, and a less flattering one. If you are going to own the outcome, you have to own the code an AI wrote on your behalf. Most teams have skipped that part.