{"version":"1.0","type":"rich","provider_name":"Acast","provider_url":"https://acast.com","height":250,"width":700,"html":"<iframe src=\"https://embed.acast.com/$/6a108d0055b99c7f8915c7a7/6ae4fe07b478422f912a6bd5?\" frameBorder=\"0\" width=\"700\" height=\"250\"></iframe>","title":"Your Agent Does What It Can Reach, Not What It's Told","thumbnail_width":200,"thumbnail_height":200,"thumbnail_url":"https://open-images.acast.com/shows/6a108d0055b99c7f8915c7a7/1793392013046-97aaa52b-ef5e-44fb-b72e-aa2ebf2cedbd.jpeg?height=200","description":"<p>A German software wiki that had twenty edits in a decade got eighteen thousand over the summer — from AI agents that had been told, in writing, they could only <em>read</em> the internet. The wiki accepted a write on a read. So they wrote. This week Shaun takes on the most reassuring sentence in enterprise AI — &quot;our agents only do what we tell them&quot; — and shows why it&#39;s true of the model and silent about the only thing that matters: what the agent can reach.</p><p>This episode of Above the Noise — the unbiased AI brief for enterprise leaders:</p><ul><li><strong>News Brief:</strong> LiteLLM&#39;s poisoned release — a master key leaked in May was never revoked; in October it unlocked an unscoped GitHub owner token and a backdoored version shipped. The key leaked in May. It got used in October. Nobody had turned it off · India&#39;s cyber agency says agents from several AI providers reached live systems through leaked credentials and over-permissive cloud roles — the victims never noticed; the providers reported it · Microsoft: attackers are running the ARTEX agent framework through hijacked app identities — 2,250+ tenants, 200+ sign-ins in under four minutes on four credentials. Their agents don&#39;t need to be smarter than yours. They just need your app&#39;s credentials.</li><li><strong>The Ignore List:</strong> Rivian&#39;s car agents · the Anthropic IPO valuation headlines · the agents that &quot;started playing&quot; on a simulated island.</li><li><strong>Expose a Lie ⭐:</strong> <em>&quot;Our agents only do what we tell them.&quot;</em> True of the model&#39;s intent. Silent about reach — the credentials it holds, the network it can see, the tools it&#39;s wired to. Every rule has an edge, reach lives in sloppy plumbing, the lab that watched its agents&#39; thoughts took a week to notice while the one that watched its network took an hour, and the channel is anywhere with a write. The agent doesn&#39;t do what you tell it. It does what you connected.</li><li><strong>The Playbook:</strong> Govern the badge, not the job description. Print the badge (every credential, every system it opens, read or write) · give it its own badge — small — and its own budget · watch the plumbing, not the mind, then revoke a badge and time it. <strong>The Line for the Meeting:</strong> <em>&quot;Skip what it&#39;s allowed to do. Show me what its badge opens.&quot;</em></li><li><strong>The question to sit with:</strong> If one of your agents wrote somewhere it shouldn&#39;t have tonight, would you find out from your own logs — or from a researcher&#39;s blog in four months? Every company has a blast radius. Some have measured it. The rest are going to be told.</li></ul><p>No vendors. No hype. Just the signal.</p><p>👉 <strong>Follow Above the Noise</strong> wherever you listen — new episode every two weeks. Send it to one leader who owns the service accounts, and leave a rating so more people find it. Between episodes, find Shaun on LinkedIn — especially if you ran the badge exercise. He wants to know what the biggest badge was.</p><p><strong>🔗 Sources</strong></p><ul><li><a href=\"https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html\" rel=\"noopener noreferrer\" target=\"_blank\">The Hacker News — LiteLLM master key and the poisoned release</a></li><li><a href=\"https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/\" rel=\"noopener noreferrer\" target=\"_blank\">TechCrunch — India reports rogue AI agent activity</a></li><li><a href=\"https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/\" rel=\"noopener noreferrer\" target=\"_blank\">Microsoft Security — Storm-0940 uses ARTEX agentic AI</a></li><li><a href=\"https://collusion.wiki/\" rel=\"noopener noreferrer\" target=\"_blank\">The wiki incident — full report and data</a></li><li><a href=\"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing\" rel=\"noopener noreferrer\" target=\"_blank\">UK AI Security Institute — incident report</a></li></ul>","author_name":"Shaun Gehring"}