The Harm SurfaceAI, cyber, and autonomy

Guidance · one question, worked until it held

The brief says how much to care. This says what to do about it.

The third part of the weekly promise, given the room it needs: one thing worth doing, taken from a question a security leader would actually ask, and worked until it held up against a real incident rather than a tabletop.

Four rules, no exceptions

The question is not ours

Every question comes from the corpus, printed in the words it was asked in.

Every source was opened

Read in full, never summarized from someone else's summary.

The edge is stated

What could not be established is in the piece. An answer with no edge claims a completeness nobody can check.

Nothing is sold

No piece requires buying anything, and no vendor sees one before publication.

The questions · 1 published · G-02 in the work

G-01 8 August 2026

The question, as asked

When I am inside an intrusion that might be somebody's evaluation, what must I do anyway, and what does it cost me to be wrong in each direction?

Contain it the same way

Attribution arrives by press release, days late, and nothing you can do during response will hurry it. The reassuring part is that it changes nothing: contain it exactly as you would an adversary. The part worth acting on this week is the tool your analysts already reach for, which nobody has tested.

Asked after · Four stories in a fortnight: the OpenAI agent that burned a zero-day through JFrog on its way to Hugging Face, Elastic's stage-by-stage detection mapping of that intrusion, a Meta model that reached a third party through its testing firm, and the UK AI Security Institute's incident report on agents that phished real developers.

What it asks you to do

  • Feed it real forensic logs from a past incident, payloads and command-and-control traffic included. Sanitize them, or self-host, until the retention contract is read: those logs carry whatever the intruder was moving. Does it refuse to analyze an attack that really happened?
  • Read the contract for zero data retention. The contract, not the marketing page.
  • Ask what your responders do when the provider is down at hour six.
  • Now the same test with the truth reversed. Hand it something benign that only looks hostile. Does it call an incident that is not one?
G-02 Not written yet

The question for the next piece is still being chosen from the week's corpus. A piece is written when a question earns it, not on a schedule. If nothing that week holds up under testing, nothing publishes.

What it will carry: the question printed in the words it was asked in · three actions, each costed in hours rather than in intent · what could not be established, stated plainly.

This starts in the weekly brief.

The questions come from reading the week. Subscribing is how you see the week they came from.