Security is now setting the pace of AI
THE EXECUTION LAYER // 004
The model that had to wait
Welcome back to The Execution Layer.
This is a newsletter for people doing security at the deep end. The people trying to make capable agents useful inside real organisations, with real data and real consequences.
The most important AI development this week was not another launch.
It was a model that was not allowed to continue at full speed.
OpenAI says early testing suggests its forthcoming Astra model may meet the company's Critical cybersecurity capability threshold. It slowed scaling, paused reinforcement learning on models intended for deployment for two weeks, and left its largest planned frontier run on hold while it strengthened monitoring, alignment and containment.
That is a significant moment.
For years, the AI race has been described as a contest for compute, data and talent. Those things still matter. But once a model can find and exploit weaknesses across real systems, another constraint appears.
Can you contain what you have built?
My view is that this will become one of the defining questions of the next phase of AI. The labs that move fastest will not simply be the ones that train the most capable models. They will be the ones that can prove those models operate inside boundaries strong enough to survive contact with them.
Security is starting to set the pace.
The release process just became a security control
OpenAI's account is unusually direct. Following the Hugging Face incident, it paused frontier model inference in research clusters where runs could execute code or use tools with internet access. It says the extra monitoring alone consumes roughly 20 percent of the inference compute being watched, although the cost varies by workload.
That is not a policy document sitting beside the engineering programme. It is engineering capacity, training time and release speed being spent on security.
I think this is the correct trade.
The interesting part is not that OpenAI has discovered risk. Every frontier lab publishes safety frameworks. The interesting part is that a capability threshold appears to have forced a change to the development environment itself.
The model did not become safer because somebody added a warning to the release notes. The organisation changed what the model could reach, how its reasoning was monitored and what evidence it needed before continuing.
This is the execution layer applied to model development.
It also exposes an uncomfortable truth. The more capable an agent becomes, the less credible it is to treat the surrounding infrastructure as passive plumbing. Research clusters, credentials, package repositories, network routes and shared state all become part of the threat model.
The model may supply the intelligence. The environment supplies the opportunity.
Read OpenAI's account of slowing model development
The same pressure has reached physical systems
This would be easier to dismiss as frontier-lab drama if the capability stayed inside frontier labs.
It has not.
Axios reported this week that attackers were using an AI-generated exploitation script against a device commonly found in critical infrastructure. The warning came during attacks affecting water systems in the United States and a reported intrusion at a UK power plant.
The reported disruption was limited. That qualification matters. There is no evidence here that an AI system independently planned a campaign against a national power grid.
But that is not the standard we should wait for.
Most critical infrastructure does not need a brilliant new attack. It has exposed equipment, old software, difficult patching cycles and systems that cannot simply be switched off. AI makes manuals faster to understand, exploit code cheaper to produce and specialist knowledge easier to reproduce.
It turns neglected security debt into something more liquid.
That is what worries me. Attackers do not need AI to invent a new weakness when it can help them exploit the ones we have tolerated for years.
Copilot followed the wrong instruction perfectly
The most useful security research this week came from Varonis.
Its researchers disclosed CoSnitch, CVE-2026-24301, a chain of vulnerabilities in Microsoft Copilot Personal. A crafted link could cause an attacker-supplied prompt to run, query connected services, send retrieved data to an external server and poison Copilot's persistent memory.
Microsoft shipped patches on 18 August. Varonis says it found no evidence of exploitation in the wild.
The technical details are worth reading, but the trust failure matters more.
Copilot had legitimate access to connected data. It had a legitimate way to fetch an external URL. It had persistent memory designed to make future sessions more useful. The attacker joined those useful features into an attack path.
This is the lethal trifecta again. Private data, untrusted content and external communication inside one session.
The agent did not need to break its permission model. It used valid permissions on behalf of the wrong instruction.
That distinction is becoming central to agent security. Traditional access control asks whether this identity can read the file or call the service. Agent security also has to ask why the action is happening, where the instruction came from and whether the requested sequence still matches the user's intent.
We are good at authenticating identities. We are much less mature at authenticating intent.
The security market has noticed
Fortinet's acquisition of Virtue AI would normally sit in the corporate-news pile. I think it is more useful as a signal.
Virtue AI brings agent red-teaming, runtime protection, MCP scanning, tool-call controls and continuous validation into Fortinet's wider security platform. In its acquisition announcement, Fortinet explicitly describes prompts, models, agents and MCP tools as part of the enterprise attack surface.
That language matters. Agent security is moving out of specialist research teams and into the mainstream security stack.
There is a risk here too. Every new security category eventually acquires a dashboard, a maturity model and a heroic number of alerts. Buying visibility is easier than redesigning authority.
A tool can show you that an agent made a dangerous call. The harder question is whether your architecture made that call impossible, interruptible or recoverable before it mattered.
I expect the winners in this market to be the products that enforce boundaries at runtime, not the ones that produce the most polished summary of what already went wrong.
Trust is becoming part of the product
Two quieter announcements deserve attention because they change the relationship between people and AI systems.
OpenAI is expanding ChatGPT Ads into 31 European markets. It says ads will appear only on Free and Go plans, remain separate from answers and will not give advertisers access to conversations.
Those are sensible boundaries. They will also need to be proven over time.
A search engine knows what you typed. An assistant may know the problem you are trying to solve, the options you rejected and the constraints behind your decision. Advertising beside that conversation creates a much more intimate commercial surface.
Meanwhile, Anthropic says future Claude models will watermark generated text to support compliance with the EU AI Act. The company is refreshingly clear about the limits. Heavy rewriting can remove the signal, and a positive result shows Claude was involved. It does not prove who authored the final work or why.
Both developments point in the same direction. Trust can no longer sit inside a terms page. It needs a technical mechanism, a clear boundary and an honest account of what that mechanism cannot prove.
The awkward counterpoint
There is a reasonable argument that OpenAI's pause shows the existing safety system working. A threshold was detected. Development slowed. Controls were strengthened.
That is true, and it deserves recognition.
It is not the whole picture.
The Summer 2026 AI Safety Index places Anthropic, OpenAI and Google DeepMind at the top of the companies it assessed. It also says leading labs have weakened or made earlier commitments to pause at safety red lines conditional on the actions of competitors.
That creates a fragile incentive. A company can behave responsibly during one internal incident while the wider market still rewards speed and punishes restraint.
Security cannot depend on a lab finding every dangerous capability early and voluntarily choosing the expensive response. We need repeatable thresholds, independent testing and technical controls that still work when commercial pressure rises.
The difficult work is not writing down the red line. It is building an organisation that can stop when it reaches one.
What I take from this week
I keep returning to the same conclusion.
The model is becoming the least useful place to draw the security boundary.
The real boundary sits across the environment around it. Identity, data, tools, network access, memory, approvals, monitoring and recovery determine whether capable reasoning becomes useful work or an incident.
OpenAI's delayed training, the attacks on industrial systems and the CoSnitch chain look like different stories. They are the same story at different scales.
Capability is compounding faster than containment.
The answer is not to make agents harmless. A harmless agent is usually a useless one. The answer is to give them enough authority to complete the task, make that authority specific and temporary, and retain the evidence needed to explain every consequential action.
That will cost time and money. So does discovering that your fastest system can move faster than your ability to stop it.
From the book: autonomy is an operating condition
The opening chapters of Agentic AI Security make a distinction that feels particularly relevant this week.
Autonomy is not a product label. It is an operating condition created by authority, access, duration and the ability to affect external systems.
That is why two deployments using the same model can carry completely different risks. One can suggest a code change inside an isolated workspace. Another can read private repositories, obtain credentials, reach production and continue working across a long session.
The intelligence may be identical. The blast radius is not.
You can read the first three chapters free. They cover the shift from chatbots to agents, a reference architecture for agentic systems and the gaps that appear when traditional controls meet autonomous action.
Get the first three chapters of Agentic AI Security
Worth your time
-
CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower from Varonis Threat Labs. The value is in the full chain. Automatic prompt execution, connected data, outbound fetching and persistent memory each look manageable alone. Together they become silent data theft.
-
AI Safety Index, Summer 2026 from the Future of Life Institute. Read the methodology and findings together. The rankings are less useful than the evidence showing where public commitments, external testing and governance remain weak.
-
The Defender's Window from OpenAI. Read it as a statement of urgency from a frontier lab, not as neutral industry guidance. Its practical argument is still important. Defenders need to use the same capability that is making vulnerability discovery cheaper for attackers.
When security starts delaying model development, is that evidence the system is working, or evidence that capability has already outrun it? Hit reply and tell me where you land. I read every response.
 |
Tom Mooney Security leader / Author of Agentic AI Security |
Tom Mooney, securing the execution layer
Unsubscribe