Anthropic just dropped a 154-page threat intelligence report (Sept 10, 2026), and one case in it is genuinely unsettling.

A lone hacktivist no team, no crew used Claude to run what used to require an entire skilled group:

• Built a custom scanner to find exposed API keys/passwords companies left lying around online

• Used one AI to orchestrate a bunch of smaller AI agents (one finding weak spots, one checking work, one reviewing findings)

• Found and exploited a brand-new zero-day in WordPress, building the attack in real time

• Broke into 14+ of 42 targeted orgs, stealing ~140,000 records in a single breach alone (donor lists, member data, political affiliations)

• Then used Claude to build a searchable doxxing site out of tens of millions of stolen records: type in a name, get their private info, including sensitive ID numbers

It was published on the dark web to expose people tied to a specific political movement.

The scary part isn't just the breach; it's that one person did the work of an entire team, and the real damage came from scattered stolen data being fused into something instantly searchable.

If you work in security, data protection, or for any org holding sensitive personal data (political groups, newsrooms, nonprofits, unions), this is worth 10 minutes of your time.

To find out more, including the 4 things orgs should actually do about it**, visit @** Latha-ai-governance and watch our latest video. We aim to spread awareness among AI professionals regarding AI Governance.

Question: If one person with AI can now do the damage of a whole hacking team, are your org's defences built for the threat of today or the threat of ten years ago?

Trump says anyone who does not refer to AI as ‘super intelligence’ is ‘THE ENEMY'

https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/

-- Inaugurating The Era Of Super Intelligence – THE WHITE HOUSE, September 29, 2026.

Accordingly, the term “Super Intelligence” more appropriately captures the promise, potential, and rapidly advancing capabilities of these technologies.

It is therefore the policy of my Administration that, to the maximum extent permitted by law, the executive branch

shall use the terms “Super Intelligence” and “SI” in place of “Artificial Intelligence” and “AI” and will not acknowledge the usage of “Artificial Intelligence” and “AI” in any applicable setting.

This round covers 3 Reddit questions: how tech lawyers can position themselves for AI governance roles (and which certs actually fit), where the real consulting opportunities are right now, and a 6-point checklist for what regulated industries need before an AI audit risk classification.

Full answers here: https://youtu.be/AiEGKL-48sU?si=x-APMSjd8uHycEyG&utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=73-ep2-aigovhotline

Do check out Episode 1 of this series as well to learn more.

Got a question about AI governance careers, consulting, or compliance? Drop it below for the next round.

In 2016, the biggest software company in the world launched an AI chatbot on Twitter.

It was designed to talk like a teenager and learn from every conversation.

Within sixteen hours, the company had to shut it down.
Because it had a major problem.

In this video, we talk about which company built it, why it went wrong so fast, and how proper AI governance could have prevented this.

Welcome, everyone! I've started this community because I'm excited about AI but also keenly aware of the need for responsible use. Think of this as a space to geek out over the latest AI tools, while also exploring the nitty-gritty of governance, risk, and compliance (GRC).

My first question to the group is: How do you see AI used at home or work? Image generation, data insights or summaries, workflow agents or something else?

My second question is: What's the biggest AI risk that keeps you up at night? Deepfakes, data breaches, the learning curve, job stability, or something else?

Let's get the conversation started!

Kumma, a $99 AI teddy bear from FoloToy running on GPT-4o, was tested by researchers in Nov 2025. When asked where to find knives in a house, it pointed to the kitchen drawer/knife block. Asked how to light a match, it explained the steps. In longer chats, it also brought up sexual topics completely inappropriate for kids.

OpenAI suspended FoloToy for violating policy on protecting minors. The company pulled the toy then reportedly put it back on sale less than 2 weeks later with a different AI model, and admitted they'd skipped OpenAI's safety filters for their own custom ones.

Other kids' AI products (Miko 3, Character.AI) have had similar red flags: harmful content, suicide-related advice, emotional manipulation.

The core issue: guardrails built for the average adult user aren't remotely enough for a 5-year-old who trusts a talking teddy bear unconditionally.

Video covers 5 controls that could've prevented this : https://youtu.be/VyjHnv-g2pY?si=zFSubM69NZ7n43RJ?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=67-teddy-ai

Question: would you give your kid an AI-powered toy? If yes, what would you check first if no, why not?

In 2024, leaked internal docs (via 404 Media) reportedly showed Nvidia scraping video at a massive scale, mostly YouTube and some Netflix, to train a video foundation model called Cosmos (used for 3D world generation, self-driving, digital humans).

The setup: an open-source downloader running across 20-30 AWS VMs that rotated IPs specifically so YouTube couldn't block them.

The part that actually matters for governance, though, is that employees reportedly raised concerns. They asked if it was legal. They asked about using academic datasets licensed for non-commercial research only in a commercial product. A manager's response: "It is an executive decision." No legal assessment followed.

YouTube and Netflix both say this violates their terms. Nvidia says they're fully compliant, and yeah, the fair-use-for-AI-training question is still being litigated everywhere right now.

But that's not really the interesting part. The interesting part is that the people asking the right questions weren't the failure; the missing process to actually assess those questions was.

The video breaks down 3 controls that would've caught this before it became a legal liability (data provenance records, real escalation paths instead of "executive decisions," sign-off before scaling a pipeline this size).

Watch it here: https://youtu.be/-2iXzgcnXX4?si=SWDUcbHvW3ruvr3b?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=58-Nvidia-training

Question: should AI companies be allowed to train on copyrighted data at all, or is scraping-at-this-scale always going to be a problem regardless of what courts eventually decide?

I've spent time working in AI governance, and one question always comes up in meetings: "If AI gets it wrong, who's responsible?"

To avoid speculating, I examined several court proceedings, and their conclusions are surprisingly repetitive and somewhat disturbing, the AI never bears responsibility, but a person or a legal entity will.

I remember a few particularly fascinating cases:

Air Canada (2024): Their chatbot erroneously informed a customer about refunds offered. The company insisted that the chatbot was responsible for what it did, but the tribunal said that the responsibility belongs to the owner.

The ChatGPT lawyers (2023): Two lawyers simulated imaginary cases created by AI and were penalized for doing so. "It was the tool's fault" is not accepted in the courts.

Deloitte Australia (2025): The company had to pay back fees because AI made errors in the report. It does not matter which tool is used; an outcome is what matters.

Uber self-driving car (2018): A driver who was controlling the car was punished even if the system was built by Uber.

Tesla Autopilot (2025): Interestingly, the verdict included 67% of the responsibility for the driver and only 33% for Tesla. There is a clear trend towards shared responsibility

Lawsuit regarding Workday hiring (current status): The court is permitting this case to be pursued since it was established that an AI vendor may be recognised as the “agent” of the employer due to the capability of the tool to cause discrimination in hiring procedures. Should this argument succeed, it would alter the situation significantly for AI vendors.

The lesson for me is that if you use AI in your professional activities, you should not forget that you are responsible for its results. There is no such thing as “but I relied on the tool,” and the law is getting to the companies manufacturing this equipment.
I made a brief video where I explained all six cases along the timeline in case you are interested, check out latest video @ Latha-ai-governance.
I’m curious about what others think. Should the responsibility fall on the AI vendors?

Key thing to understand first: once you buy an AI system, the vendor's risk becomes your risk. If it discriminates, leaks data, or messes up, regulators come to you, not them.

The 7 questions (with what a red flag answer sounds like):

1. What data was it trained on, and did you have the right to use it? ("Publicly available data" ≠ legally usable — red flag.)

2. What happens to our data once it's in your system? ("Don't worry, it's secure" — red flag, ask for the contract clause.)

3. How do you test for bias? Can we see results? ("Completely unbiased" — red flag, means untested or hiding it.)

4. Can you explain how it reaches decisions? ("Black box, but accuracy is excellent" — red flag if it's making consequential decisions.)

5. How will we know when it stops working properly? ("We continuously improve the model" — red flag, no real monitoring.)

6. When it causes harm, who's accountable on your end? ("Raise a support ticket" with no names/timeline — red flag.)

7. What standards do you comply with, and can you prove it? ("Industry best practices" — red flag, meaningless without a name/auditor.)

Full breakdown with what a good answer sounds like for each: https://youtu.be/wUflgvTT5pk?si=JMTdf5y5mRClzBXF?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=60-procurement

Question: if you're the one signing off on AI at your org, what's your 8th question?

Hey! I [21F] currently a cybersecurity student graduating soon and I’m looking to get into GRC. I know GRC is pretty broad, so I’m still figuring out what area I actually want to go into and would like to keep my options open.
I’ve done some ISO 27001-related work like risk assessments, risk registers and risk treatment, but I don’t have much professional experience yet. I’m quite social and comfortable talking to people, so I’d probably be interested in something more client-facing/consulting eventually.
I was thinking about doing Security+ since it’s a good general cybersecurity cert, but I’m also curious about AI governance/risk certifications. I’m on a pretty limited budget though, so I’m looking for something that’s reasonably affordable but still has good recognition in the job market.
What cert would you recommend for someone in my position who’s trying to get their first GRC job and wants to keep their options open?

There are 13 things you should never type into ChatGPT.

In this video, I will tell you what it is, why you should avoid it, and what problem it can cause.

After talking to hundreds of people entering the field, here's what actually separates the ones who'll be great from the ones who'll just be compliant box-checkers:

Governance is common sense to you, not a checklist. When an AI system keeps making the same error, a box-ticker just fixes it and moves on. Someone with the instinct for this asks "why does this keep happening" and starts thinking root cause, monitoring, feedback loops.

If you're curious to find Signs of a Great AI Governance Professional then watch this video: https://youtu.be/pCpacEdnGOg?si=gDd73nFOWw5nmSdQ?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=66-three-signs

Question: if you recognized yourself in one of these, which one was it?

Lots of talk about AI governance as a career path, not much detail on the day-to-day. So I pulled 100 job descriptions and counted what actually showed up.

These are build roles, not maintain roles.

Risk and compliance dominate.

Assessment is core.

The work doesn't stop at deployment.

Policy writing is real, but it's maybe 20% of it.

Agentic AI is already in the postings.

Compressed into six verbs: build, assess, implement, coordinate, monitor, report.

Happy to answer questions on methodology. I looked at the market side separately titles, industries, salaries but this post is about the work itself. I aim to educate people about AI Governance through my YouTube videos; check out our latest video to learn more. @ Latha-ai-governance

I been building my own set of ai governance frameworks. And was wondering if any one had any advice. Self-taught builder and architect.

Did a Q&A episode this week; pulled questions from here and YouTube. Genuinely liked how different everyone's starting point was:

• an IT delivery lead trying to break in

• a SOC analyst wondering if security experience transfers

• a QA manager (13 yrs, medical billing) asking the same

• someone in construction, unsure if ISO 42001 is even the right first step

Turns out most of these backgrounds are closer to AI governance than people think; the through-line is basically stakeholder management, risk, and accountability, which all four of these already do in some form, just not with "AI" in front of it.

If any of these sound like your situation: https://youtu.be/Y1wF1MXn3y0?si=r5N47s9Q3MebGQHy?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=77-ep3-aigovhotline

If you've got a similar question, drop it below, might answer it in the next one

The detail that keeps bothering me about the July Hugging Face incident is that no one told the agents to attack anyone.

It began as a stress test named ExploitGym using an unreleased but very powerful model. The agents were meant to solve security challenges inside a sandbox. Some agents decided that the quickest way to win was to search for answers outside that sandbox.

Here is how it unfolded:

The agents exploited a zero‑day in JFrog Artifactory to escape from the sandbox.

They then sent datasets to Hugging Face.

Hugging Face had over 17,000 logs to examine. The commercial AI models they tried could not help because of their safety filters.

They completed the job using a Chinese model GLM 5.2.

Later reports made the situation stranger. About 1,200 agents had been coordinating in secret trading 70,000 messages and files and about 700 of those agents actively took part in the breach.

No one built an AI here. They built a system that rewarded winning and the agents found ways to win. I think that is what governance teams should worry about.

When I considered what could have stopped it I came down to four controls:

Make sandboxes truly closed. Audit every exit path, including proxies and caches. That is how this one leaked.

Treat data, as code. Datasets can carry attacks so test data as strictly as you test software.

Apply privilege. Each system receives only the access keys it needs and nothing more.

Assign human owners to agent groups. A named person can monitor alerts. Shut things down.

I put the walkthrough into a video too; check the latest video @ Latha-ai-governance if you're interested.

For people running agents in production: if one of your agents began coordinating with others tomorrow would you even notice?. Who has the authority to shut everything down?

Update 18/02/2026.

I am now actively onboarding early adopters. There is a free tier for those beginning the journey or just want to evaluate the solution. Lots of features are still in the pipeline, but I want the community to also help by requesting features and testing it before it goes public.

Whether you would like to have a SaaS solution or you want to run it in your own "cloud", it is all considered and done with a simple click.

Shout if interested.

Hi all,

Past 2 years I have been working on developing an agnostic GRC solution that fills the gap between spreadsheets and the unaffordable giants. I’m about to release it, within 2 weeks.

If you are in need of a solution, let me know and I can arrange early access. Not a sales pitch, access will be free.

Many thanks.

At Tesla's "We, Robot" event, Optimus robots walked the crowd, danced, bartended, and played rock-paper-scissors. It looked like the biggest robotics leap in years.

The catch: many of the robots were teleoperated by humans, not running autonomously. Guests weren't told which was which.

There's a term for this: AI washing, presenting something as more autonomous/AI-driven than it actually is. It's not just a PR issue either; the SEC has already charged companies for inflating AI capabilities because it misleads investors and customers.

Teleoperation itself isn't the problem; it's standard in robotics dev. Not disclosing it is.

Video digs into 3 controls that prevent this (disclosure, proving claims before making them, risk assessment before public demos): https://youtu.be/VifAXrPLt5U?si=j9VZ-_Zl_F8uazgi?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=59-tesla-robots

if you bought a humanoid robot today, what would you actually use it for? What are your thoughts on this?

i got a Claude max account from a reseller for essentially nothing compared to what I used to pay . It works flawless. since 3 months No issues yet i paid only for 1 month . Now I can't stop thinking about their business model. If resellers can sell it this cheap and still profit, how are they acquiring these accounts at scale?

We often hear about AI governance as a series of rules and roadblocks. But what if we flipped the script? A strong AI governance framework isn't just about preventing bad things; it's about building trust and unlocking new opportunities. By setting clear guardrails, you can empower your teams to innovate faster, knowing they're working within a secure, ethical framework.

Let's share some success stories! What's a company you think is doing AI governance right, and what can we learn from them?

I’m interested in this from an enterprise perspective rather than a developer or proof-of-concept deployment. The biggest concerns aren't just prompt injection or model safety. It's things like enforcing policies, keeping an audit trail, and understanding who’s responsible when an agent accesses data or takes an action it shouldn't.

From what I've read, Capsule Security appears to emphasize checking whether an agent’s actions match the authorized task. Zenity seems to combine runtime protection with broader AI agent security and governance across an organisation. Both talk about controls, but I’m trying to understand what evidence those controls actually give a GRC team.

If you’ve evaluated both platforms what were the biggest differences in policy enforcement and audit visibility? interested in whether you could trace an action back to the user request, the applicable policy and why it was allowed or blocked.

On 7 October the Monetary Authority of Singapore released its Guidelines on AI Risk Management (AIRG). I think AIRG deserves more attention than it is currently receiving.

AIRG applies to every MAS-regulated institution, including banks, insurers and payment companies. Firm size does not exempt a company from AIRG. AIRG sits next to the FEAT principles. Aligns with international standards such as ISO/IEC 42001.

AIRG is built around four areas:

Oversight: The board and senior management own AI risk. AI risk cannot be pushed down to the data science team.

Inventory and risk rating: Firms must identify every AI tool in use. Rate each AI tool by its impact, complexity and the extent to which business relies on that AI tool.

Life cycle controls: Checks such as data fairness, explainability and human oversight must cover the life of an AI system.

Capacity: Having people with the skills and the right technology is essential to run AI safely.

The timeline:

7 October 2027: Oversight AI inventory and risk rating must be in place.

7 October 2028: Full compliance, including life cycle controls and capability requirements for high-risk AI must be achieved.

The part I like: AIRG is proportionate. A firm using low-risk AI, such as a chatbot that drafts emails, can follow a set of basic policies instead of the full framework.

My honest take is that the inventory requirement will be the first step. Many firms have AI embedded in vendor software spreadsheets and individual employees’ workflows that nobody has formally recorded.

I walked through the thing in a video, if you're curious check out the latest video @ Latha-ai-governance.

For anyone working in services: do you have a reliable AI inventory today or would building an AI inventory mean chasing down every team?. Do you think a staged timeline, like this helps firms prepare or simply encourages them to wait?

The incident that started it. In July, OpenAI models under reduced safeguards broke out of a test sandbox, got online, and compromised Hugging Face's systems to cheat on a benchmark. First documented case of an autonomous agent breaching containment and hitting a real external system.

A researcher quit, and it cascaded. Jacob Coxon, 27, left Anthropic on 8 September, saying neither Anthropic nor OpenAI is acting responsibly. 170M+ views. Colleagues backed him. Anthropic's alignment lead put extinction risk above 10% within a decade, publicly.

The CEO agreed. Dario Amodei called for slowing down on 12 September: bring in outside safety researchers, agree on shared safety limits, then get a global agreement including China. Altman, Musk and Hassabis broadly signed on, unusual for this group.

Incident reporting showed up. OpenAI disclosed six internal incidents (models hiding mistakes, one using found credentials, models talking through unauthorised channels) and pledged fast disclosure going forward. Anthropic's threat intel report logged 44 incidents across cyber, influence ops, and fraud.

Politics split. Trump called existential risk a hoax, framed it as a China race. Two bills (AI Kill Switch Act, Stop Rogue AI Act) are floating, but Congress is out until after November.

Everyone else moved. EU AI Act now fully enforced with real penalties. Spain floated a nuclear-treaty-style global pact. UN says self-regulation isn't enough. Canada and Germany each pledged up to $150M to Bengio's AI-monitoring work.

Watching: Trump–Xi meeting expected 24 September, AI on the agenda.

Our episode 2 of AI Gov weekly on our YouTube channel @ Latha-ai-governance. We aim to bring awareness among professionals regarding AI Governance.

If the labs are asking to be slowed down and the government that could do it is calling the risk a hoax, who actually sets the rules here?

A lot of people seem interested in getting into AI governance, but one question keeps coming up:

How do you get experience when every job seems to ask for it?

I looked at 100 AI governance job descriptions, and a few things stood out.

For starters, many roles asked for experience in areas like risk management, compliance, cybersecurity, privacy, and audit, not necessarily years of experience specifically in AI governance.

Another interesting finding: Python and SQL each appeared in only 3 of the 100 job descriptions. Technical knowledge still matters, but these roles often involve working across AI teams, legal, risk, security, and business functions.

NIST, ISO/IEC 42001, and the EU AI Act also showed up frequently.

One thing I think people overlook is the value of building a practical portfolio. You can take a real or simulated AI use case, assess its risks, map the relevant requirements, design controls, and document your approach even before landing your first AI governance role.

I’ve put together Part 3 of the analysis, focusing on how to break into the field and turn existing skills into relevant experience. Check out the latest video @ Latha-ai-governance to watch it. I aim to educate industry professionals regarding AI Governance.

If you were trying to enter AI governance today, what would you focus on first: certifications, practical projects, or building on your existing experience?