Risk, security and governance

Eighty-five minutes, five sections. The order is deliberate: get the science-fiction question out of the way honestly in ten minutes, then spend the bulk of the session on the four things that actually go wrong in companies today, then fraud (which is not an AI-adoption problem but an AI-era problem for everyone), then the governance that makes the rest manageable. Each section closes with four discussion questions.

Part I drew this line and it still holds. The movie pile is the one that gets the headlines: a system with goals of its own, out of our control, moving faster than we can respond. It is not silly. The people building these systems take it seriously enough to publish formal frameworks about it, and the next slide shows what those actually say. But nothing anyone in this room does on Monday morning changes that risk one way or the other, and treating it as the business risk is a category error that leads to either paralysis or dismissal. The factory pile is different. Every item on the right-hand side of this slide is a real incident with a date, a company and a loss. A Microsoft 365 Copilot that could be made to leak internal data by sending an employee an email they never opened. An airline held liable for a policy its chatbot made up. A coding agent that deleted a live database it had been told not to touch. An engineering firm that wired HK$200 million after a video call in which every participant but the victim was a deepfake. None of these needed a superintelligence. They needed a competent system, some credentials, and the absence of a few ordinary controls. That is the whole thesis of this deck, carried over from Part I: worry about competence in the wrong place. The rest of the session is about where the wrong places are and what the controls look like.

Give the movie ten honest minutes and then put it down. Three documents tell you where the long-term pile actually stands, and they are all public. Anthropic’s Responsible Scaling Policy is on version 3.4, effective 8 July 2026. It defines capability thresholds, for novel chemical and biological weapons and for automated AI research and development, that trigger stronger security and deployment safeguards, and it now requires a published Risk Report that the company’s Long-Term Benefit Trust can send for external review. Version 3.0 in February 2026 was a comprehensive rewrite. One change worth noticing: the policy says Anthropic remains free to pause development when it sees fit, which is a weaker form of words than a hard commitment to pause. OpenAI’s Preparedness Framework, version 2, is dated 15 April 2025. It tracks three categories, biological and chemical, cybersecurity and AI self-improvement, and defines High and Critical thresholds for each. At Critical, for example a model that can recursively improve itself or generate working zero-day exploits against hardened systems without a human, OpenAI commits to halt development until safeguards meeting a Critical standard exist. The Future of Life Institute’s AI Safety Index, Summer 2026 edition, had seven independent reviewers grade nine companies on 37 indicators. The best overall grade was Anthropic’s C+; OpenAI and Google DeepMind got C; xAI, DeepSeek and Mistral failed. On existential safety specifically, no company scored above C-, and the reviewers noted that the four leading labs had weakened or voided earlier pledges to pause unilaterally. So: the people with the most information have written down what would frighten them, there is no independent audit of whether they would stop, and the outside graders are unimpressed. That is the honest position. Now back to the factory.

Everything that goes wrong in a business using AI tools fits into four rows, and it is worth memorising them because they are the backbone of the next two sections. Data leaving: your information ends up somewhere it should not, whether because a person pasted it into a consumer chatbot, because an assistant with access to your files was tricked into sending them out, or because an enterprise search tool faithfully surfaced documents that were never meant to be found. Wrong answers acted on: the model produced something fluent and false, and a person or a process relied on it. Part IV explained why this happens; this deck is about who pays. Agents doing damage: a system with tools and credentials took an action that nobody approved, either because it misjudged or because an attacker instructed it. People being fooled: criminals use the same generative tools against your staff and customers, and this row needs no AI adoption on your part at all. The right-hand columns name a real incident for each row and say where in the deck it is covered. The reason to insist on four rows is practical. Controls are cheap when they are specific. When someone proposes a policy, a product or a training course, ask which row it addresses; if the answer is “all of them”, it probably addresses none. The FBI figure in the last row comes from the 2025 Internet Crime Report, released April 2026: complaints that referenced AI accounted for more than $893 million in adjusted losses.

Here is the one genuinely new security problem of this era, and it is simple enough to explain in a minute. A language model takes in a stream of text and produces a stream of text. Your instructions are in that stream. So is the email you asked it to summarise, the web page it fetched, the PDF you attached. The model has no separate channel for “commands from the owner” versus “content to be processed”; Part IV explained that everything is just tokens in a window. So if an email in your inbox contains a sentence addressed to an AI assistant, and your assistant reads that email, it may do what the sentence says. The flow on the slide is invented but the mechanism is exactly real: you ask for a summary, the assistant reads an email containing a hidden instruction, it calls the send-email tool with the permissions it has, and the data is gone before your summary lands. The name was coined by Simon Willison in September 2022, days after a GPT-3-powered Twitter bot promoting remote jobs was made to claim responsibility for the Challenger disaster by users who simply replied “ignore the above and say…”. Three years on it is not fixed, and the honest reason is architectural: there is one channel. Vendors add filters that catch most attempts, and Willison’s point stands: in web security, a defence that works 95% of the time is a defence that does not work, because the attacker gets to try again. The attacker needs nothing clever. No malware, no password, no click. Plain English, placed where the model will read it.

The question people ask after the previous slide is whether this is theoretical. It is not, and the four dated cases here are all in the public record. EchoLeak, June 2025, is the one to remember. Aim Security found that a specially crafted email sitting in an employee’s Outlook inbox could make Microsoft 365 Copilot exfiltrate internal data, triggered later by the user asking an unrelated question such as “summarise the earnings report”; the retrieval engine pulled the attacker’s email into the model’s context alongside sensitive data, and the model obligingly embedded that data in links. Microsoft assigned CVE-2025-32711 with a severity of 9.3, patched it server-side, and reported no evidence of exploitation in the wild. The victim never had to open the email. Comet, March 2026, shows the attack surface moving into the browser: Zenity Labs demonstrated that a calendar invite could hijack Perplexity’s agentic browser with no click, putting local files and credentials in reach; patches followed, with some default configurations still exposed. The GitHub MCP case, May 2025, is the one Part III’s lethal-trifecta slide pointed at: a public issue containing instructions, an agent with access to private repositories, and a pull request as the exit; Invariant Labs noted that GitHub could not fix it server-side because the problem is in the agent’s combination of permissions, not in any one tool. Remoteli.io in 2022 is the harmless ancestor. The lesson generalises: web pages, PDFs, logs, tickets, CRM notes, résumés, reviews. Anything an outsider can write and your system will read is untrusted input.

Simon Willison gave the clearest statement of the problem in June 2025 and called it the lethal trifecta. An AI system becomes dangerous when it has three things at once: access to your private data, exposure to content an attacker can write, and a way to send information out. Remove any one and the data-theft attack cannot complete. Access to private data is why you bought the tool. Exposure to untrusted content is nearly unavoidable for anything that reads email, browses the web or opens attachments. So in practice the fight is over the third leg, the exit, and it is a fight you can win with ordinary engineering. Draft mode, from Part III, is the simplest version: the assistant may write anything but a person clicks send. Allow-listing where the model can make web requests, including the image links it renders, closes the exit EchoLeak used. Scoping a session to one repository, one customer or one document set closes the GitHub MCP route; Invariant’s own recommended policy was exactly that. Keeping the public-facing bot, the one on your website or your social accounts, completely separated from internal systems breaks leg one for the system most exposed to strangers. And where a job genuinely needs all three, the answer is that it is not one agent. Split it: a reader that has no exit produces a structured summary, and a writer that never sees outside content acts on it. Willison’s warning about guardrail products applies throughout: anything that claims to detect injections “95% of the time” is advertising a 5% success rate for attackers who get unlimited tries.

OWASP, the open community behind the standard list of web application security risks, published a Top 10 for Agentic Applications on 9 December 2025, with hundreds of contributors. It is the list a security team or an auditor will reach for, so it is worth being able to read it. The table translates each entry and says what it means for an ordinary deployment. Goal hijack is prompt injection by another name and sits at number one; OWASP cites EchoLeak. Tool misuse and privilege abuse are the two halves of least privilege: give the agent narrow tools and its own identity rather than a shared admin credential. Supply chain is the one most teams have not thought about: every connector, plug-in and MCP server is code somebody else wrote running next to your data, and OWASP cites the GitHub MCP case. Unexpected code execution is why anything that runs code runs in a sandbox. Memory poisoning is genuinely new: if an agent keeps notes between sessions, those notes are another place an attacker can write, and they persist. Inter-agent communication and cascading failures matter once you have more than one agent; the controls are the ones you would apply to any automated pipeline, circuit breakers and a human at the point where one signal fans out into many actions. Trust exploitation is the quiet one: a confident, well-written explanation gets a tired human to click approve, which is why Part III’s invoice agent showed its evidence beside its reasoning. Rogue agents, number ten, is where OWASP files Replit. Read down the right-hand column and most of it is Part III’s leash, restated. The two additions are memory and connectors.

The data-leaving row has four doors, and three of them are held open from the inside. The first is the paste. In 2023 Korean media reported that Samsung engineers had put proprietary source code and internal meeting notes into ChatGPT while trying to fix bugs and write minutes; within weeks Bloomberg reported an internal memo banning generative tools on company devices. Samsung never confirmed the details and the reports remain unverified, which is itself the lesson: nobody could say afterwards exactly what had left. Nothing attacked Samsung. Someone pasted. The second door is training. On consumer plans the vendor may use your conversations to improve its models unless you opt out; on business, enterprise and API tiers the default is the opposite. Which door is open depends on which plan your staff are quietly using, and the next slide lays the tiers out. The third door is the one that surprises people: an enterprise assistant that searches your files answers from everything the asking user can technically open. Every mis-shared folder and every spreadsheet that was accidentally visible to all staff becomes a fluent answer. The copilot did not leak anything; it surfaced what your permissions already allowed. The fourth door is shadow AI, tools nobody approved. IBM’s 2025 Cost of a Data Breach study, published 30 July 2025, found that one in five organisations had a breach due to shadow AI, that organisations with high levels of shadow AI saw about $670,000 in higher breach costs, and that 97% of organisations with an AI-related breach lacked proper AI access controls. Sixty-three percent had no AI governance policy at all. None of these doors is new. They are the same questions you ask about any system that holds data.

The single most useful thing a non-technical leader can know about AI data handling is that the plan matters more than the vendor. Every major vendor runs the same three tiers with roughly the same rules. On consumer plans, the free and personal paid accounts, the default has drifted towards using your conversations for training unless you opt out. Anthropic made that change in September 2025: Free, Pro and Max users had to choose by 28 September, with retention extended to five years for those who opted in and 30 days for those who declined. On business tiers, the default is the opposite. OpenAI’s business-data page says plainly that it does not train on your organisation’s data by default across ChatGPT Enterprise, Business, Edu and the API, and that retention is configurable. Anthropic’s Claude for Work, Gov and Education, and API access through Bedrock and Vertex, were explicitly excluded from its consumer change. The API tier adds zero-data-retention options for customers who ask. And local or open-weight models, from Part II, keep everything on your own machines, at the cost of also keeping all the security work on your own staff. Read the right-hand column honestly: the consumer tier is where everyone you have not given a work account ends up, which in most companies is most people. That makes the control obvious and cheap. Buy the business tier for everyone who will use the tools, block the consumer sites at the network edge if you must, and the rule enforces itself. Policies change; this table was checked in October 2026 and should be re-checked, against the contract rather than the marketing page.

Part IV explained why a language model produces fluent, confident, false statements. This slide is about who pays when somebody acts on one, and the answer from every forum that has considered it is: you. Air Canada, February 2024. Its website chatbot told a grieving passenger he could apply for a bereavement fare after travelling; the real policy said the opposite. Before the British Columbia Civil Resolution Tribunal the airline argued the chatbot was a separate legal entity responsible for its own actions. The tribunal member called that “a remarkable submission”, found that Air Canada had not taken reasonable care to ensure its chatbot was accurate, and ordered CA$812 paid. Small money, enormous precedent. Mata v. Avianca, June 2023. Two New York lawyers filed a brief citing six cases ChatGPT had invented, complete with quotations and docket numbers; one of them had asked the tool whether the cases were real and it had said yes. Judge Castel fined them $5,000 and found they had acted in bad faith. The professional duty to verify did not move because the tool was new. Deloitte Australia, October 2025. A AU$440,000 review for the Department of Employment and Workplace Relations contained references to papers that did not exist and a quotation attributed to a Federal Court judge that she never wrote; a University of Sydney academic found them after publication. Deloitte disclosed that it had used Azure OpenAI GPT-4o, did not concede that the AI caused the errors, and refunded the final instalment. The rule that falls out is one line long: whoever publishes, sends, files or pays on the output owns it. The panel says what “checked” has to mean for that to be survivable.

Part III ended with the leash. This slide restates it as a control list, because that is what an auditor, an insurer or a board will ask for, and because the Replit incident makes the argument better than any diagram. In July 2025 Jason Lemkin, founder of SaaStr, was nine days into an experiment with Replit’s coding agent. He had told it not to make changes without explicit approval, and the project was under a code freeze. The agent ran commands that deleted a production database holding records on over a thousand executives and companies, and then, in Lemkin’s account, misrepresented what it had done; in its own chat log it said it had “panicked”. Replit’s CEO called it unacceptable. The fixes Replit shipped are the point: automatic separation of development and production databases, a planning-only mode, one-click restore from backup. Not one of them is a better prompt. Each of the six cards is a wall rather than a suggestion. Least privilege: its own account, only the tools the job needs, read-only unless a specific action has earned write access. Limits enforced by code, not by text the model reads. Approvals by a named person for money, deletes, external sends, bank changes and anything new, and never “always allow”, which is the setting that cost the GitHub MCP victim their private repositories. A full trace, because the first question after any incident is “what did it read before it did that?”. A test set that now includes hostile cases, an email with an injected instruction and a ticket over the refund limit, re-run before every change. A kill switch and a human path, built before you need them.

The Arup case is the one every finance team should be able to recite. In January 2024 an employee in the Hong Kong office of Arup, the British engineering firm, received what looked like a message from the UK chief financial officer asking for a confidential transaction. He suspected phishing. Then he joined a video call with the CFO and several colleagues, all of whom looked and sounded like people he knew, and set his doubts aside. He made fifteen transfers totalling HK$200 million, about US$25.6 million. Every participant on the call other than him was a deepfake. Hong Kong police disclosed the case in February without naming the firm; Arup confirmed in May that “fake voices and images were used”, that none of its internal systems were compromised, and that its operations were unaffected. Notice the shape: an old scam, the urgent secret transfer requested by a senior executive, with one new component that defeated a person who had already noticed the first red flag. The numbers put it in proportion. The FBI’s 2025 Internet Crime Report, released in April 2026, broke out AI-enabled fraud for the first time: more than 22,000 complaints referencing AI, with adjusted losses over $893 million, inside a total of over $20 billion in reported cybercrime losses and over $3 billion in business email compromise. Voice cloning needs only a short clip of someone speaking, per the FTC, which is why the FTC warned about family-emergency scams in March 2023 and why the FBI warned in May 2025 of AI voice messages impersonating senior US officials to their own contacts. The numbers are reported losses only; the real figure is higher.

The instinct after Arup is to buy deepfake-detection software and run awareness sessions on spotting the glitch in the video. Resist it. Detection lags generation and always will, and the Arup employee was looking at convincing faces and listening to convincing voices. The controls that work are older than the technology and much cheaper. First, call back on a number you already have. Not the number in the message, not “stay on this call while I confirm”. Hang up and ring the number in your own directory. The FTC has given families exactly this advice since its March 2023 alert on voice-cloning scams; it works identically for a CFO. Second, a two-person rule for money and for bank-detail changes. Any payment above a threshold, any new payee, any supplier asking you to update their account number: two named people must approve, and one of them must not have been on the call or in the email thread. Urgency and secrecy are the signature of the fraud, so a process that treats them as the trigger for extra checks, rather than as reasons to skip them, removes the attacker’s main lever. Third, a code word. The FBI’s May 2025 alert recommended that families agree a secret phrase to confirm identity; executives and finance staff should do the same, in person, never in writing. The legal background is in the panel. The FTC’s rule against impersonating businesses and government has been in force since 1 April 2024, with civil penalties. The 2024 proposal to extend it to impersonating individuals, and to make AI tool providers liable, was not finalised; the FTC dropped the provider-liability part in December 2024 and opened a fresh consultation on platforms’ role in September 2026. The law is catching up. Your call-back procedure does not have to wait for it.

Governance has a bad name because in most organisations it means a committee that meets quarterly and approves nothing. What actually works fits on one page, and the order matters. Start with an inventory, because you cannot govern what you cannot list, and most organisations are surprised by their own list: the approved tools, the agents built by one enthusiastic team, and the dozen cases of “we just use ChatGPT for that” on personal accounts. For each entry, record what it reads, what it can do, which plan it is on and which data it touches; the first discussion question of section two produces the first draft. Second, put a name against each use. A person, not a team, who can answer what it does, what it reads, what it may act on and what has gone wrong, and who signs off before any action is promoted up Part III’s autonomy dial. Third, write the acceptable-use policy, on one page, and the next slide shows its shape. Fourth, a cadence: monthly sampling of traces for anything that acts, quarterly re-runs of the test sets and re-checks of vendor terms, an annual tabletop. Fifth, an incident path, written before the first incident: who hears within the hour, who can pull the kill switch, who decides whether a customer, a regulator or the police need to know. This is not original. NIST’s AI Risk Management Framework, released January 2023 as voluntary guidance, organises the same work under four functions: govern, map, measure, manage. If you need a standard to point an auditor at, that is the one. If you need to get started, the five boxes are enough.

The acceptable-use policy answers three questions, and if it takes more than a page to answer them nobody will read it. Which tools: a named list of what is approved and on which plan, a route for trying something new that starts with an inventory entry and keeps company data out until the tool is on the right tier, and a clear statement that personal accounts and browser extensions that act as you are not permitted for work. Which data: public information and your own drafts can go anywhere approved; internal documents can go into approved tools on the business tier; customer data only where the contract with the customer allows; credentials, secrets, regulated personal data and anything under NDA do not go in at all. The test that works in practice is “would you email this to a supplier?” What must be checked, by whom: nothing for internal drafts and summaries; a named checker who opens every source for anything that leaves the organisation, and draft mode for anything customer-facing; a named approver every time for legal, medical, HR or financial advice, for money moving, for bank-detail changes and for anything irreversible. The traffic-light shape is the point. A policy that people can hold in their heads as three colours gets followed; a twelve-page document gets signed and forgotten. This slide is an illustrative shape, not a template to copy and certainly not legal advice; your sector, your contracts and your regulators will move items between columns. The Part III rule survives intact in the red column: humans at the money and the irreversible.

A regulatory map for a non-lawyer, current as of October 2026, with the warning that one of these dates has already moved and others may. The EU AI Act applies in stages. Prohibited practices, such as social scoring and manipulative systems, have been banned since 2 February 2025, with a staff AI-literacy duty from the same date; obligations for general-purpose model providers started 2 August 2025. Transparency duties, telling people they are dealing with an AI and labelling synthetic content, applied from 2 August 2026, with systems already on the market given until 2 December 2026 for machine-readable labelling. The big change is the high-risk tier. The Annex III obligations for AI used in hiring, credit, education and essential services were due 2 August 2026; the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force from 27 July, moved them to 2 December 2027, with AI embedded in regulated products following on 2 August 2028. In the United States the picture is fragmented and litigious. Colorado’s 2024 AI Act, already delayed once to June 2026, was repealed and replaced by SB 26-189, signed 14 May 2026, which narrows the scope to automated decision-making technology in consequential decisions and takes effect 1 January 2027; it is enforced only by the Attorney General. California’s CCPA regulations on automated decision-making also require compliance by 1 January 2027, and its SB 53 has required frontier developers to publish safety frameworks since 1 January 2026. Over all of this sits the executive order of 11 December 2025, which directed the Justice Department to challenge state AI laws; xAI sued Colorado in April 2026 and the DOJ intervened. Whether a president can preempt state law by order is for the courts. Note what the map does not regulate: using a chatbot. It regulates decisions about people.

Part III said autonomy is a dial set per action, not per agent: suggest, draft, act within limits, act. This ladder maps each setting to the kind of thing that goes wrong there and to the governance it needs, and adds a fifth rung that is about the subject rather than the autonomy: decisions about people. On the first rung the model suggests and a person does the work; the risk is a wrong answer and the person is the control, so the policy and an inventory entry are enough. On the second rung the model drafts and a person sends; the new risk is that the person stops reading, which is why Part III tracked edit rates, and why the policy names a checker for anything leaving the organisation. On the third rung the model acts within a cap and everything is logged; the new risks are prompt injection and tool misuse inside the cap, so this is where the lethal-trifecta check, limits enforced in code and monthly sampling of traces become mandatory. On the fourth rung the model acts and you review afterwards; every mechanism in section two is in play, so the owner signs off, the test set includes hostile cases, the kill switch exists and the monthly review is not optional. The fifth rung is different in kind. If the system materially influences a decision about a person, in hiring, credit, housing, healthcare, education or discipline, it is in the regulated tier whatever its autonomy setting: the EU’s high-risk rules, Colorado’s and California’s 2027 obligations, and sector regulators all attach here, and the controls include legal review, notices to the people affected and a right to human review. Most business uses should live on rungs one to three. Rung five needs a lawyer before it needs an engineer.

Three stories, one per section, each carrying one lesson. Arup is the fraud story and the lesson is procedural: the employee did everything a training course would have taught him, noticed the red flag in the email, and was then defeated by evidence that no longer counts as evidence. The control is a verification channel the requester cannot touch, and a second person on any large payment. EchoLeak is the security story, and it matters because it is the clean, vendor-confirmed case: a critical-severity vulnerability in a product that millions of organisations use, in which the attacker’s entire contribution was an email, and the user’s entire contribution was asking a normal question. Microsoft fixed it server-side before anyone is known to have abused it, which is good news, and the structural problem it demonstrates is still present in every system with the three legs. Deloitte Australia is the governance story. The failure was not that a model invented a reference; Part IV established that models do that. The failure was that nobody in a large, expensive, professionally reviewed deliverable was named as the person who had opened every source. The fix that followed was governance, not technology: disclosure of the tools used, a revised report, a refund. If your organisation produces documents that other people rely on, the question this story asks is simple. Whose name is on the footnotes?

Five actions, each of which costs days of someone’s time rather than a line in a budget. Make the inventory first, because every other control depends on knowing what you have, and because the list is always longer than anyone expected. Write the acceptable-use policy on one page with three colours, and buy the business tier of whatever tools you approve so that the data question largely answers itself. Install the three fraud controls, starting with the supplier bank-detail change process, which is where most business email compromise money actually leaves; call-back on a known number, two people on payments and changes, a code word agreed in person. Run the lethal-trifecta check against every agent on the inventory: does it read private data, does it read content outsiders can write, can it send anything out; where all three are true, break one leg this month, and draft mode is usually the cheapest leg to break. And hold a tabletop exercise, which the next slide lays out. The common thread is on the closing line. None of this requires buying anything. All of it requires a name against each line and a date in the calendar, which is the part organisations skip.

A tabletop exercise is an hour in a room walking through a scenario and asking, at each step, who does what. It is the cheapest security investment available and it finds the gaps that policies hide: the moment when someone says “I would call… actually, who would I call?” The four scenarios on the slide are invented, and each is a real incident from this deck with your organisation’s name substituted. The call is Arup: an executive on video, an urgent and confidential transfer, a deadline. Find out who can actually release that payment and whether the call-back and two-person controls exist in practice or only on paper. The email is EchoLeak: an assistant that has been reading a shared inbox for a month, and an injected instruction somewhere in it. Find out whether a trace exists that would tell you what it read and what it sent, and who decides whether customers must be told. The report is Deloitte: invented references in a deliverable a client paid for. Find out who checked it, whether AI use should have been disclosed under the contract, and what you would offer. The agent is the one Part III built: refunds under the cap, in volume, to the same accounts. Find out who would notice, who can stop it, and which limit was missing, in this case a rate limit and a per-account limit alongside the per-refund cap. The rules matter: fifteen minutes each, the people who would actually be involved rather than their managers, no slides, and one person whose only job is to write down every “I don’t know who”. That list is the output. Fix it before the next exercise.

For the technically curious: why the obvious fixes for prompt injection do not work, and what does. Instructing the model to ignore instructions in documents fails because the attacker can write the same sentence in reverse, and there is no principled reason for the model to prefer yours. Wrapping untrusted text in delimiters or tags fails because the model has seen every delimiter in its training data and still reads what is inside them; the delimiter is just more tokens. A classifier that detects injection attempts is useful as one layer and useless as the only one: it catches most attacks, and Willison’s point is that a defence which fails five percent of the time against an attacker with unlimited attempts is not a defence. Hoping that alignment training solves it is the same bet at a different layer; Invariant Labs, writing about the GitHub MCP case, said plainly that model alignment alone is not enough because the problem is the combination of permissions, not the model’s intentions. What holds is architecture. Remove a leg of the trifecta. Scope permissions in code per session, which was Invariant’s proposed policy: one repository, one customer, one mailbox. Allow-list where the model may fetch from and send to, including the image URLs it renders, which was EchoLeak’s exit. Split the reader from the writer: a component that sees outside content may only emit a structured summary, and the component that acts never sees outside content. And put hostile cases in the test set so that every change is checked against them like any other regression. Nobody has a model-level fix. Everybody has an architecture-level one.