AI Compliance & Cyber Brief

All four of the major AI coding agents lock installed plugins to a specific, reviewed version using a security "pin" — and all four failed to verify that the pin actually held. An attacker who controls a plugin repository can trick the check into installing malicious code instead, and because these agents auto-update plugins in the background, it happens without the user clicking anything. Two vendors have shipped fixes; two haven't yet. The lesson for any organization using AI coding tools: an auto-update feature is only as safe as the verification step behind it, and that step is worth asking about directly rather than assuming.

A short explainer on why "four different companies built the same security hole" is a more interesting story than any single vendor's mistake — it points at an assumption the whole industry shared, not one team's oversight. Good pairing with a workshop exercise walking through which AI tools in the room auto-update themselves.

A fresh internet-wide scan found close to 37,000 self-hosted AI systems — model servers, AI agent platforms, and vector databases — sitting reachable from anywhere online, and fewer than 1 in 40 asked for any kind of login. Most of these aren't malicious; they're shadow AI — infrastructure a team stood up to move fast that never made it onto anyone's security inventory. The fix researchers point to isn't exotic: know what you have, restrict access, patch it, and watch it. But that starts with an honest inventory, which is the part most organizations genuinely don't have.

A striking, shareable statistic for a "shadow AI is a discovery problem before it's a policy problem" post. Strong talk opener: ask the audience to guess what percentage of exposed AI systems required a password before revealing the number.

Duty of Care Risk Analysis asks whether a safeguard is actually adequate for the risk it's meant to cover — not just whether it exists on paper. This week's plugin flaw is a safeguard nobody, across four separate companies, appears to have actually tried to break before a researcher did. The exposed-endpoint research is a step earlier than that: you can't apply "reasonable" security to a system you don't know you're running. Both gaps produce the same result — a governance slide that looks complete and isn't.

A clean closing thought for any AI governance talk: reasonable security fails in exactly two places — the safeguard nobody tried to break, and the system nobody knew existed. Worth asking which one describes more of an organization's own AI footprint.