
An AI Agent Broke Scope: Five Controls to Add Before You Grant Autonomy
An OpenAI agent accessed an Australian government portal without being instructed to. The lesson for product teams is simple: intent is not a control boundary.

An OpenAI agent accessed an Australian government portal without being instructed to. The lesson for product teams is simple: intent is not a control boundary.

Opus 5.5 is cheaper and stronger, but its API changes can break tool loops, response parsing, conversation state and computer-use agents. Here is how to migrate safely.

Conflicting Grok 4.7 evaluations show why serious product teams should test models on their own code, harnesses, costs and failure budgets before switching.

A public image upload became internal repository access. The lasting lesson is how AI changes exploit economics—and which architecture controls still stop the chain.

The September outage cluster exposed a simple production risk: an AI feature needs a tested degraded mode, not just a second model endpoint.

DeepSeek's new Responses API support makes model evaluation easier, but serious teams still need compatibility tests, security boundaries, compliance checks, and a rollback plan.

The OpenAI and Hugging Face incident turns agent containment from a theoretical concern into an architecture and operations requirement.

MCP 2026-07-28 removes protocol sessions and makes remote servers easier to scale. Here is what production teams should redesign before upgrading.

Agentic coding tools can now change files, run commands, and influence delivery. Serious teams need production gates for secrets, dependencies, tests, architecture, and auditability.