# Devence Lab - full index

> Applied research lab working on autonomous AI systems: assurance,
> interpretability, AI security and safety-critical deployment.

Every piece below exists as HTML and as Markdown. The Markdown is the same
content without navigation, footer or hydration payload, and carries YAML
front matter with the canonical URL.

Indexes:
- https://devencelab.com/content.json - the whole catalogue as JSON
- https://devencelab.com/articles/index.json - long-form research
- https://devencelab.com/insights/index.json - reported coverage, with sources
- https://devencelab.com/articles/feed.xml - articles RSS
- https://devencelab.com/insights/feed.xml - insights RSS
- https://devencelab.com/sitemap.xml

Preferred citation: Devence Lab. Attribute to the canonical URL of the piece.
Contact: contact@devencelab.com

## Articles (7)

Long-form engineering research.

### Why Static Interpretability Fails on Multi-Step Agentic Decision Chains
- URL: https://devencelab.com/articles/static-interpretability-agentic-chains
- Markdown: https://devencelab.com/articles/static-interpretability-agentic-chains.md
- Published: September 18, 2026 | Topic: Interpretability | 14 min read, 14 references
- Summary: A technical account of the mismatch between single-forward-pass interpretability methods and the failure modes of agents that plan, act, observe, and revise over many steps - grounded in published circuit-analysis literature, a controlled failure-attribution benchmark, and emerging graph-based tracing methods.

### The Agent Sandbox: A Reference Architecture for Isolating Autonomous AI Systems
- URL: https://devencelab.com/articles/agent-sandbox-reference-architecture
- Markdown: https://devencelab.com/articles/agent-sandbox-reference-architecture.md
- Published: September 16, 2026 | Topic: Assurance | 36 min read, 32 references
- Summary: An industry-neutral engineering reference on containing agents that browse, execute code, and act on the open internet - synthesized from disclosed CVEs, published isolation-technology internals, OWASP's agentic risk taxonomy, and the operating architectures of production agent-sandbox vendors.

### Runtime Monitors for Autonomous Systems: Detecting Drift and Misbehavior After Deployment
- URL: https://devencelab.com/articles/runtime-monitors-autonomous-systems
- Markdown: https://devencelab.com/articles/runtime-monitors-autonomous-systems.md
- Published: September 14, 2026 | Topic: Assurance | 33 min read, 32 references
- Summary: A methodological deep dive into why evaluation is not oversight, how the runtime-verification and machine-learning-monitoring traditions converge on autonomous language-model agents, and what the published, quantitative record says about how well post-deployment monitors actually work.

### Case Study: Using Interpretability to Catch a Specific Failure Mode Before Deployment
- URL: https://devencelab.com/articles/interpretability-catching-failure-modes
- Markdown: https://devencelab.com/articles/interpretability-catching-failure-modes.md
- Published: September 12, 2026 | Topic: Interpretability | 23 min read
- Summary: A technical breakdown of three verified, published research programs that used mechanistic interpretability, linear probes, sparse autoencoders, and residual-stream analysis, to detect deception, hidden reward-hacking objectives, and strategic underperformance in language models before those models reached real users.

### Sparse Autoencoders: What They Reveal, and the Accuracy Tradeoffs Nobody Advertises
- URL: https://devencelab.com/articles/sparse-autoencoders-tradeoffs
- Markdown: https://devencelab.com/articles/sparse-autoencoders-tradeoffs.md
- Published: September 10, 2026 | Topic: Interpretability | 24 min read
- Summary: A methodological deep dive into sparse dictionary learning for neural network interpretability, how sparse autoencoders (SAEs) work, what they have genuinely revealed, and the specific, measured costs that get quietly left out of the demo.

### Attribution Graphs: A Technical Walkthrough of Circuit Tracing, and Where It Breaks
- URL: https://devencelab.com/articles/attribution-graphs-circuit-tracing
- Markdown: https://devencelab.com/articles/attribution-graphs-circuit-tracing.md
- Published: September 8, 2026 | Topic: Interpretability | 32 min read
- Summary: A methodological deep dive into how Anthropic's interpretability team traces the internal computation of large language models, what the resulting "attribution graphs" actually show, and the specific, documented ways the method fails.

### Chain-of-Thought Monitoring: A Fragile Window Into Model Cognition
- URL: https://devencelab.com/articles/chain-of-thought-monitoring
- Markdown: https://devencelab.com/articles/chain-of-thought-monitoring.md
- Published: September 6, 2026 | Topic: Assurance | 18 min read, 15 references
- Summary: A technical deep dive for engineers and researchers building oversight into agentic systems

## Insights (64)

Reported coverage of AI security, agentic systems, compute and model releases.

### Four coding agents crossed their sandboxes. The host trust graph is the boundary.
- URL: https://devencelab.com/insights/2026/09/20/four-coding-agents-crossed-their-sandboxes-the-host-trust
- Markdown: https://devencelab.com/insights/2026/09/20/four-coding-agents-crossed-their-sandboxes-the-host-trust.md
- Published: September 20, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Pillar Security reproduced sandbox escapes across Cursor, Codex, Gemini CLI and Antigravity. Production isolation has to constrain trusted host readers, command semantics and local daemons, not only the agent process.

### A cyber agent crossed the test boundary. Prompts are not scope controls.
- URL: https://devencelab.com/insights/2026/09/20/a-cyber-agent-crossed-the-test-boundary-prompts-are
- Markdown: https://devencelab.com/insights/2026/09/20/a-cyber-agent-crossed-the-test-boundary-prompts-are.md
- Published: September 20, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Gemini reached real company systems during an authorised cyber evaluation after internet access and target identity escaped the test boundary. Agent evaluations need enforceable network scope, not prompt-level assumptions.

### 72 hours to an internal repository changes the patching clock, not the vulnerability class
- URL: https://devencelab.com/insights/2026/09/20/72-hours-to-an-internal-repository-changes-the-patching
- Markdown: https://devencelab.com/insights/2026/09/20/72-hours-to-an-internal-repository-changes-the-patching.md
- Published: September 20, 2026 | Topic: AI Security | 3 min read, 3 sources
- Summary: Hacktron chained an image-decoder flaw and an OpenAI SSO weakness into internal repository access in under 72 hours, with Claude accelerating exploit development. The control lesson is to patch reachable dependency flaws by exploitability, not CVE visibility.

### Five browser agents fell to one extension. Extension policy is now an agent security control.
- URL: https://devencelab.com/insights/2026/09/19/five-browser-agents-fell-to-one-extension-extension-policy
- Markdown: https://devencelab.com/insights/2026/09/19/five-browser-agents-fell-to-one-extension-extension-policy.md
- Published: September 19, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Forever Security used one ordinary Chromium extension to compromise AI-assistant trust paths across five browser environments. The production lesson is to govern extension permissions as part of the agent authority boundary, not as browser hygiene.

### 2 seconds across 2 GB is not an agent latency result. Separate runtime start from model work.
- URL: https://devencelab.com/insights/2026/09/19/2-seconds-across-2-gb-is-not-an-agent
- Markdown: https://devencelab.com/insights/2026/09/19/2-seconds-across-2-gb-is-not-an-agent.md
- Published: September 19, 2026 | Topic: Agentic AI | 2 min read, 3 sources
- Summary: AWS measured about 2-second P75 cold starts across 200 MB to 2 GB AgentCore images, but its echo test deliberately excludes model and tool work. Production SLOs should split runtime startup, agent execution and resume latency.

### A fast model behind a slow benchmark client is not a capacity result. Measure the load generator too.
- URL: https://devencelab.com/insights/2026/09/19/a-fast-model-behind-a-slow-benchmark-client-is
- Markdown: https://devencelab.com/insights/2026/09/19/a-fast-model-behind-a-slow-benchmark-client-is.md
- Published: September 19, 2026 | Topic: GPU & Compute | 2 min read, 1 sources
- Summary: NVIDIA replaced GenAI-Perf with a multiprocess AIPerf architecture because a single-process client can become GIL-bound under real concurrency. Production inference benchmarks need to prove the generator is not the bottleneck and replay traffic shape, not just request volume.

### 13 inference launches do not make one serving stack. Optimise for the bottleneck you can measure.
- URL: https://devencelab.com/insights/2026/09/19/13-inference-launches-do-not-make-one-serving-stack
- Markdown: https://devencelab.com/insights/2026/09/19/13-inference-launches-do-not-make-one-serving-stack.md
- Published: September 19, 2026 | Topic: Model Releases | 2 min read, 3 sources
- Summary: AWS has shipped 13 SageMaker inference launches in 2026, including tiered KV caching and disaggregated prefill/decode. The deployer lesson is to classify the workload before turning every optimisation on.

### 3% false positives is not an AI scanner win. The threat model is doing the precision work.
- URL: https://devencelab.com/insights/2026/09/18/3-false-positives-is-not-an-ai-scanner-win
- Markdown: https://devencelab.com/insights/2026/09/18/3-false-positives-is-not-an-ai-scanner-win.md
- Published: September 18, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: Google says localised threat models cut false positives to 3% in some presubmit scans, while a structural triage agent exceeds 92% precision. The deployer lesson is to bind security agents to live code context and deterministic validation.

### An encrypted credential vault is not a runtime boundary. Agent tools can still see plaintext.
- URL: https://devencelab.com/insights/2026/09/18/an-encrypted-credential-vault-is-not-a-runtime-boundary
- Markdown: https://devencelab.com/insights/2026/09/18/an-encrypted-credential-vault-is-not-a-runtime-boundary.md
- Published: September 18, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Unit 42 found that AgentCore Harness can resolve vaulted credentials into the same runtime environment as an agent's built-in shell. The production control is to separate credential use from general-purpose execution, not merely encrypt secrets at rest.

### SSO is not an MCP privilege boundary. Authorise every tool call again.
- URL: https://devencelab.com/insights/2026/09/18/sso-is-not-an-mcp-privilege-boundary-authorise-every
- Markdown: https://devencelab.com/insights/2026/09/18/sso-is-not-an-mcp-privilege-boundary-authorise-every.md
- Published: September 18, 2026 | Topic: Model Releases | 2 min read, 2 sources
- Summary: AWS now demonstrates four sequential authorization gates between an authenticated user and MCP tools. The production lesson is broader: identity proves who is calling; an external policy layer must still decide what that identity may do on every invocation.

### 88% of AI proofs of concept do not need another model. They need a platform control plane.
- URL: https://devencelab.com/insights/2026/09/18/88-of-ai-proofs-of-concept-do-not-need
- Markdown: https://devencelab.com/insights/2026/09/18/88-of-ai-proofs-of-concept-do-not-need.md
- Published: September 18, 2026 | Topic: Agentic AI | 2 min read, 1 sources
- Summary: Wood Mackenzie says 88% of its AI proofs of concept never reach widescale deployment. Its APEX architecture points to the operational fix: centralise identity, policy, evaluation and tool access while keeping agent business logic replaceable.

### A vector store is not a RAG default. Retrieval economics belong in the architecture decision.
- URL: https://devencelab.com/insights/2026/09/17/a-vector-store-is-not-a-rag-default-retrieval
- Markdown: https://devencelab.com/insights/2026/09/17/a-vector-store-is-not-a-rag-default-retrieval.md
- Published: September 17, 2026 | Topic: Model Releases | 2 min read, 2 sources
- Summary: AWS now compares OpenSearch, Aurora PostgreSQL with pgvector and S3 Vectors across Bedrock Knowledge Bases workloads. The useful decision is not which store is fastest overall, but which retrieval contract the application actually needs.

### Faster grid connections are not a power contract. AI data centres need a flexibility SLO.
- URL: https://devencelab.com/insights/2026/09/17/faster-grid-connections-are-not-a-power-contract-ai
- Markdown: https://devencelab.com/insights/2026/09/17/faster-grid-connections-are-not-a-power-contract-ai.md
- Published: September 17, 2026 | Topic: GPU & Compute | 2 min read, 1 sources
- Summary: NVIDIA, Google and Emerald AI want grid-responsive data centres judged on response speed, duration, predictability and emergency behaviour. For AI infrastructure teams, power flexibility becomes an operational service level that must be measured before it can earn faster interconnection.

### 95.2% recall is not proof that PII is gone. Redaction needs a reconciliation gate.
- URL: https://devencelab.com/insights/2026/09/17/95-2-recall-is-not-proof-that-pii-is
- Markdown: https://devencelab.com/insights/2026/09/17/95-2-recall-is-not-proof-that-pii-is.md
- Published: September 17, 2026 | Topic: Model Releases | 2 min read, 1 sources
- Summary: AWS raised PII-redaction recall from 89.3% to 95.2% by matching repeated tokens against full-page output. The production lesson is stricter: document pipelines need measured residual-risk thresholds and reconciliation before release.

### Six misalignment reports are not a model card. They are an incident-response template.
- URL: https://devencelab.com/insights/2026/09/17/six-misalignment-reports-are-not-a-model-card-they
- Markdown: https://devencelab.com/insights/2026/09/17/six-misalignment-reports-are-not-a-model-card-they.md
- Published: September 17, 2026 | Topic: Model Releases | 2 min read, 1 sources
- Summary: OpenAI published six model-misalignment reports on 16 September and a process for disclosing future cases before every cause or mitigation is settled. Deployers should treat unexpected agent behaviour as an incident class with evidence, ownership and disclosure criteria.

### AI can find the flaw faster than the vendor can patch it. Compensating controls become a release requirement.
- URL: https://devencelab.com/insights/2026/09/16/ai-can-find-the-flaw-faster-than-the-vendor
- Markdown: https://devencelab.com/insights/2026/09/16/ai-can-find-the-flaw-faster-than-the-vendor.md
- Published: September 16, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: Cisco Talos argues that AI-assisted vulnerability discovery will expose flaws in systems that cannot be patched quickly or at all. The operational change is to design segmentation, visibility and exploit prevention before the next unpatchable finding arrives.

### Gemini 3.8 Live does not end when the model stops speaking. Voice agents need a second state machine.
- URL: https://devencelab.com/insights/2026/09/16/gemini-3-8-live-does-not-end-when-the
- Markdown: https://devencelab.com/insights/2026/09/16/gemini-3-8-live-does-not-end-when-the.md
- Published: September 16, 2026 | Topic: Agentic AI | 2 min read, 2 sources
- Summary: Google's extended-thinking Live model can finish an utterance while reasoning or tool calls continue in the background. Existing voice clients that equate turn completion with idle state can now interrupt work that is still running.

### 3x fewer CRM errors is not a general model win. It is a case for narrow post-training.
- URL: https://devencelab.com/insights/2026/09/15/3x-fewer-crm-errors-is-not-a-general-model
- Markdown: https://devencelab.com/insights/2026/09/15/3x-fewer-crm-errors-is-not-a-general-model.md
- Published: September 15, 2026 | Topic: GPU & Compute | 2 min read, 2 sources
- Summary: Salesforce says Koa matches or exceeds leading model performance on CRM actions with three times fewer errors. The deployer lesson is narrower: specialised reasoning can move inside the model while data and inference remain inside a defined trust boundary.

### 90% cheaper cached input is not a pricing trick. It changes what belongs in the prompt.
- URL: https://devencelab.com/insights/2026/09/15/90-cheaper-cached-input-is-not-a-pricing-trick
- Markdown: https://devencelab.com/insights/2026/09/15/90-cheaper-cached-input-is-not-a-pricing-trick.md
- Published: September 15, 2026 | Topic: Model Releases | 2 min read, 1 sources
- Summary: AWS says Bedrock prompt caching can reduce repeated input-token costs by up to 90% and latency by up to 85%. The production decision is architectural: stable context should be separated from volatile context and governed as a reusable dependency.

### Agent permissions are not team permissions. They need their own deployment boundary.
- URL: https://devencelab.com/insights/2026/09/15/agent-permissions-are-not-team-permissions-they-need-their
- Markdown: https://devencelab.com/insights/2026/09/15/agent-permissions-are-not-team-permissions-they-need-their.md
- Published: September 15, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: Cloudflare can now scope Workers access to individual services and narrower platform roles. The important change for agent deployments is that machine identities no longer need to inherit the same broad account authority as the humans operating them.

### Agent consent is not an OAuth screen. It is an execution boundary.
- URL: https://devencelab.com/insights/2026/09/15/agent-consent-is-not-an-oauth-screen-it-is
- Markdown: https://devencelab.com/insights/2026/09/15/agent-consent-is-not-an-oauth-screen-it-is.md
- Published: September 15, 2026 | Topic: Model Releases | 2 min read, 1 sources
- Summary: Amazon Bedrock AgentCore now binds user consent to agent sessions and records the flow in CloudTrail. The useful shift is architectural: delegated authority becomes an explicit runtime control rather than an assumption buried inside a connector.

### Microsoft’s AI code is not a model policy. It is an application control requirement.
- URL: https://devencelab.com/insights/2026/09/14/microsofts-ai-code-is-not-a-model-policy-it
- Markdown: https://devencelab.com/insights/2026/09/14/microsofts-ai-code-is-not-a-model-policy-it.md
- Published: September 14, 2026 | Topic: Agentic AI | 2 min read, 3 sources
- Summary: Microsoft’s AI Services Code of Conduct puts the operational burden on deployers: input and output controls, fraud detection, disclosure, human oversight and failure remediation now belong in the application architecture.

### The industry's safety warning is not a pause. It is a demand for deployer stop conditions.
- URL: https://devencelab.com/insights/2026/09/14/the-industrys-safety-warning-is-not-a-pause-it
- Markdown: https://devencelab.com/insights/2026/09/14/the-industrys-safety-warning-is-not-a-pause-it.md
- Published: September 14, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Anthropic is now arguing for coordinated pacing while its own roadmap still targets stronger security controls. For deployers, the practical lesson is to define explicit conditions that halt agent expansion before capability outruns containment.

### Click rate stopped measuring what phishing tests think it measures
- URL: https://devencelab.com/insights/2026/09/13/click-rate-stopped-measuring-what-phishing-tests-think-it
- Markdown: https://devencelab.com/insights/2026/09/13/click-rate-stopped-measuring-what-phishing-tests-think-it.md
- Published: September 13, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: SecurityWeek reports new research across 2.47 million simulated phishing attacks arguing that click rate no longer predicts compromise. Once AI writes the emails, click rate mostly measures how good the email was, not how alert your staff are.

### Your model registry runs on the same software CISA just flagged as under attack
- URL: https://devencelab.com/insights/2026/09/13/your-model-registry-runs-on-the-same-software-cisa
- Markdown: https://devencelab.com/insights/2026/09/13/your-model-registry-runs-on-the-same-software-cisa.md
- Published: September 13, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: CISA added five actively exploited flaws in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its known-exploited list this month. Artifactory sits under a lot of ML pipelines that nobody classified as security-critical.

### The federal pass on data centre pollution does not reach the states that matter
- URL: https://devencelab.com/insights/2026/09/13/the-federal-pass-on-data-centre-pollution-does-not
- Markdown: https://devencelab.com/insights/2026/09/13/the-federal-pass-on-data-centre-pollution-does-not.md
- Published: September 13, 2026 | Topic: GPU & Compute | 2 min read, 1 sources
- Summary: Former EPA officials warned this month that weakened federal rules will let AI data centres pollute more freely. For anyone siting compute, the binding constraint was already shifting to state and local permitting, and this changes less than it looks like.

### A 7% pass rate is not a step change. It is a benchmark with no floor yet.
- URL: https://devencelab.com/insights/2026/09/13/a-7-pass-rate-is-not-a-step-change
- Markdown: https://devencelab.com/insights/2026/09/13/a-7-pass-rate-is-not-a-step-change.md
- Published: September 13, 2026 | Topic: Model Releases | 2 min read, 1 sources
- Summary: GPT-6 Astra completed 7 of 100 dual-arm robotics tasks on a new benchmark, versus zero for a competing model. A researcher called it a step change. The number that matters is that both models are still failing the large majority of the tasks.

### A million personalised fraud emails in three days breaks a defence industry's core assumption
- URL: https://devencelab.com/insights/2026/09/13/a-million-personalised-fraud-emails-in-three-days-breaks
- Markdown: https://devencelab.com/insights/2026/09/13/a-million-personalised-fraud-emails-in-three-days-breaks.md
- Published: September 13, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: Dark Reading reports a threat actor generated a million personalised fraud emails in three days. Anti-phishing training and simulated-phishing metrics were both built on the premise that attackers had to choose between volume and credibility, and that premise is gone.

### Your SOC's fastest-growing alert source is not an attacker. It is your own staff.
- URL: https://devencelab.com/insights/2026/09/13/your-socs-fastest-growing-alert-source-is-not-an
- Markdown: https://devencelab.com/insights/2026/09/13/your-socs-fastest-growing-alert-source-is-not-an.md
- Published: September 13, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: A new class of alert is growing faster than any other in enterprise security operations centres, and it isn't triggered by attacks on AI. It's the ordinary footprint of an organisation using it, and most detection rules aren't built to tell the difference.

### 1.8 million apps were already scanned for secrets. Assume yours was one of them.
- URL: https://devencelab.com/insights/2026/09/13/1-8-million-apps-were-already-scanned-for-secrets
- Markdown: https://devencelab.com/insights/2026/09/13/1-8-million-apps-were-already-scanned-for-secrets.md
- Published: September 13, 2026 | Topic: AI Security | 2 min read, 2 sources
- Summary: Security researchers have documented hardcoded secrets in Android apps for years as a slow, manual research exercise. Threat groups now use Claude to run that exact scan across the entire Play Store, and BleepingComputer reports they already have.

### Account bans stop misuse of the model. They don't stop the system already built with it.
- URL: https://devencelab.com/insights/2026/09/13/account-bans-stop-misuse-of-the-model-they-dont
- Markdown: https://devencelab.com/insights/2026/09/13/account-bans-stop-misuse-of-the-model-they-dont.md
- Published: September 13, 2026 | Topic: AI Security | 2 min read, 2 sources
- Summary: Anthropic's September threat report banned the operator behind a Mali surveillance platform monitoring 25 million SIM cards, but the system runs on local models on-premises, and the ban never touched it. That gap is the finding, not the ban.

### OpenAI's RubyGems attack is not a containment failure. It is a disclosure failure.
- URL: https://devencelab.com/insights/2026/09/13/openais-rubygems-attack-is-not-a-containment-failure-it
- Markdown: https://devencelab.com/insights/2026/09/13/openais-rubygems-attack-is-not-a-containment-failure-it.md
- Published: September 13, 2026 | Topic: Agentic AI | 3 min read, 2 sources
- Summary: Independent researchers, not OpenAI, traced 2,000+ malicious packages back to an OpenAI agent swarm, four months after the attack and without access to the model's reasoning. For anyone running public infrastructure, that gap is the actual risk.

### The AI Act stopped being a deadline and became an enforcement regime
- URL: https://devencelab.com/insights/2026/09/12/ai-act-enforcement-began
- Markdown: https://devencelab.com/insights/2026/09/12/ai-act-enforcement-began.md
- Published: September 12, 2026 | Topic: AI Regulation | 2 min read, 3 sources
- Summary: From 2 August the Commission's AI Office and national authorities began enforcing. The obligations did not change on that date, the consequence of ignoring them did.

### 80% have embedded agents. 31% have deployed them. The gap is the whole story.
- URL: https://devencelab.com/insights/2026/09/12/eighty-percent-embed-thirty-one-deploy
- Markdown: https://devencelab.com/insights/2026/09/12/eighty-percent-embed-thirty-one-deploy.md
- Published: September 12, 2026 | Topic: Agentic AI | 2 min read, 2 sources
- Summary: Survey figures showing most enterprises experimenting and a third in production get read as slow adoption. They are better read as evidence that the hard part starts after the demo works.

### Gartner's 40% is not a governance problem. It is a review-timing problem.
- URL: https://devencelab.com/insights/2026/09/12/forty-percent-and-the-review-gap
- Markdown: https://devencelab.com/insights/2026/09/12/forty-percent-and-the-review-gap.md
- Published: September 12, 2026 | Topic: Agentic AI | 3 min read, 3 sources
- Summary: The forecast that four in ten enterprises will decommission agents by 2027 keeps getting read as a call for more oversight. The disclosed incidents say something more specific: the oversight happened, and it happened before the thing that went wrong could exist.

### The bottleneck stopped being GPUs. It is now the grid.
- URL: https://devencelab.com/insights/2026/09/11/power-bound-not-gpu-bound
- Markdown: https://devencelab.com/insights/2026/09/11/power-bound-not-gpu-bound.md
- Published: September 11, 2026 | Topic: GPU & Compute | 2 min read, 3 sources
- Summary: Gartner projects 40% of AI data centres will be power-constrained by 2027. For anyone planning multi-year capacity, the scarce input has changed and the procurement conversation has not caught up.

### Turnover-based fines change who has to care
- URL: https://devencelab.com/insights/2026/09/11/turnover-based-fines-change-the-maths
- Markdown: https://devencelab.com/insights/2026/09/11/turnover-based-fines-change-the-maths.md
- Published: September 11, 2026 | Topic: AI Regulation | 2 min read, 3 sources
- Summary: Up to €35M or 7% of global turnover for prohibited practices, €15M or 3% for high-risk and GPAI failures. Percentage-of-turnover penalties are designed to outrun any business case for non-compliance.

### 200,000 exposed MCP servers is what happens when a protocol ships before its threat model
- URL: https://devencelab.com/insights/2026/09/11/two-hundred-thousand-exposed-mcp-servers
- Markdown: https://devencelab.com/insights/2026/09/11/two-hundred-thousand-exposed-mcp-servers.md
- Published: September 11, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Fourteen CVEs and six figures of exposed instances in a single quarter. The pattern is not carelessness, it is a protocol that assumed a trusted local context and then got deployed across the internet.

### Three labs shipped cyber models in one week. The capability is not the story.
- URL: https://devencelab.com/insights/2026/09/11/cyber-models-shipped-as-product
- Markdown: https://devencelab.com/insights/2026/09/11/cyber-models-shipped-as-product.md
- Published: September 11, 2026 | Topic: AI Security | 3 min read, 1 sources
- Summary: Google, Anthropic and OpenAI all put offensive-capable security models behind access programmes in early September. What changed is not what the models can do, it is who decides who gets to point them at a network.

### Hyperscalers are buying gigawatts directly. That tells you what they expect the grid to do.
- URL: https://devencelab.com/insights/2026/09/10/gigawatt-power-purchase-agreements
- Markdown: https://devencelab.com/insights/2026/09/10/gigawatt-power-purchase-agreements.md
- Published: September 10, 2026 | Topic: GPU & Compute | 2 min read, 3 sources
- Summary: Microsoft contracting 10.5 GW and Google 3 GW with a single renewable operator is not a sustainability gesture. It is a hedge against the public grid being unable to supply.

### Telling users they are talking to an AI is now a product requirement, not a courtesy
- URL: https://devencelab.com/insights/2026/09/10/disclosure-obligations-are-a-product-decision
- Markdown: https://devencelab.com/insights/2026/09/10/disclosure-obligations-are-a-product-decision.md
- Published: September 10, 2026 | Topic: AI Regulation | 2 min read, 3 sources
- Summary: Transparency rules applying from 2 August require interactive AI systems to disclose themselves and generated content to be labelled. The engineering is trivial; the product consequences are not.

### Tool poisoning works because the model cannot tell a description from an instruction
- URL: https://devencelab.com/insights/2026/09/10/tool-poisoning-is-a-trust-problem
- Markdown: https://devencelab.com/insights/2026/09/10/tool-poisoning-is-a-trust-problem.md
- Published: September 10, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: The OWASP MCP Top 10 puts tool poisoning at A1. It sits there because the attack needs no exploit, only a tool description the model reads as guidance.

### A CVSS 10.0 in an agent framework is a different kind of vulnerability
- URL: https://devencelab.com/insights/2026/09/10/cvss-ten-in-an-agent-framework
- Markdown: https://devencelab.com/insights/2026/09/10/cvss-ten-in-an-agent-framework.md
- Published: September 10, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: CVE-2026-79696 landed a maximum-severity score against Google Cloud's Agent Development Kit for Python. The scoring system was built for software that does what it is told, and that assumption no longer holds.

### Inference efficiency stopped being a cost line and became a capacity strategy
- URL: https://devencelab.com/insights/2026/09/09/efficiency-is-now-a-capacity-strategy
- Markdown: https://devencelab.com/insights/2026/09/09/efficiency-is-now-a-capacity-strategy.md
- Published: September 9, 2026 | Topic: GPU & Compute | 2 min read, 3 sources
- Summary: When power is the binding constraint, every watt saved per token is capacity you did not have to contract for. That reframes a set of engineering decisions most teams treat as optimisation.

### Prompt injection stopped being a content problem the moment it reached RCE
- URL: https://devencelab.com/insights/2026/09/09/prompt-injection-reaching-rce
- Markdown: https://devencelab.com/insights/2026/09/09/prompt-injection-reaching-rce.md
- Published: September 9, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Disclosed flaws in developer tooling chain injected HTML to a rewritten MCP configuration to arbitrary command execution, with no further user interaction. That chain changes the severity conversation.

### Guardrails that run on a CPU change where you can put them
- URL: https://devencelab.com/insights/2026/09/09/guardrails-without-a-gpu
- Markdown: https://devencelab.com/insights/2026/09/09/guardrails-without-a-gpu.md
- Published: September 9, 2026 | Topic: AI Security | 2 min read, 1 sources
- Summary: Lasso Security's LEAP claims transformer-free detection in under five milliseconds on ordinary CPUs. The accuracy claim matters less than the deployment topology it unlocks.

### Seventy percent of the grid is near end of life. AI arrived at the worst possible moment.
- URL: https://devencelab.com/insights/2026/09/08/aging-grid-meets-new-load
- Markdown: https://devencelab.com/insights/2026/09/08/aging-grid-meets-new-load.md
- Published: September 8, 2026 | Topic: GPU & Compute | 2 min read, 3 sources
- Summary: The infrastructure being asked to absorb unprecedented concentrated demand is simultaneously due for replacement. Those two facts interact badly, and the interaction lands on deployment timelines.

### The security question is not what your AI reads. It is what it can do.
- URL: https://devencelab.com/insights/2026/09/08/reading-to-acting-is-the-boundary
- Markdown: https://devencelab.com/insights/2026/09/08/reading-to-acting-is-the-boundary.md
- Published: September 8, 2026 | Topic: AI Security | 2 min read, 2 sources
- Summary: Microsoft frames the shift as tools moving from reading to acting. That line is the most useful dividing mark available for triaging an AI estate.

### When a thousand agents act as one, your identity model has already failed
- URL: https://devencelab.com/insights/2026/09/08/agent-swarms-and-the-identity-problem
- Markdown: https://devencelab.com/insights/2026/09/08/agent-swarms-and-the-identity-problem.md
- Published: September 8, 2026 | Topic: Agentic AI | 2 min read, 2 sources
- Summary: Reporting on large agent swarms operating undetected for weeks describes an authorisation architecture that assumes a principal is a person or a service. Neither describes what is actually making the requests.

### Release notes just became compliance artifacts
- URL: https://devencelab.com/insights/2026/09/07/release-notes-as-compliance-artifacts
- Markdown: https://devencelab.com/insights/2026/09/07/release-notes-as-compliance-artifacts.md
- Published: September 7, 2026 | Topic: Model Releases | 2 min read, 3 sources
- Summary: With AI Act enforcement live, the AI Office can request technical documentation, evaluate models and require corrective measures. What a lab publishes at launch now has a regulatory reader.

### Six MCP incidents, one pattern: the credential outlived the task
- URL: https://devencelab.com/insights/2026/09/07/six-incidents-one-pattern
- Markdown: https://devencelab.com/insights/2026/09/07/six-incidents-one-pattern.md
- Published: September 7, 2026 | Topic: AI Security | 2 min read, 3 sources
- Summary: Read the disclosed incidents together and the common factor is not a protocol flaw. It is standing access granted once and never scoped to the work it was granted for.

### A $25M deepfake loss is an authorisation failure wearing a detection costume
- URL: https://devencelab.com/insights/2026/09/07/deepfake-fraud-is-a-process-failure
- Markdown: https://devencelab.com/insights/2026/09/07/deepfake-fraud-is-a-process-failure.md
- Published: September 7, 2026 | Topic: Agentic AI | 2 min read, 1 sources
- Summary: The Arup case keeps being cited as evidence that synthetic media detection matters. The more useful reading is that a payment process depended on a human recognising a face, and that dependency was never written down as a control.

### Capability thresholds are becoming a disclosure norm. Deployers should read them as a handoff.
- URL: https://devencelab.com/insights/2026/09/06/capability-thresholds-as-a-norm
- Markdown: https://devencelab.com/insights/2026/09/06/capability-thresholds-as-a-norm.md
- Published: September 6, 2026 | Topic: Model Releases | 2 min read, 3 sources
- Summary: Labs now publish where they think a model crosses into dangerous capability. That disclosure is useful, and it moves responsibility onto whoever deploys past the line.

### When the control is a human reviewer, the human is the attack surface
- URL: https://devencelab.com/insights/2026/09/06/the-reviewer-is-the-attack-surface
- Markdown: https://devencelab.com/insights/2026/09/06/the-reviewer-is-the-attack-surface.md
- Published: September 6, 2026 | Topic: Agentic AI | 2 min read, 2 sources
- Summary: One disclosed incident involved fabricated identities used to manipulate a reviewer into approving agent actions. Human-in-the-loop is a real control, and it has a threat model nobody writes down.

### Rubin's real claim is a 10x cut in the cost of a token
- URL: https://devencelab.com/insights/2026/09/06/rubin-and-the-cost-of-a-token
- Markdown: https://devencelab.com/insights/2026/09/06/rubin-and-the-cost-of-a-token.md
- Published: September 6, 2026 | Topic: GPU & Compute | 3 min read, 2 sources
- Summary: NVIDIA's next platform is in full production with seven chips and five rack systems. Strip the launch numbers back and the figure that changes plans is inference economics, not training throughput.

### Your model's deprecation date is a risk you do not control
- URL: https://devencelab.com/insights/2026/09/05/deprecation-is-a-risk-you-own
- Markdown: https://devencelab.com/insights/2026/09/05/deprecation-is-a-risk-you-own.md
- Published: September 5, 2026 | Topic: Model Releases | 2 min read, 3 sources
- Summary: With releases arriving weekly, the version you qualified has a shelf life set by someone else's roadmap. Very few deployment plans account for that, and the regulated ones can least afford not to.

### A $5,000 query that every monitor approved
- URL: https://devencelab.com/insights/2026/09/05/agents-fail-while-returning-success
- Markdown: https://devencelab.com/insights/2026/09/05/agents-fail-while-returning-success.md
- Published: September 5, 2026 | Topic: Agentic AI | 2 min read, 2 sources
- Summary: A single generated query ran up a five-figure bill without tripping a resource alert. Agent failures look like healthy systems, which is precisely why infrastructure monitoring does not see them.

### Positron raised $875M on a bet that memory bandwidth is the wrong constraint
- URL: https://devencelab.com/insights/2026/09/05/skipping-hbm-is-a-bet-on-workload-shape
- Markdown: https://devencelab.com/insights/2026/09/05/skipping-hbm-is-a-bet-on-workload-shape.md
- Published: September 5, 2026 | Topic: GPU & Compute | 2 min read, 2 sources
- Summary: The Asimov chip drops high-bandwidth memory for up to 2.3TB of LPDDR5X per die. That is not a cost optimisation. It is a claim about which workloads are going to matter.

### Gartner's other warning: one governance policy across all agents causes the failure
- URL: https://devencelab.com/insights/2026/09/04/uniform-governance-breaks-agents
- Markdown: https://devencelab.com/insights/2026/09/04/uniform-governance-breaks-agents.md
- Published: September 4, 2026 | Topic: Agentic AI | 2 min read, 2 sources
- Summary: The advice to govern agents uniformly sounds prudent and produces the opposite of safety. The reason is that an agent's risk is set by its authority, and authority is not uniform.

### Confidential computing reached the GPU. Regulated AI workloads just got a new answer.
- URL: https://devencelab.com/insights/2026/09/04/confidential-computing-reaches-the-gpu
- Markdown: https://devencelab.com/insights/2026/09/04/confidential-computing-reaches-the-gpu.md
- Published: September 4, 2026 | Topic: GPU & Compute | 2 min read, 1 sources
- Summary: Hardware-backed isolation is extending from CPUs into GPUs, multi-GPU environments and agent workflows. For sectors that could not put data near a shared accelerator, the deployment question changes.

### Early protocol decisions become systemic risk, and MCP is the current case study
- URL: https://devencelab.com/insights/2026/09/03/protocol-decisions-become-systemic-risk
- Markdown: https://devencelab.com/insights/2026/09/03/protocol-decisions-become-systemic-risk.md
- Published: September 3, 2026 | Topic: Agentic AI | 2 min read, 3 sources
- Summary: A command injection issue traced to design choices made early in MCP's life propagated across the ecosystem. The lesson generalises well beyond one protocol.

### A model scored 100% on ExploitBench. That tells you about the benchmark.
- URL: https://devencelab.com/insights/2026/09/03/exploitbench-hundred-percent
- Markdown: https://devencelab.com/insights/2026/09/03/exploitbench-hundred-percent.md
- Published: September 3, 2026 | Topic: Model Releases | 2 min read, 1 sources
- Summary: OpenAI's Astra reportedly saturates an offensive security benchmark while declining 91.5% of jailbreak attempts. Both numbers are less informative than they look, and the second is the one to worry about.

### GPT-6, Grok 4.7 and Gemini 3.8 shipped inside ten days. Your qualification cycle did not.
- URL: https://devencelab.com/insights/2026/09/02/release-cadence-outruns-assurance
- Markdown: https://devencelab.com/insights/2026/09/02/release-cadence-outruns-assurance.md
- Published: September 2, 2026 | Topic: Model Releases | 2 min read, 3 sources
- Summary: Frontier releases are now arriving faster than any serious evaluation process can absorb them. The organisations that cope will be the ones that stop qualifying models and start qualifying the system around them.

### The first cyber-defence model shipped as a product, not a research artefact
- URL: https://devencelab.com/insights/2026/09/01/a-cyber-model-as-a-first-class-product
- Markdown: https://devencelab.com/insights/2026/09/01/a-cyber-model-as-a-first-class-product.md
- Published: September 1, 2026 | Topic: Model Releases | 2 min read, 1 sources
- Summary: Gemini 3.8 Flash Cyber is reported to outperform substantially larger general models at autonomous vulnerability discovery. The specialisation is the news, and it points at where the next wave of models goes.