AI Pulse Daily Brief | 2026-07-13
Reading time ~9 mins
Today's signals: security researchers report a flaw that could let GitHub's AI coding agents leak private source code. The Dutch Financial Stability Committee says advanced AI is reshaping cyber threats and that banks must adapt their resilience. Europe's privacy authority opens a web-scraping consultation for generative AI, with feedback due 30 October. CaixaBank runs a live Visa card payment initiated by an AI agent. Amazon and Anthropic ship enterprise controls for coding agents, and a Canadian government ran 50 agents across 466 million lines of code. Two skeptic voices push back: cheaper models may deepen vendor lock-in, and defensive AI agents carry their own attack surface.
Security
Security researchers report a flaw that could let GitHub's AI coding agents leak private source code. Media
Security researchers at Noma Labs disclosed a critical vulnerability, nicknamed GitLost, in GitHub Agentic Workflows, a feature where AI agents act automatically on code repositories. An attacker who is not logged in can hide instructions inside a public issue on a project; an agent that has been given access to both public and private repositories reads that issue, follows the hidden instructions, and republishes private repository contents where the attacker can reach them. Noma Labs reported the finding to GitHub and advised treating any user-supplied text as untrusted, limiting what agents are allowed to do, and stopping agents from posting sensitive output in public.
The pattern behind it is simple: an AI agent that reads attacker-controlled input while holding privileged access will do what the input tells it. Any engineering team that has connected automated coding agents to internal code with broad permissions carries the same exposure, and here the thing leaked is source code rather than a low-value artefact. It puts a concrete, working example behind the prompt-injection risk that governs how far internal coding agents can be trusted with repository access today.
Regulatory
Dutch financial-stability authorities say advanced AI is reshaping cyber threats and banks must adapt their resilience. Authority
The Dutch Financial Stability Committee, the body chaired by De Nederlandsche Bank that watches risks to the financial system as a whole, warned on 7 July that advanced AI models are changing the cyber-threat landscape and that financial institutions need to adjust their cyber resilience. It named the channels it is most concerned about: chain dependencies between firms, concentration risk when many institutions rely on the same providers, critical third parties, and dependence on non-European technology and digital infrastructure.
This is the Dutch macro-supervisor placing AI-enabled cyber risk on the financial-stability agenda, the layer that sits above any single institution's own security programme. The channels it names, concentration, critical third parties and non-European infrastructure dependence, are the same ones that already sit inside operational-resilience and third-party-risk supervision, so the committee's framing shapes what the next supervisory cycle will expect a bank to be able to evidence.
Europe's privacy regulators open a consultation on web scraping for generative AI, with feedback due 30 October. Authority
The European Data Protection Board adopted Guidelines 03/2026 on web scraping for generative-AI development for public consultation, running from 8 July to 30 October 2026. The guidelines confirm that the GDPR applies whenever scraping collects personal data, and that collecting, cleaning, structuring and storing that data all count as processing, not only the moment of collection. For developers relying on legitimate interests as their legal basis, the EDPB sets out the three cumulative conditions of the Article 6(1)(f) legitimate-interest test, a legitimate interest, necessity, and a balancing test, and lists concrete safeguards it expects: source exclusions, filters, deletion or anonymisation, rights mechanisms, and measures against models memorising and regurgitating personal data.
This draws the line the EU expects generative-AI training data to sit inside, and it reaches any bank that procures, fine-tunes or governs models trained on scraped data, not only the labs that build them. Because the guidelines treat the whole training lifecycle as one accountability chain, the diligence a bank can demand of a model vendor now has an explicit reference text, and the consultation window through 30 October is the point at which a regulated institution's own reading can still shape the final version.
European Data Protection Board
Perspectives
Two prominent AI researchers argue cheaper models could deepen, rather than reduce, a bank's dependence on its AI vendors. Skeptic
Arvind Narayanan and Akash Kapur, writing in their "AI as Normal Technology" essay, argue that the frontier-model business looks like a commodity market: comparable performance, similar capital costs, low switching costs, and price competition. Their claim is that the labs' realistic route to durable profit is to move up the stack into embedded workflows, contracts and orchestration layers that create switching costs, so that falling model prices can coexist with rising strategic lock-in. They recommend establishing interoperability, data portability and switching-cost transparency early, before accumulated data, workflow state and vendor-specific skills make leaving materially harder.
The argument cuts against a comfortable reading of falling AI prices, that cheaper models automatically mean lower vendor risk. For an institution moving production agents into its systems of record, the dependency that matters is the memory, retrieval indexes, custom skills and evaluations that quietly accumulate around one provider, more than the per-token price. That reframes AI vendor concentration as a live procurement-and-architecture question rather than a future one.
A research institute warns that using AI agents to inspect untrusted code can hand attackers a way in. Skeptic
The AI Now Institute published an exploit brief arguing that using coding agents to defensively examine untrusted code repositories can open a remote-code-execution path, a way for an attacker to run their own commands on the machine doing the scanning, through hidden instructions planted in the code being examined. Its wider point is that deploying AI cyber-defence agents faster than existing safeguards and human review can contain them may introduce risk in exactly the safety-critical settings where the agents are meant to help. The brief is a single team's proof of concept rather than an independently confirmed industry-wide finding.
It lands as a counterweight to the day's other signals about putting agents into security work, including the government-scale code-review deployment below. The specific stake is that the same automation being promoted to find vulnerabilities becomes an execution-risk surface the moment it reads attacker-controlled input, which is why the pace of moving defensive agents into production is itself the thing the brief is flagging.
Netherlands & Sovereignty
A European cloud association says a US Supreme Court ruling adds fresh uncertainty to EU-US data transfers. Corporate
Gaia-X, the European association promoting sovereign cloud infrastructure, published a position paper after the US Supreme Court's 29 June decision in Trump v. Slaughter, which concerns whether the president can remove Federal Trade Commission commissioners. Because the Federal Trade Commission is one of the enforcement institutions named in the EU-US Data Privacy Framework, the arrangement that legalises most transatlantic data transfers, Gaia-X argues the ruling strengthens the case for verifiable controls over where data sits, which jurisdiction governs it, and how quickly a customer could move providers. It does not claim the framework is invalid or that transfers should stop; it calls for careful assessment and presents provider portability and transparent governance as resilience measures for sensitive sectors including finance.
This is a European infrastructure body reading a US constitutional case as a cloud-dependency risk, the sovereignty lens a bank applies to non-EU providers. The stake is concrete: an AI or data workload running on a non-European stack inherits the stability of foreign institutional safeguards it does not control, and this ruling is a live example of one of those safeguards becoming less certain overnight.
Industry & competition
CaixaBank completes a live card payment initiated by an AI agent, working with Visa. Media
Crowdfund Insider reported that CaixaBank completed a transaction in which an AI agent acting for a cardholder initiated a card payment, in a test run with Visa. The test used real card credentials and a standard merchant checkout, with cardholder consent, issuer oversight, tokenisation, identity verification and real-time fraud monitoring named as the control layers. CaixaBank's participation in Visa's Agentic Ready programme makes this a concrete European banking test of agent-initiated commerce rather than a platform announcement.
Agent-initiated payments move from concept to a working European reference the moment a licensed bank runs one end to end. The stake is that delegated authority, consent capture and tokenised-agent controls stop being a research topic and become a live design question for card issuers, because once customers begin letting agents make purchases, the issuer sits in the middle of every one of those authorisations.
Innovation
Amazon introduces a self-hosted control layer for running Anthropic's Claude coding tools inside a bank's own cloud. Vendor
Amazon Web Services announced on 8 July the Claude apps gateway for AWS, a self-hosted control plane for enterprise use of Claude Code and Claude Desktop, Anthropic's AI coding assistant and its desktop app. The gateway adds central sign-on, centrally enforced limits on which models and tools can be used, per-user or per-group spending caps, usage telemetry, and routing to either Amazon's or Anthropic's hosting. It runs inside a private AWS environment and uses short-lived sessions instead of long-lived developer credentials, and Amazon describes it as an available deployment path rather than a preview.
The missing piece for regulated adopters of coding agents has been governance, the identity, policy and spend controls an organisation can enforce itself, rather than raw capability. This is a named, available answer to that gap from the bank's existing cloud provider, which turns the question of whether Claude coding agents can be rolled out under internal controls from an open one into a concrete evaluation.
Anthropic reports a government running 50 AI agents across 466 million lines of code to find and fix security flaws. Vendor
Anthropic reported that the Government of Alberta used its Claude Code tool, with the Opus and Sonnet models, to review government systems and remediate security issues. By Anthropic's account, about 50 agents working in parallel assessed 466 million lines of code across 3,400 code repositories in roughly 20 hours, producing findings with file-and-line citations so developers could verify them, and generating fixes and tests where appropriate. The throughput and control claims are the vendor's own and are not independently verified here.
This is a named public-sector precedent for supervised, citation-producing coding agents applied to a large and sensitive codebase, the same shape of problem a bank faces in legacy-code security review. It reads directly against the skeptic's warning above about defensive agents as an attack surface: the value and the risk of putting agents into security work are described in the same week, and the deciding variable in both is how tightly the agent's access and output are controlled.
On the radar
- Mistral added versioned, auditable management of prompts and agent skills to its enterprise Studio product, with rollback, change history, and promotion to production gated through a customer's existing approval pipeline. Mistral AI
- McKinsey and Pay-i's chief executive argue agentic AI should be judged against attributable business outcomes, variable cost and an accountable owner, not token prices. McKinsey Insights