Nobody in AI security is gradable enough. Every vendor pitch has a “where the market is going” slide. Almost none of them come back three months later and check whether any of it was right.
So I run a third brain on top of my reading: a public prediction ledger with dated, testable calls I re-grade every cycle. Full disclosure: every one of these calls shapes what my company, Anzenna, is building. That’s exactly why I grade them in public. If they’re wrong, my strategy is wrong, and I’d rather find out here than in a boardroom two quarters later.
Here are the five I care about most right now.
#1. Human-in-the-loop approval in coding assistants is structurally unreliable; the defensible control shifts to independent behavioral monitoring
The trust model in every AI coding assistant shipping today is “the user approves each privileged action.” It’s the box vendors point to in every enterprise sales conversation, the answer to the security-questionnaire item about authorization for privileged actions, the mechanism your CISO thinks sits between the assistant and a compromised laptop. My call is that the model is structurally broken, and the defensible control has to move out of the assistant’s own dialog and into behavioral monitoring that observes what the agent actually did, on independent logs, out of band from anything the assistant chose to render.
If this holds, the industry has a bigger problem than it currently admits. The approval prompt isn’t a small piece of the trust story. It is the trust story. If attackers can walk past it by lying about the filename, prepending “Additionally” to a prompt, or exploiting an opt-out that never worked, then the layer enterprise buyers have been told is the safety mechanism is standing on a control that doesn’t hold. That’s a category assumption that has to be revisited across every vendor in the space, ours included.
Three findings landed in a single week and each one says the same thing in a different accent. Wiz’s GhostApproval, a symlink flaw across six coding assistants (Amazon Q, Claude Code, Cursor, Google Antigravity, Augment, Windsurf), lets a malicious repository write to ~/.ssh/authorized_keys or ~/.zshrc while the approval dialog displays an innocent filename. Noma’s GitLost showed a GitHub agentic workflow leaking the contents of private repositories into a public issue comment, with the exfiltration guardrail bypassed by literally prepending “Additionally” to the injected prompt. A wire-level analysis of xAI’s Grok CLI found it uploading entire repositories and verbatim .env secrets to a vendor bucket, and the upload persists even with the “Improve the model” toggle turned off. Different vendors, different failure modes, same conclusion: the approval prompt is a UI, not a control.
#2. Detection-as-data becomes the standard for AI agent security
Threat intelligence for AI agents is moving toward PR-reviewed structured JSON, not rules compiled into a vendor’s binary. The logic is mechanical: when detections are data, the community can contribute; when they’re locked in a binary, only the vendor can. The attacker surface here changes every couple of weeks, and a novel skill-injection technique can go from research paper to weaponized in a fortnight. The update-cadence race is not close. Whichever architecture lets more hands touch the rulebook wins.
The consequence for how you build defense is what matters. If detections are a shared, open corpus, the winning defenders are the ones with the best runtime substrate to consume that corpus and act on it, not the ones with the fattest static scanner. Community-contributed intel only pays off if something is watching what the agent actually does when the IOC lands.
The evidence has been steady. Perplexity’s bumblebee project ships a threat_intel/ directory of PR-reviewed JSON files, eight curated malware catalogs, 654 entries across 2,291 affected versions. OpenSSF’s malicious-packages database does the same at scale, over 71,000 entries in OSV format. Cisco co-published a Foundry Security Spec for building equivalent evaluation systems as reviewable data. Anthropic’s Project Glasswing shipped a public vulnerability-scanning harness on GitHub with the scanning skills and threat-model builder as open artifacts. Every major research group producing agent-security intel in 2026 is releasing it as data, not as a black box.
#3. In-line blocking is not required to cover most AI-agent cloud-compromise risk
The reigning talking point in AI-agent cloud-compromise conversations for most of this year has been Adan Alvarez’s “60-second exfil”: a leaked AWS key going from disclosure to full compromise in about a minute. The consensus reading was that observe-and-respond can’t possibly keep up, so inline blocking is the only viable defense. The data now points the other way. A properly-instrumented environment with observe + canaries + fast response covers most of the actual risk without paying the operational cost of inline enforcement.
This matters because inline blocking on AI-agent activity is not free. Every false positive is a broken developer workflow. Every model refusal is a support ticket. Every latency hit is a reason for the team to route around your control. If observe + canaries + fast response covers most of the risk, the sustainable enforcement posture is the lighter one, and any vendor architecture built on “you must block or you lose” is optimizing for the wrong constraint.
Tracebit’s benchmark settled it: 951 real agent-vs-cloud runs against instrumented AWS environments. The median time from compromise to admin was 14 minutes, not 60 seconds. Canaries warned before the agent took a critical action in 95.9% of runs. Deception prompting cut the compromise rate from 20% to 3%. The Alvarez number was a real single-shot outlier, not the population median.
#4. The AI-feature attack surface expands beyond coding agents faster than any single vendor covers it
Every vendor pitch in this category, mine included, implicitly assumes the surface is Claude Code, Cursor, Codex, and their siblings. That’s where the incidents get press, where the researchers publish, where the buying committees have already started asking questions. It’s a real surface. It’s not the whole surface. AI-agent execution capabilities are showing up in databases, CI/CD, and identity systems faster than any single vendor can keep up, and coverage strategies that key only off the coding-tool binary will miss the majority of the actual attack surface within two quarters.
This is where the architectural bet lives. Coverage designed as “watch what Claude Code and Cursor do on the developer’s laptop” is a control built for last quarter’s threat model. The right architecture is a surface-agnostic egress and behavior primitive: something that observes AI-agent-shaped activity wherever it runs, without needing to know the specific tool binary in advance. Harder engineering bet. That’s the one my team is making.
The evidence keeps arriving. SpecterOps’ “Oops, I Weaponized the Database” turned SQL Server 2025’s new AI features (external REST endpoints, embedding models, xp_cmdshell output returned through embedding functions) into a working C2 and exfil channel out of the database engine itself. Datadog published “Entra Agent ID: Blueprint Blast Radius” mapping how Microsoft’s agent identity primitive holds and reuses credentials outside the human-authorization model. GitHub Actions was already in play as an agentic execution layer before any of this year’s incidents, and it stays in play. Every one of these is a place where an AI agent runs code with privileges on data the customer cares about. None of them is a coding assistant.
#5. OpenAI ships defender tooling
Frontier-model providers usually enter adjacent markets through the supply chain they already own, not through a new deployment surface. The call was that OpenAI would enter defensive security on the model-provider side within a quarter: a specialized cyber-tuned model plus the partner-program plumbing to embed it in the existing defensive stack, long before they took on the harder problem of directly instrumenting endpoints.
The nuance is which layer moved. What OpenAI shipped is model plumbing and a partner program, not an on-endpoint control that judges each proposed agent action in-line and decides whether to let it through. That kind of on-device behavioral gatekeeping is where a model provider would actually enter the endpoint-agent-monitoring layer, and Daybreak doesn’t do it. The trip-wire worth watching from here is different. CrowdStrike is now holding a frontier cyber model and already owns the endpoint. If it turns GPT-5.5-Cyber toward agent runtime monitoring on that endpoint, the market moves.
Three weeks after the call, OpenAI shipped Daybreak: GPT-5.5-Cyber as a fine-tuned frontier model for cyber operations, a Codex Security plugin covering threat modeling and patch generation, and a Cyber Partner Program embedding GPT-5.5-Cyber into CrowdStrike, Palo Alto, and Wiz’s products. Three weeks is fast enough for the timing not to be luck.
Why I bother
Every one of these calls shapes what my team builds. That’s the honest reason to write them down in public. Not to be right. To be gradable, and to have the strategy grade with them. Nobody in this industry is gradable enough. Trying to close the gap, at least for one voice.