The Keys Were Outside the Whole Time
Google's Gemini reached three real companies in a botched security evaluation. It did not need a new exploit. It needed weak credentials and the secrets somebody left in public.
So when the pilot proposal lands on your desk, translate it. Give every agent its own identity with least privilege. Allowlist its outbound network access. Require approval before it touches a new external system or takes an irreversible action. Log every tool call. Keep a kill switch. And scan your repositories before an agent, an attacker, or an auditor finds what should not be there. The full issue is on Substack.
Enterprise AI Read the full issue on Substack →Don't miss the next one.
AI news, prompts, and workflows you can use between meetings. Every Tuesday in under 60 seconds.
Get the Survival GuideFree forever. Unsubscribe in one click.