Readiness SignalTechnical Controls
PCI SSC: if an AI agent can touch cleartext card data, a human approves the action
The PCI Security Standards Council published Security Considerations for AI Systems, reported October 9, covering least agency, separation of duties, and human approval for agents in payment environments.
Talking point
The payments standards body has written down what a good agent control looks like: explicit human approval for any action touching cleartext card data, least agency, and no single AI system that holds sensitive data, reads untrusted input, and talks to the outside world all at once. If a workflow needs all three, split it across agents with different permissions. The pattern applies to any regulated data, not just payments.
Content angle
Try the three-circle test: sensitive data, untrusted input, outbound communication. Any AI tool sitting in the overlap of all three gets split or gated. Board-level version: name the humans who formally accept responsibility for what your agents do.
Source: Source: Help Net Security — PCI SSC AI guidance
Readiness SignalAgentic AITechnical Controls
AWS open-sources Strands Box: agent policy that lives outside the agent and remembers what it already did
A developer preview released October 7 combines OS-level isolation with a policy engine that can restrict later actions based on earlier ones.
Talking point
The notable idea is not the sandbox, it is the policy: a rule can say 'if the agent read this file, block that network call,' or 'no more than three Slack posts in ten minutes,' and the control enforces it, not the agent. Credentials are attached at the gateway so the agent never holds them. It is an early developer preview, so the value for now is the pattern, not the product.
Content angle
Rules that remember: a rule that only looks at the current action is a speed bump; a rule that knows what already happened is a control. A COO can write history-aware rules in plain English.
Source: Source: InfoWorld — Strands Box
Readiness SignalAgentic AIOWASP
OWASP's Q3 exploit roundup: instructions in a prompt are not a security boundary
The OWASP GenAI Security Project posted its Q3 2026 exploit roundup, covering incidents from July 1 through September 30.
Talking point
The conclusion running through the roundup, as summarized by practitioners, is that telling a model what not to do is not a control. Scope has to be enforced outside the prompt, credentials isolated from the agent, and actions monitored. The practical test for any deployment: if the instructions were ignored, what would physically stop the agent?
Content angle
Your system prompt is a suggestion. A prompt is a sign on the door; a credential is the lock. Exercise: list every restriction on your AI tools and mark each one as asked or enforced.
Source: Source: OWASP GenAI Security Project
Readiness SignalAgentic AIIncident Response
CrowdStrike: a campaign against South Korean financial firms used an open-source agentic pentest tool, and the attacker's agent logs were left exposed
CrowdStrike published October 7 on a late-September to early-October campaign using ARTEX with commodity LLMs; open directories on the operator's servers held agent session histories and memory files.
Talking point
CrowdStrike reports an attacker using an open-source agentic testing tool with commodity AI models against financial firms, and the attacker's own agent session logs ended up exposed. The advantage was speed, not sophistication. The lesson for defenders is that agent logs and memory files are evidence: decide now who can read them and how long they are kept. Attribution remains moderate confidence and victim details are still unconfirmed.
Content angle
The attacker forgot the transcripts. Every AI agent in your company produces a record of what it did and why. Is that record an audit asset or an unmanaged liability?
Source: Source: CrowdStrike — ARTEX campaign