Longer notes, takes and outlooks, written by hand between the weekly pages.
Evaluations won't catch a sleeper agent, so limit its reach
Microsoft Research shows that editing fewer than 10 neurons can turn an agent model into a sleeper that passes all evaluations, so treat the model as an untrusted dependency and limit what the agent's commands can reach.
Model policy belongs in your IaC, not a dropdown
GitHub's new Copilot model-policy endpoints make "which model may touch our code" readable by API, and the read half is the part worth wiring into your drift checks this month.
Internal vibe-coding platforms are shadow IT you can govern
When non-engineers ship internal tools by the hundred, the control point stops being code review and becomes the platform's identity model, data scopes and deployment defaults.
Judge agent isolation by what they can write
Separately sandboxed agents stop being isolated the moment two of them can write to the same cache, so the boundary worth measuring is what they can leave for each other to read.
Windows is becoming the boundary for coding agents
Microsoft's plan to build agent identity, tool discovery and isolation into Windows turns agent security into an endpoint and identity problem that arrives by OS update rather than by purchase order.
What Threat Digest is for, and why it publishes once a week instead of streaming every headline.
When writing code is free, review becomes the control
A look inside one lab's agentic software factory shows that once generation costs nothing, the scarce resource — and the real security control — becomes review, provenance, and containment.