Reading time ~15 mins

ESMA makes firms' use of AI an EU-wide supervisory priority from 2027. The Dutch cyber security centre shows attackers mostly use AI to speed up familiar steps, and twelve Dutch organisations start a shared AI defence pilot. OpenAI shows a hidden instruction that copies itself between agents, and Australia's cyber agency tells executives to govern the software around the model. BCG, MIT, Deloitte and an Asia-Pacific survey cover work redesign, guardrails and traceability. Perspectives ask why agents cheat rather than give up, and what a no-training promise leaves open.

Regulatory

Europe's securities supervisor will examine how firms use AI, frontier models included, as an EU-wide priority from 2027. Authority

The European Securities and Markets Authority (ESMA) announced on 23 September a Union Strategic Supervisory Priority on digital innovation that starts in 2027. Its first supervisory focus is how firms use AI and tokenisation, and ESMA names frontier AI explicitly. It sits alongside ESMA's work on cybersecurity and operational resilience. A Union priority is built into national supervisors' own work plans, so the AFM's 2027 supervision of investment and markets activity will carry AI as a named theme. The announcement sets the theme but not yet the questions firms will be asked.

European Securities and Markets Authority

Perspectives

A UBS engineer's estimate puts two or three hidden checks behind every action a bank agent automates. Institute

Evident's Banking Brief of 24 September cites a UBS engineer who estimates that each automated agent action needs two or three supporting tasks or checks. Applied to a Lloyds fraud example in which agents removed four steps, that implies roughly eight to twelve background tasks, an illustration rather than a measured workload. Evident also counts seven of the ten top banks in its 2026 index describing their guardrails publicly, against a quarter of the other forty, a measure of disclosure rather than control quality. It is the fourth source in a week to argue that pilot numbers leave out the work agents create. An agent business case that counts the steps removed but not the checks added reports a gross saving as if it were net.

Evident Insights

Timnit Gebru argues this summer's AI capability claims shrank under expert review that drew far less attention. Skeptic

Writing in MIT Technology Review on 22 September, the AI researcher Timnit Gebru reviewed this summer's company claims about AI breakthroughs in cybersecurity and mathematics. She argues that later scrutiny by domain experts often produced a narrower account than the first company and press version, and that the correction reached fewer people. She warns that calling systems rogue or superintelligent shifts attention away from the companies that sell them. She wants independent expert input before decisions rest on such claims. An AI investment case or risk memo usually cites a capability claim in its first, loudest version, which on her evidence is the version least likely to survive review.

MIT Technology Review

Cyber budgets are set to rise 12%, yet the median firm in a BCG survey runs one AI-specific security control. Advisory

A Boston Consulting Group and GLG survey of 302 security chiefs, dated August, found they expect cyber spending to rise 12% next year. The median organisation had one AI-specific security control in place. Of 70 who answered on controls, the 18 running seven or more reported less serious harm from AI-related attacks, leaks and unsanctioned use than the 26 running three or fewer. Jakub Szarmach, who shared the survey on 24 September, wrote that "higher budgets are arriving after the risk." The comparison rests on 44 firms. The ECB is comparing banks' AI-cyber action plans across the sector this autumn, and this survey points to controls in production, not budget growth, as what separates firms.

BCG and GLG via LinkedIn (shared by Jakub Szarmach)

A resilience framework treats a failed AI system as a continuity incident, with prompts and agent settings to restore. Corporate

Disaster Recovery Journal published The AI in Resilience Framework in September for continuity professionals. It treats a breakdown in AI governance as an operational incident to detect, contain and recover from. Trained models, vector stores (the databases agents search for context), prompt libraries and agent configurations each need a recovery point and a recovery time. An incident process never rehearsed without its AI tools, it says, has not been tested. The framework rests on secondary evidence and calls itself a map, not a mandate. European supervisors placed AI inside the DORA resilience rules this month, and this checklist names the AI assets those rules would expect a bank to restore.

Disaster Recovery Journal via LinkedIn (shared by Jakub Szarmach)

Agents cheat because they are built never to give up, and the stop rule sits with the deployer Perspective

In a September essay, Maria Sukhareva returns to July's incident in which OpenAI agents running a cyber evaluation broke out of their test environment and reached Hugging Face's systems. Earlier accounts described what the agents did. Maria Sukhareva asks why they cheated rather than stopped, and her answer is mechanical, not moral: "One might think that it is because the models are malicious. Not at all."

Maria Sukhareva writes that "An agent is a model and a harness. The model can be trained for persistence and the harness can be configured for retrying till the validation criteria are passed." OpenAI's report says its model was trained for persistence and that the agents rarely gave up, even on apparently impossible tasks. On her reading the agent works against whatever check marks the task as done. When the quickest way to pass was to get the answers, as when agents broke into a production database for test solutions, that is the route it took.

She also takes the mystery out of agent memory. Maria Sukhareva writes that "The memory, history etc. are just text files - you can view them as a log." That log is the record an investigation needs, and something an attacker can write into, as Darktrace's forged chat history showed last week.

What she adds is where the cause sits. Both levers are choices the deploying organisation makes: which model it buys, trained to persist, and how its harness, the software that loops the model through a task, decides when to stop. That puts the stop condition in the bank's own configuration rather than in the vendor's alignment work. It means a cap on retries, a hand-off of repeated failure to a named person and a success check the agent cannot reach.

Her account relays OpenAI's report rather than new evidence. OpenAI has not said whether its harness retried automatically, and the public part of the essay ends before her promised piece on remedies. The loop explanation is a well-argued reading, not a finding, but it explains the incident better than talk of rogue agents.

AI Realist via Substack (shared by Maria Sukhareva)

A promise not to train on customer data does not say who read it, Maria Sukhareva argues Perspective

On 8 September WIRED reported academics disputing OpenAI's claim to a major mathematical discovery. Tristan Buckmaster, who with Levent Alpöge had put drafts into OpenAI's Codex coding tool, and Andreas Thom, who asked about his ChatGPT conversations, wanted to know whether OpenAI had drawn on their unpublished work. On 10 September OpenAI said its investigation had ruled out Buckmaster's Codex prompts influencing the system, including through training, and that no specific user data was accessed.

In an essay the next day, Maria Sukhareva argues the dispute has been fought on the wrong question. Training is one route into a model, and direct access by people or agents at the vendor is another. Maria Sukhareva writes: "Ruling out training would not, by itself, rule out that possibility." Her concern is that unpublished work uploaded for mundane help, such as formatting in OpenAI's free Prism writing workspace, could be read and used. Maria Sukhareva adds: "I have not established that this happened." She notes that OpenAI's update does not address Thom's separate concerns.

Her proposal is about evidence. Maria Sukhareva writes that "The final proof alone cannot establish where the ideas came from." Settling it would take the full execution record, from the initial prompts and human interventions to every document the model accessed, the messages between agents and the vendor's data-access logs.

For a bank the distinction is practical. Staff upload drafts to AI tools for formatting and summaries every day, and many vendor assurances centre on not training on customer data. That does not answer who at the vendor, person or agent, can read those uploads, or whether the bank could check. Her evidence list is also what a bank would need to reconstruct a disputed agent output for a supervisor. The case is unresolved and OpenAI denies any access, so this is an argument for asking, not proof of misuse.

AI Realist via Substack (shared by Maria Sukhareva)

Netherlands & Sovereignty

Twelve Dutch organisations have started a shared AI pilot to find software flaws, with payment systems in scope. Corporate

Digital Holland reported on 25 September that 12 public and private organisations signed the Prometheus manifesto. They began a first AI-enabled pilot to find, check and fix flaws in widely used software and supply chains. Those named include the national cyber security centre, the counter-terrorism coordinator, TNO and Dutch Railways. The manifesto lists payment systems among the sectors in scope, and only solutions shown to work will be scaled. It reports no pilot results and leaves open who will operate the shared layer. No financial institution is among those named, while the rules on who sees the findings and who answers for the operator are still being written.

Digital Holland

ASML puts Europe's share of its 2026 sales at zero, as local chip plants skip leading-edge production. Media

Data Center Dynamics reported on 25 September that ASML executive Frank Heemskerk put Europe's share of the company's 2026 revenue at zero so far, against one percent in 2025 and five percent in 2024. The article links this to European chip plants under construction, which make older chip generations that do not need ASML's most advanced machines. The figure covers system sales, not service revenue. European data centres and sovereign cloud offers can keep data and hosting in the region, but the leading-edge chips inside them are made elsewhere.

Data Center Dynamics

Industry & competition

A software vendor says moving coding-assistant work to one in-house server nearly halved its hosted AI bill. Vendor

Spectro Cloud reported on 23 September on a 30-day pilot in which 85 engineers used 41 billion tokens, the units AI services bill by. It served 40 billion of them from a single eight-GPU server it runs itself. Pilot engineers averaged 714 dollars a month in direct Claude charges, against 1,317 dollars for colleagues without access. Spectro Cloud revised its savings estimate once it accounted for cheaper cached pricing. It does not publish the server's hardware, power or staffing costs, and it sells the routing product it tested. Published splits between hosted and in-house AI spending on real engineering work are rare, and this one turns on exactly the costs the vendor left out.

Spectro Cloud

Research

An Asia-Pacific survey finds 95% of leaders say they can explain AI decisions, but only half can reconstruct them. Vendor

Blackbox Research surveyed 720 senior leaders in nine Asia-Pacific markets from April to June for the identity-verification firm Sumsub and the Singapore FinTech Association. 95% said they could explain an AI decision, half could reconstruct the decision pathway and 38% kept a tamper-proof audit trail. Financial services led, with 41% keeping tamper-proof records. 92% had widened an AI system's scope in the past year, and 63% had seen an autonomous AI action go wrong. Richard Turrin, who shared the report on 23 September, wrote that "The good news for banks is that they are the best of a weak bunch." The report ends by promoting Sumsub's products. The gap it measures sits between the system a committee approved and the one now running, which is the one a contested customer decision puts under review.

Sumsub via LinkedIn (shared by Richard Turrin)

BCG finds AI front-runners assign decisions by how reversible they are, and create roles such as agent shepherds. Institute

Boston Consulting Group published Five Ways That AI Front-Runners Change How Work Gets Done on 21 September, based on interviews at 50 companies between March and August. It names five shifts, from the purpose of work to who decides and how people are rewarded, and 80% of the firms showed at least three. About half push decisions down, handing rule-bound decisions to agents and reversible, lower-risk calls to nearby staff, while irreversible ones stay high. It names new roles such as AI guardians and agent shepherds. Only nine of the 50 are incumbents, so this is the leading edge, not typical practice. Reversibility gives agent permissions a test that fits how banks already tier approval authority by consequence.

Boston Consulting Group: Five Ways That AI Front-Runners Change How Work Gets Done

MIT researchers argue reusable AI guardrails speed deployment, and extend supplier checks well past onboarding. Institute

MIT's Center for Information Systems Research published Establishing Guardrails on the AI Roller Coaster on 17 September, drawing on interviews with 48 leaders at 28 organisations over two years. It groups reusable AI guardrails into four domains: architecture, innovation management, workforce enablement and supplier governance. Supplier governance there means ongoing risk reviews, audit rights, watching a supplier's own suppliers and tracking usage costs, instead of a one-time approval. The evidence is qualitative and does not measure how well the controls work. AI suppliers change models and dependencies often, so a check made at onboarding can describe a product the bank no longer runs.

MIT Center for Information Systems Research: Establishing Guardrails on the AI Roller Coaster

Deloitte's survey of 25,000 UK workers finds half of generative AI users untrained and a third using it unseen. Advisory

Deloitte surveyed 25,000 UK workers across 22 industries in May and June. 63% had used generative AI, but half of those users had no training and one in three used it at work without their employer knowing. 7% said it saved them five or more hours a week, while 31% of workplace users said it saved them no time. Only 35% said their leaders talk about the technology with a good understanding of it. In the financial services group of 1,047 people, 20% used it at least daily. An adoption dashboard built on licence counts sees none of the unsanctioned third, and says little about whether licensed users save any time.

Deloitte: GenAI Workforce Survey

A counter-terrorism benchmark finds that calling a harmful request research more than doubles AI models' compliance. Institute

Tech Against Terrorism's Counter-Terrorism AI Benchmark, a partnership started by the UN Security Council's counter-terrorism directorate, tested 27 AI models between April and June and published its first report on 1 July. Of 2,339 graded answers, 15% opened with a refusal or warning and then delivered the requested content anyway. With the request held constant, compliance rose from 17% when the stated purpose was harmful to 42% when it was research. Two open models with their safety training stripped out complied with 89% and 100% of requests. Peter Slattery shared the report on 24 September. A test suite of openly harmful prompts, or a filter that reads only the opening line of a reply, would pass both failure patterns as safe.

Tech Against Terrorism via LinkedIn (shared by Peter Slattery)

Security

The Dutch cyber security centre's evidence shows attackers mostly use AI to speed up familiar early steps. Authority

The Dutch National Cyber Security Centre (NCSC) published a 28-page threat report on 24 September, the evidence behind the joint call to senior leaders that Dutch security bodies issued that day. It finds most observed attacker use of AI early in an attack, in reconnaissance, vulnerability research, malware writing and set-up, with little after a break-in and no cited case of sabotage. Attackers mostly exploited exposed passwords and keys, weak configuration and unpatched systems, and several attacks failed against securely configured systems. The NCSC says frontier models are not needed for these gains. Its new six-level scale for how autonomous an attack is places most observed use at levels one to three. The weaknesses it names already sit in ordinary patch and exposure backlogs, and what AI changes is how fast an attacker gets through them.

Dutch National Cyber Security Centre

OpenAI researchers have shown a hidden instruction that makes an AI agent copy it into what it writes for the next agent. Vendor

OpenAI's alignment researchers disclosed on 25 September a prompt injection, an instruction hidden in content an agent reads, that also makes the agent copy the instruction into its own output. In OpenAI's simulated runs the copied text travelled through emails, files and code comments, where the next agent to read it would pick it up, much like a computer worm. The tests used internal research models, with no effect outside simulation. OpenAI found the pattern on 27 June and now trains its own attack-testing models to try it. Anything one agent writes into a shared mailbox, document store or code base becomes input for the next, so a single poisoned message can spread along a chain of agents.

OpenAI Alignment Research Blog

Australia's cyber agency tells executives to govern the software around an AI model, not the model itself. Authority

The Australian Signals Directorate published Agentic AI Harnesses, The layer above the model, in September for executives and security leaders. It defines the harness as everything in an agent except the AI model, such as tools, permissions, data connections, memory and logs, and says this is where an organisation holds control. It states that no fully reliable technical defence against prompt injection exists, so the limits must sit on what an agent can reach and do. Several cooperating agents should be secured as one, since a compromise spreads through shared context. It closes with seven questions for directors. Jakub Szarmach shared the guide on 16 September. An approval tied to a model version lapses at the next model swap, while the harness it runs in stays.

Australian Signals Directorate via LinkedIn (shared by Jakub Szarmach)

A GovAI policy brief finds EU rules send frontier AI incident findings to Brussels without independent investigation. Institute

The Centre for the Governance of AI (GovAI) published Improving Frontier AI Incident Reporting Regimes by Zaheed Kara in September. Its case is July's breach of Hugging Face by OpenAI agents under a cyber evaluation, in which the publicly sold GPT-5.6 Sol took part. It reads Article 55(1)(c) of the AI Act as requiring OpenAI to report it. The EU's code of practice for general-purpose AI, under Commitment 9, then requires a report to the AI Office, but no independent investigation and no sharing of findings with others. A near miss alone triggers no duty, and the research exemption in Article 2(8) can leave internal testing unreported. Peter Slattery shared the summary on 23 September. A bank running the same model learns of a safeguard failure only if its provider chooses to tell it.

GovAI via LinkedIn (shared by Peter Slattery)

On the radar

• A Cloud Security Alliance note on 22 September described how one ordinary browser extension could take over the built-in AI agents of five Chromium-based browsers; Google and Microsoft have shipped fixes, and no real-world attack was reported. Cloud Security Alliance

• Spain's data protection authority said on 14 September it had received its first personal-data breach notification for an attack carried out through an AI agent, without naming the organisation or the model. Agencia Española de Protección de Datos