Cybersecurity Expert

We’re getting good at writing policies about how AI should be used. Responsible AI principles. Acceptable-use policies. AI risk frameworks. Approval processes. Governance committees. All of these have a place. But there is a harder question that I think organisations need to start asking: What evidence proves those controls actually work? Because AI is changing the nature of the control problem. We are moving from AI that simply provides information to AI that can increasingly access data, make decisions, call tools, trigger workflows and take actions. And much of our traditional assurance thinking still assumes there is a human sitting somewhere in the process. That assumption is becoming increasingly uncomfortable.  Autonomy is scaling faster than assurance Consider a relatively simple AI agent. It might be able to: Read information from internal systems  Search documents and databases  Make decisions based on predefined criteria  Trigger workflows  Create or...

When Anthropic abruptly pulled Mythos 5 and Fable 5 from circulation , the move sent a jolt through the AI and cybersecurity communities. These were not minor point releases. They were widely regarded as among the most capable models the company had ever shipped, and watching them withdrawn, even temporarily, raised an uncomfortable question: if the frontier itself can be paused over a safety concern, what exactly are we securing, and how would we know if it failed? At the time of writing, much of the detail remains disputed. Anthropic and government officials appear to hold very different views about how serious the issues really were, and until more technical evidence is made public, nobody outside the organisations directly involved can say with confidence what happened. What we can do is step back and ask why an episode like this matters at all, because the answer says a great deal about where AI security is heading. A bigger jump than the version number suggests Part of what made ...