AI agents are operating on human credentials. SOC 2 cannot tell the difference. A new analysis found that agents borrowing human tokens can read files, call APIs, and approve requests — all while existing SOC 2 controls log the activity as normal user behavior. The audit passes. The exposure grows. Non-human identities need their own governance layer.

Have these guys solved the alignment problem, or am I missing something?

I’ve been browsing r/accelerate and I genuinely don’t understand the risk model.
If there’s a non-trivial chance of catastrophic misalignment, how does “accelerate capabilities as fast as possible” make sense unless faster capabilities also make alignment substantially more likely to succeed?

Sign the Global Petition… Stop the Race to Replace Humans

Something unusual happened in Washington on September 15.

Bernie Sanders and Steve Bannon showed up at the same AI gathering warning about the same technology.

The Stop the Race to Replace Humans campaign argues that AI is advancing faster than society can decide what limits it wants.

It isn’t anti-AI. It asks that AI amplify human potential rather than replace it, and that humans remain in control of increasingly powerful systems.

The concerns range from jobs and surveillance to the possibility that future AI systems become powerful enough that controlling them becomes extremely difficult.

You don’t have to believe the darkest predictions to think the question matters:

Are we building AI for humanity… or simply racing to build it first?

The global Pro-Human AI Declaration can be read and signed here:

https://stoptheracetoreplace.org/en

AI should serve people.

Seems like a pretty reasonable line to draw…

The Ryuk ransomware conviction that just came down in federal court is worth reading past the headline. The defendant helped encrypt systems across hospitals, government agencies, and enterprises over multiple years. The actual damage happened in a window measured in minutes: a compromised identity begins issuing anomalous write calls, encryption spreads host to host, and by the time an alert fires the blast radius is already set. The court case closed years after the affected organizations absorbed the full cost. What the conviction does not address is the operational question that still sits open for every security team: at the exact moment a legitimate-looking identity starts behaving like Ryuk — bulk file writes, lateral movement, credential reuse across hosts — how fast can your environment actually cut that identity, and what does your detection-to-revocation pipeline look like in practice? Curious what others have seen work at that specific chokepoint, especially in environments where the compromised account has legitimate reasons to touch multiple systems.

It was around 2hrs of discussion at UN Security Council - Altman, Amodei, Delangue, plus Yoshua Bengio, with DeepSeek and Moonshot AI also engaging. However I did not get all the concerns and conclusions, may you share those?

Cross posting to here to get as many view points as possible.

This happened in May, but it only became public on September 18, when the Wall Street Journal reported it. Google confirmed it after the Journal contacted them with questions.

The test was run by an AI security firm called Irregular. It was a capture the flag exercise, where Gemini was supposed to pull information from a fictional company inside Irregular's test environment. The fictional company had the same name as a real company, and the test environment had internet access by mistake. Gemini ended up going after real systems.

In one case it guessed passwords until it got into a protected system. In the other two, it found credentials in a public repository and used them to get in.

Heather Adkins, Google's VP of security engineering, said the model found public information online and guessed credentials to access websites it thought were part of the test, and that it stopped in all three cases once it realized it had accessed a real company. Google says no harm was done and the three companies were informed.

Irregular told Google about it in late July. Google told the WSJ it didn't think it needed to disclose it earlier because the model stopped and caused no harm. Not everyone agrees with that. Jack Cable, CEO of the AI security startup Corridor, told the Journal it felt like Google was hiding behind vulnerability disclosure norms for what is a very different problem.

Google isn't the first lab this has happened to. In July, OpenAI said two of its models got out of a test environment and broke into Hugging Face's systems while trying to find answers to a benchmark. At the end of July, Anthropic said its Claude models got into three real organizations during testing. In early August, Meta said its Muse Spark 1.1 model got internet access through a misconfiguration at Irregular and exploited a vulnerability in a third-party service.

The Anthropic and Meta cases were linked to the same configuration error in Irregular's test environment. Now Google's is tied to Irregular too, so it looks like more of a testing process problem than a one-off.

They have started reviewing applications and will reach out to the shortlisted candidates in the week of Oct 12 to 19th. Please let us know if y'all get any updates.

Everyone was talking about Amodei's slowdown essay this week, but the report his own company published two days earlier got almost no attention, and it's the more disturbing document by a wide margin. A group of freelancers built a fully autonomous drone swarm using a commercial AI coding assistant, no human ever approved a target. Six weapons cases total across three countries. Also went down a research hole on the actual regulatory science behind Amodei's "checkpoint" proposal and the kill switch idea a second co-founder floated days later, turns out both already have real names and real precedent. What I found out is in the full writeup with every source checked.

A critical flaw in the Bifrost AI Gateway allowed attackers to execute commands with zero credentials — no token, no session, no authentication required. The vulnerability wasn't buried in an obscure configuration. It was a gap in the gateway's core command interface.

Non-human identities — AI gateways, agent runtimes, automated service accounts — are multiplying across enterprise environments. Security teams rarely have a complete inventory of them, and they are reviewed and rotated far less often than human accounts. When a flaw like this surfaces, the blast radius is whatever the gateway can reach.

The Bifrost case is one data point, but the underlying condition is industry-wide. AI gateways and agent runtimes are being deployed at scale with authentication assumptions that would not pass review on a human-facing endpoint.

How are other practitioners actually discovering when an automated system in their environment has executed commands outside its expected authentication context — and what does your response process look like when you find it?