Published research on agentic AI control failure, behavioral governance, and the gaps that compliance reviews miss — research notes, analyses, research briefs and working papers.
The exploitation of agentic AI systems to produce unauthorized outcomes — a risk category existing fraud frameworks were not built to address. In development.
A real enterprise case shows how individually authorised agent actions, each correct on its own platform, combined into 87 instances of commission exceeding deal margin — and why no segregation-of-duty control caught it.
Most agentic AI governance programmes have built strong permission controls and treated the audit layer as a logging checkbox. The two require entirely different kinds of control.
AI agents accumulate memory across sessions — and that memory changes how they behave over time. Most governance programs have not drawn the boundary around it.
Why agentic systems need a layer that verifies what an agent did against what it was authorized to do — and what happens when that layer is missing.
Autonomous vulnerability research has arrived. What a 27-year-old OpenBSD bug and a lunchtime email tell us about the structural limits of human-speed defense.
A governance framework for organisations deploying autonomous AI agents in production — structured across five intervention pillars with implementation prioritisation for Risk, Control, and Board-level oversight.
Prompt injection is an integrity failure that no security product can currently solve as a class. What this means for every organisation deploying AI agents under FINMA, EU AI Act, and GDPR.
NIST AI 800-4 documents deceptive AI behavior as an unsolved security monitoring problem. Pre-deployment evaluations exist — but face a structural ceiling. What this means for agentic deployments in regulated industries.
Looking for research in progress, not yet published? Inside the Lab →