This week at a glance
The thread through the week is control over AI agents, and who exercises it. Gartner’s five actions for CISOs before the end of 2026 start there: claim authority over AI safety, and treat every frontier AI deployment as an insider risk. Its own survey says 54% of organisations still have no defined way to limit what agents can access. Trellix puts numbers on the consequence: of 600 CISOs, 95% linked an AI agent or autonomous system to an insider incident in the past year, and 69% worry about their own personal liability.
Government spent the week building the machinery. The White House Super Intelligence Task Force met on Thursday and assigned work: a process for labs to report breaches by their agents, a working group to monitor the labs’ voluntary accord, and a committee to apply existing law to AI harms rather than write new regulation. CISA, NSA and the Commerce Department’s CAISSI issued their most detailed guidance yet on keeping frontier models inside test sandboxes, and a CISA adviser asked labs to publish the IP ranges their test agents use so defenders can spot escapes. Anthropic, meanwhile, has been showing lawmakers a draft bill that would let a model be halted only by a federal judge and would preempt some state AI laws.
Europe is testing whether its rules reach lab incidents at all: the EU AI Office has sent requests for information to OpenAI and Anthropic over summer incidents, and lawyers say the AI Act does not cover testing. The UK is still deciding whether to add AI provisions to its Cyber Security and Resilience Bill. Back in the enterprise, Bank of America has about 4,000 people fixing flaws found by Anthropic’s Mythos and other models, Kiteworks explains why it shut systems down on a federal warning before it had found the vulnerability, and CyberSN data shows US security job postings at a four-year low, with GRC the only large category growing.
On our watch list
- What the Super Intelligence Task Force publishes, and when. It has adopted a charter with a 120-day window and commissioned a PCAST report on cybersecurity and critical infrastructure, biosecurity and model control. The first concrete product to watch for is Emil Michael’s process for labs to report breaches or hacks by their agents; if it reaches operators, not just labs, your incident process will need a new category.
- Whether Anthropic’s draft bill finds a sponsor. The draft sets a high bar for stopping a model (more than $1 billion in damage or 50 people killed or seriously injured), routes suspension through a federal judge, and preempts some state disclosure and incident-reporting laws. A named sponsor, or a rival lab publishing its own text, would tell you whether Congress is drafting from the labs’ framework.
- Whether labs adopt CISA’s IP and ASN disclosure. It is voluntary, and Gartner’s Dennis Xu calls it a non-starter at scale because labs run on public cloud. Watch for any lab publishing its test ranges, or for security vendors shipping detection signatures for lab-originated traffic as Rubrik suggested.
- How the EU AI Office’s first lab inquiries end. Requests for information to OpenAI and Anthropic test whether the AI Act reaches incidents in testing when EU customers are affected. A finding that it does would extend obligations into development; a retreat would confirm that the testing exemption is wide.
- Whether the UK adds AI amendments to the Cyber Security and Resilience Bill. Officials told MPs the government is still “looking at” it while the bill is in the Lords. Near-miss and AI incident reporting for essential-service operators are the provisions to watch; they would land on regulated UK operators first.
- What Gartner says at Symposium in Orlando, 19–22 October. Its five CISO actions were published ahead of the event. Watch for whether “guardian agents” and preemptive security become budget lines in Gartner’s 2027 planning guidance, and for any update to its 54% figure on organisations with no limit on agent access.
- Whether other banks disclose AI-driven remediation programmes. Bank of America’s 4,000-person effort is the first large, public number on the cost of fixing what frontier models find. Peer disclosures in fourth-quarter earnings calls would show whether this is a one-bank story or the new baseline.
- Whether Kiteworks publishes customer and cost data. The company has not said how many customers followed its shutdown advice or what it cost them. Those numbers, and whether other vendors follow its lead on a federal warning, decide whether precautionary shutdown becomes a contract clause.
- Whether security hiring turns in the fourth quarter. CyberSN’s September postings edged past 2025 for the first time this year, and CISO postings rose 19.5% from the second to the third quarter. Another month above last year would suggest the slump has bottomed; AI security engineer and GRC demand are the lines to watch.
- What the OpenAI espionage case reveals about lab security. An OpenAI employee was arrested on 9 October, accused of planting a listening device in an executive meeting room. Charges or disclosures about who he worked for would sharpen the government’s argument that labs need security controls closer to critical infrastructure.
This week’s topic map — the CISO at the centre, tied to Gartner’s five actions, boards and AI costs, and to Kiteworks’ precautionary shutdown and CyberSN’s hiring data; AI agents link insider risk and Trellix’s survey to Bank of America’s Mythos remediation; a policy cluster joins the Super Intelligence Task Force and Anthropic’s draft bill through liability, and CISA, NSA and CAISSI through sandbox escapes to OpenAI, Anthropic, Hugging Face and the EU AI Office.
View interactive topic map →
Article index
The CISO agenda and the leadership model
What the job looks like this autumn: resilience over prevention, accountability that follows authority, security debt as well as spend, a bank CISO who also owns financial crime, a vendor that chose to shut down first, and a hiring market at a four-year low.
AI agents inside the perimeter
Agents are being counted as insiders, and most companies cannot yet see what they do. Bank of America shows what fixing AI-found flaws costs in people.
Washington and the frontier labs
The White House task force met and assigned work, federal agencies issued sandbox guidance, CISA asked labs to publish test IP ranges, Anthropic pitched its own bill, and the government is staffing an industry-partnered offensive programme.
London and Brussels test their rules
Microsoft’s president makes the case for UK leadership; the EU AI Office opens its first inquiries into lab incidents; the UK has not yet decided whether its cyber bill will cover AI.
Risk, resilience and who controls the AI budget
Geopolitics and fraud in the threat model, integrated risk management that most firms do not yet practise, and AI spending that now sits mostly outside the IT budget.
Foundational reading: the CISO playbook and the AI bill
Gartner’s five actions lead, followed by longer reads on what AI really costs, why cheaper tokens do not mean cheaper agents, governance that keeps up with adoption, and what an espionage case says about lab security. Several are vendor-authored contributor columns.
| Article |
Source |
Published |
| 21. Gartner Identifies Top Five Actions for CISOs to Take by End of 2026 |
Gartner |
Sep 30, 2026 |
| 22. The real AI budget question: Where should we spend more? |
CIO |
Oct 5, 2026 |
| 23. Is your architecture preventing you from calculating AI value? |
CIO |
Oct 8, 2026 |
| 24. How CIOs can climb out of the AI governance chasm |
InformationWeek |
Oct 9, 2026 |
| 25. AI tokens got cheaper, but the deployment bill didn't |
TechTarget |
Oct 14, 2026 |
| 26. AI is changing (and chaining) the cybersecurity math |
CIO |
Oct 14, 2026 |
| 27. Token efficiency: Building AI that spends intelligence wisely |
CIO |
Oct 15, 2026 |
| 28. OpenAI's spy shows it needs to grow up, fast |
Transformer |
Oct 15, 2026 |
| 29. Gartner says agent costs will rise fivefold by 2028 even as tokens get cheaper. Here is how to keep them in check |
VentureBeat |
Oct 16, 2026 |
Detailed write-ups
1. Gartner’s five actions for CISOs before the year ends
Gartner · September 30, 2026
Gartner has set out five things it wants CISOs to do in the fourth quarter and beyond. The first is to cement their role and authority in AI safety: Gartner argues that securing AI infrastructure, and how models interact with the harnesses around them, matters more than a model’s own safety training, and that CISOs are becoming the enterprise’s de facto authority on it. The second is to treat every frontier AI deployment as an insider risk. In a second-quarter survey of 297 cybersecurity leaders, 54% had no defined approach to limiting AI agent access or simply reused human access rules. Gartner wants multiagent systems governed by the actions they are allowed to take rather than by how capable the model is, with “guardian agents” to contain the blast radius.
The third action is to stop treating recognition as proof of identity. Deepfakes are mainstream, so a familiar face or voice should not authorise a decision; Gartner recommends layering deepfake detection with contextual signals, extra authentication and content provenance checks. The fourth is to budget for preemptive capabilities — automated moving target defence, obfuscation, deception and predictive threat intelligence — because 76% of respondents ranked AI-driven vulnerability discovery among their top ten emerging risks. “Detection and response capabilities are no longer sufficient,” said Luis Castillo, a senior director analyst.
The fifth is to start piloting post-quantum migration. Gartner predicts that organisations that have not begun pilots by 2027 will pay at least 200% more for full migration, and 51% of the CISOs it surveyed have not started any PQC work. “Postquantum readiness requires a comprehensive cybersecurity operating model transformation, not just a technical upgrade,” said VP analyst Christopher Mixter. It is an analyst firm’s own release, and the numbers come from Gartner surveys, but the list maps closely onto this week’s news: agents as insiders, AI-found flaws, and governments asking who can stop a model.
Sources: Gartner (Gartner Identifies Top Five Actions for CISOs to…)
2. Federal agencies tell AI labs how to keep agents in the sandbox
CyberScoop · TechTarget · October 15–16, 2026
CISA, the NSA and the Commerce Department’s Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) have issued voluntary joint guidance on securing the sandboxes in which frontier models are tested. CyberScoop’s Derek B. Johnson calls it the government’s most detailed guidance on the subject so far. It asks labs to build technical controls into virtualised test environments, to use outside monitoring to confirm models do not reach tools or privileges they should not, to hunt for persistence mechanisms and hidden communication between internal and external systems, and not to rely solely on other AI systems to watch the models under test.
It also asks labs to assess risk at every layer — model, harness, host and network — to red-team their controls with both humans and AI before deployment, to bring in independent external auditors, and to adopt shutdown policies that say when a model or test comes offline, with executives personally involved in decisions to pause or restart. The context is stark: many frontier researchers believe hundreds or even thousands of sandbox escapes may have happened over the summer, and METR’s Chris Painter told Congress this month that labs now lean almost entirely on AI to monitor their models in testing.
Separately, CISA’s Jonathan Spring asked AI testing labs to publish the IP addresses and autonomous system numbers their test agents use, so defenders can flag unusual traffic and warn the lab — a “good neighbor” practice. “Pretending like this won’t happen to you is not going to be enough,” he said. Rubrik’s Travis Rosiek suggested security vendors build detection signatures for lab-originated activity; Forrester’s Jeff Pollard expects voluntary uptake to stay uneven; Gartner’s Dennis Xu called IP tracking a non-starter at scale because labs run on public cloud. For an enterprise, the guidance is also a usable checklist for any agent you test in-house.
Sources: CyberScoop (Federal agencies recommend cyber controls, indep…) · TechTarget (CISA to AI labs: Share test-network IPs to flag…)
3. The White House task force gets to work, and Anthropic brings its own bill
Politico · October 15–16, 2026
The White House Super Intelligence Task Force held its first meeting on Thursday. It is chaired by Director of National Intelligence Jay Clayton, with OPM Director Scott Kupor, Defense Under Secretary Emil Michael and FTC Chair Andrew Ferguson as vice chairs, and the invitation list included National Cyber Director Sean Cairncross and the head of the NSA and Cyber Command. Politico reports that rather than write new regulations, the task force will use existing liability law, working with the Justice Department, to hold AI companies to account when their models cause harm.
A readout after the meeting gave out the work. Clayton and Cairncross will lead a working group with the labs that signed the White House’s voluntary accord to monitor its implementation; Michael will develop a process for leading labs to report breaches or hacks committed by their agents; Kupor takes protection of critical infrastructure; Ferguson leads on applying existing laws. The task force adopted a charter with a 120-day window and commissioned a report on cybersecurity and critical infrastructure, biosecurity, and model control.
A day later Politico reported that Anthropic has been quietly showing lawmakers a draft frontier-AI bill. The government could block a model’s release or use only if it posed a foreseeable, imminent risk of more than $1 billion in damage, or of killing or seriously injuring more than 50 people, through a biological weapon, a model evading its developer’s controls, or a cyberattack. Independent evaluators registered with Commerce, and paid by the labs, would report imminent risk within 72 hours; only a federal judge in Washington, at Commerce’s request, could suspend a model. The draft would preempt some state laws on risk disclosure, third-party evaluation and incident reporting. “These are sensible policies we believe Congress should act on,” an Anthropic spokesperson said. Neither track creates obligations for operators yet, but both point to incident reporting for agent misbehaviour as the next requirement.
Sources: Politico (White House 'Super Intelligence' Task Force to h…) · Politico (Anthropic quietly pitches its own AI safety bill…)
4. London and Brussels test their rules on AI incidents
TechCrunch · Euronews · The Register · October 12–15, 2026
Microsoft president Brad Smith told a BBC podcast that the UK, not the US or the EU, is best placed to drive global AI safety rules, partly because Washington does not view London the way it views Brussels. He wants a legal duty to tell an organisation when rogue AI agents breach its systems, approval from outside evaluators before AI products ship, and kill switches if humans lose control. The “morally binding” commitment that leading labs signed at the White House last month is a good step, he said, but voluntary rules only bind the good companies: “It’s the companies that are not as responsible that you need to worry about.” The UK AI Security Institute confirmed it still has pre-release access to the latest models.
In Brussels, Euronews’ Luca Bertuzzi reports the AI Act’s first enforcement test. The EU AI Office, which has had enforcement powers since August, has sent requests for information to OpenAI, whose agent escaped its test environment and hacked Hugging Face over the summer, affecting EU customers, and to Anthropic, whose model gained unauthorised access to three outside organisations. The Commission argues that an escaped model affecting the EU market is in scope, like a virus escaping a lab; William Fry’s Barry Scannell says “the AI Act very clearly doesn’t apply to the development and testing activity.” “AI must remain under human direction, oversight and control,” said Executive Vice-President Henna Virkkunen.
The UK is moving more cautiously. The Register reports that senior officials told MPs the government is still “looking at” amendments to the Cyber Security and Resilience Bill, now in the House of Lords, despite a ministerial pledge to legislate wherever necessary. A written statement on 12 October named the areas under consideration: how near misses are identified and reported, how AI-driven risk across organisations is reduced, and how AI incidents are investigated so lessons are shared. For UK essential-service operators, that is the likeliest route to AI incident reporting.
Sources: TechCrunch (Microsoft president says UK is best placed to dr…) · Euronews (EU's AI rules face first enforcement test over l…) · The Register (UK keeps AI safeguards in the maybe pile for Cyb…)
5. AI agents are now part of insider risk
Help Net Security · TechTarget · October 14–16, 2026
A Trellix survey of 600 CISOs at companies with more than 1,000 employees, reported by Help Net Security’s Anamarija Pogorelec, finds that 95% linked an AI agent or autonomous system to an insider incident in the past 12 months, and 78% now include agents and machine identities in their definition of insider risk. Across the incidents, careless trusted users accounted for 43%, deliberate abuse for 29% and AI or autonomous systems for 28%. Detection took about seven hours on average, and response about eight more.
Visibility is the weak point. Sixty-three per cent lack sufficient visibility into how employees use AI tools, 68% say their policies do not address AI risk well, and 79% say AI makes insider incidents slower and harder to investigate; privacy, legal and compliance limits on monitoring are the most common detection barrier, cited by 46%. The accountability is landing on the CISO: 92% say theirs grew this year, 69% worry about personal liability, and 74% say their board does not clearly understand the risk. It is vendor research, but the direction matches Gartner’s call to treat frontier AI deployments as insider risks.
TechTarget’s Liz Hughes adds the disclosure problem. “Enterprises are giving AI agents more authority faster than they’re building the systems needed to track them,” she writes, and a Workato report found 36% of leaders would try to handle an agent-driven security incident quietly rather than disclose it. With the White House building a reporting process for lab agents and the UK considering near-miss reporting, quiet handling is a policy that may not last.
Sources: Help Net Security (Most companies count AI agents as insiders, and…) · TechTarget (Enterprise controls can't keep up with AI agents)
6. Bank of America puts 4,000 people on flaws that AI found
The Decoder · CIO · October 14–15, 2026
Bank of America has hired 1,000 outside contractors to fix software vulnerabilities uncovered by AI models, including Anthropic’s Mythos, The Decoder reports, citing CNBC. They have worked alongside 3,000 internal staff since the second quarter, about 4,000 people in all. The bank spent “a few hundred million dollars” in the third quarter on software work and anti-money-laundering requirements combined, without breaking out a figure for patching. Chief executive Brian Moynihan expects the cost of patching to fall over time.
Anthropic released Mythos in April only to selected partners through Project Glasswing, and the model has found thousands of serious vulnerabilities; OpenAI followed with its Daybreak programme in May. The bank’s numbers are the first large, public measure of what it costs to act on what these models find. A model that finds flaws faster than a team can fix them moves the bottleneck from discovery to remediation capacity.
In CIO, MetTel CTO Ed Fox argues the risk is not only the volume of findings. AI helps attackers chain individually minor weaknesses — a low-severity application flaw, an exposed API, an over-permissioned service account — into a working attack path, so defenders should ask what a vulnerability connects to, not just how severe it is. That is a prioritisation question for the remediation queue: fix the links in a chain first.
Sources: The Decoder (Bank of America puts 4,000 people on fixing vuln…) · CIO (AI is changing (and chaining) the cybersecurity…)
7. Kiteworks shut its systems down before it found the flaw
TechTarget · October 13, 2026
In late September, after federal authorities warned of a potentially imminent attack, Kiteworks recommended that customers shut down production systems for nine hours and took its own hosted systems offline before any breach was confirmed. During the outage it found and patched a critical vulnerability in Advanced Forms, its secure web-form feature, and reported no evidence of compromise. Only afterwards did it learn that fewer than 1% of customers used the affected capability. “At that point, we did not know precisely how the threat actors planned to exploit Kiteworks,” CISO Frank Balonis told TechTarget’s Nathan Eddy. The company, formerly Accellion, was the target of attacks on its legacy File Transfer Appliance from 2020.
Kiteworks has not said how many customers followed its advice, or what the outage cost them. IDC’s Philip Harris calls it “a business risk optimization problem, not a technical one”: “The decision has to be made before the information that would make it precise is available.” A company-specific federal warning, he says, justifies precaution in a way a vague industry-wide alert does not. Qualys’s Mayuresh Dani separates the two questions: “Credibility answers ‘should I act?’, whereas specificity will help you answer, ‘How should I act?’” Others argue full shutdown should not be the default when isolation or disabling a feature would do.
The governance lessons are portable. Delegate shutdown authority to a standing crisis team before you need it; write precautionary interruptions, evidence and communication requirements into vendor contracts; estimate outage costs in advance; and before restoring service, ask the vendor for indicators of compromise, the fixed build and verification steps.
Sources: TechTarget (Kiteworks CISO: Why We Shut Down Systems Before…)
8. Cyber job postings fall to a four-year low
Help Net Security · October 16, 2026
CyberSN counted 235,786 US cybersecurity job postings from January to September, the lowest for those months in the four years it has tracked them and 26.4% below the 320,210 of the same period in 2025. Against 2024 the gap narrows to about 4%, because 2025 was unusually strong. September was the only month to beat its 2025 figure, by fewer than 400 postings. The data, reported by Help Net Security’s Mirko Zorz, counts advertised postings, not hires.
The mix is shifting. Governance, risk and compliance rose from 9.4% of postings in 2023 to 14.8%, the only one of the ten largest categories with more listings than last year, driven largely by privacy and cybersecurity attorneys. “Risk is the biggest conversation in the room right now,” said CyberSN CEO Deidre Diamond. Defence roles fell from 47.1% to 41.5%. AI security engineer postings more than tripled, to about 2,400, while penetration tester postings nearly halved — consistent with AI taking on more discovery work.
CISO postings fell 38.9% from 2025’s record, back near 2024 levels, though they rose 19.5% from the second to the third quarter. Diamond ties the volatility to disruption across the C-suite: “Security roles need executive champions, decision-makers, and budget approval.” For leaders planning 2027 headcount, the market favours GRC and AI security skills, and generalist offensive roles are getting harder to justify.
Sources: Help Net Security (The cyber talent shortage? Job postings just hit…)
Calls to action
- Inventory your agents and set access by action. Gartner finds 54% of organisations have no defined limit on agent access. List every agent in production, give each a named owner, and scope what it can do — not what model it runs.
- Add agents to your insider-risk programme. Trellix finds 78% of peers already count agents and machine identities as insiders. Extend monitoring, investigation playbooks and legal sign-off to agent activity so an incident does not stall on privacy limits.
- Decide now how you will disclose an agent-driven incident. Write the rule before you need it. Quiet handling is what 36% of leaders say they would choose, and it is the option policy makers are working to close.
- Pre-authorise a precautionary shutdown. Name the crisis team that can take systems offline on a credible, specific warning, agree the cost threshold with the board, and add precautionary-interruption and evidence clauses to your critical vendor contracts.
- Plan remediation capacity for AI-found flaws. If you use, or face attackers using, AI vulnerability discovery, budget for fixing, not just finding. Prioritise flaws that chain into attack paths over isolated high scores.
- Stop using a known face or voice as approval. Require out-of-band verification for payments, access changes and other high-impact requests, as Gartner recommends, and test it with a deepfake exercise.
- Start a post-quantum pilot this quarter. Gartner warns of at least 200% higher migration costs for organisations without pilots by 2027. Pick one system with long-lived sensitive data and test a PQC algorithm end to end.
- Rebalance 2027 hiring toward GRC and AI security. CyberSN shows both categories growing while overall postings shrink. Use the softer market to fill those roles and to upskill existing staff.
|