AI Compliance & Cyber Brief

Researchers disclosed a vulnerability, nicknamed GitSpawn, in which an ordinary Git configuration setting inside a malicious repository — not a prompt, not a jailbreak — quietly runs attacker-chosen code the moment an AI coding agent performs a routine startup check. No cloning is required: a zipped folder, a synced drive, or a USB stick containing the booby-trapped repository is enough. Fixes have rolled out at different speeds across the affected tools, and at least one vendor had not yet triaged the report as of publication. The lesson for any organization using AI coding assistants: the risk wasn't in what the AI was asked to do, it was in what the AI was quietly allowed to touch on the way in.

A short explainer or post built around the idea that AI security failures increasingly live in ordinary, boring infrastructure — not in clever prompts — and why that means AI governance has to extend to every tool an agent is allowed to run, not just the model itself.

OWASP's GenAI Security Project released its 2026 Top 10 list of risks for LLM applications, and for the first time built the ranking by weighing real-world incident data alongside expert opinion rather than expert opinion alone. Under that new methodology, "Excessive Agency" — an AI agent operating with more access or authority than its task requires — jumped to the third most significant risk overall. Alongside the ranking, the project released a new companion standard aimed at giving organizations a concrete, checkable answer to a simple question: exactly what is this AI agent allowed to touch, and can you prove it?

A strong opener for any executive conversation about AI risk: the risk people worry about publicly (a model saying something wrong) and the risk actually showing up in incident data (an agent doing something it shouldn't have had access to do) are not the same risk.

The reasonable-security test at the heart of Duty of Care Risk Analysis asks whether a risk was foreseeable, whether a reasonable safeguard was available, and whether the burden of applying it outweighed the harm of skipping it. The Git configuration behavior exploited this week is a long-understood category of risk that predates AI entirely — nothing about it required AI-specific foresight to catch. What changed is that autonomous coding agents were connected to that same ordinary infrastructure without anyone re-asking the reasonable-security question for this new, faster actor. That gap — old risk, new actor, no re-check — is exactly what the reasonable-security test exists to close.

A closing thought for any audience thinking about AI governance: your organization's oldest, most boring infrastructure risks don't disappear when you add an AI agent — they just get a faster, less careful new user.