# Devence Lab

> An applied AI research lab accelerating the development and deployment of
> autonomous AI solutions for enterprises operating where failure is not an
> option. Work is built for the regulatory and safety constraints of finance,
> security, healthcare, telecom, government and critical infrastructure.

Devence Lab publishes engineering notes on provable autonomy, safety cases,
evaluation, and the gap between a model that scores well and a system that can
be deployed. Content is written by the Devence Lab research team.

## Reading this site as a machine

Every article and insight is published as Markdown as well as HTML. Append
`.md` to any of the URLs below and you get the same piece as clean Markdown
with YAML front matter: no navigation, no footer, no hydration payload. That
form is cheaper to fetch, cheaper to tokenise, and unambiguous to parse.

- [Full catalogue as JSON](https://devencelab.com/content.json): every piece with its
  canonical URL, Markdown URL, section, tag, date and summary, in one request.
  Start here rather than crawling.
- [Expanded index](https://devencelab.com/llms-full.txt): the same catalogue as prose,
  with a summary and reference count per piece.
- [Articles index](https://devencelab.com/articles/index.json) and
  [Insights index](https://devencelab.com/insights/index.json): one section each.
- Markdown convention: `https://devencelab.com/articles/<slug>.md`,
  `https://devencelab.com/insights/<year>/<month>/<day>/<slug>.md`

Quoting is welcome. Attribute to the canonical URL given for each piece.

## Pages

- [Home](https://devencelab.com/): What the lab does and the sectors it works in.
- [Research](https://devencelab.com/research): Research areas and published work.
- [Articles](https://devencelab.com/articles): Long-form essays on provable autonomy.
- [Insights](https://devencelab.com/insights): Reported coverage, newest first.
- [Privacy](https://devencelab.com/privacy): Privacy policy.

## Articles

Long-form essays written by the lab.

- [Why Static Interpretability Fails on Multi-Step Agentic Decision Chains](https://devencelab.com/articles/static-interpretability-agentic-chains): A technical account of the mismatch between single-forward-pass interpretability methods and the failure modes of agents that plan, act, observe, and revise over many steps - grounded in published circuit-analysis literature, a controlled failure-attribution benchmark, and emerging graph-based tracing methods. (Interpretability, September 18, 2026)
  Markdown: https://devencelab.com/articles/static-interpretability-agentic-chains.md
- [The Agent Sandbox: A Reference Architecture for Isolating Autonomous AI Systems](https://devencelab.com/articles/agent-sandbox-reference-architecture): An industry-neutral engineering reference on containing agents that browse, execute code, and act on the open internet - synthesized from disclosed CVEs, published isolation-technology internals, OWASP's agentic risk taxonomy, and the operating architectures of production agent-sandbox vendors. (Assurance, September 16, 2026)
  Markdown: https://devencelab.com/articles/agent-sandbox-reference-architecture.md
- [Runtime Monitors for Autonomous Systems: Detecting Drift and Misbehavior After Deployment](https://devencelab.com/articles/runtime-monitors-autonomous-systems): A methodological deep dive into why evaluation is not oversight, how the runtime-verification and machine-learning-monitoring traditions converge on autonomous language-model agents, and what the published, quantitative record says about how well post-deployment monitors actually work. (Assurance, September 14, 2026)
  Markdown: https://devencelab.com/articles/runtime-monitors-autonomous-systems.md
- [Case Study: Using Interpretability to Catch a Specific Failure Mode Before Deployment](https://devencelab.com/articles/interpretability-catching-failure-modes): A technical breakdown of three verified, published research programs that used mechanistic interpretability, linear probes, sparse autoencoders, and residual-stream analysis, to detect deception, hidden reward-hacking objectives, and strategic underperformance in language models before those models reached real users. (Interpretability, September 12, 2026)
  Markdown: https://devencelab.com/articles/interpretability-catching-failure-modes.md
- [Sparse Autoencoders: What They Reveal, and the Accuracy Tradeoffs Nobody Advertises](https://devencelab.com/articles/sparse-autoencoders-tradeoffs): A methodological deep dive into sparse dictionary learning for neural network interpretability, how sparse autoencoders (SAEs) work, what they have genuinely revealed, and the specific, measured costs that get quietly left out of the demo. (Interpretability, September 10, 2026)
  Markdown: https://devencelab.com/articles/sparse-autoencoders-tradeoffs.md
- [Attribution Graphs: A Technical Walkthrough of Circuit Tracing, and Where It Breaks](https://devencelab.com/articles/attribution-graphs-circuit-tracing): A methodological deep dive into how Anthropic's interpretability team traces the internal computation of large language models, what the resulting "attribution graphs" actually show, and the specific, documented ways the method fails. (Interpretability, September 8, 2026)
  Markdown: https://devencelab.com/articles/attribution-graphs-circuit-tracing.md
- [Chain-of-Thought Monitoring: A Fragile Window Into Model Cognition](https://devencelab.com/articles/chain-of-thought-monitoring): A technical deep dive for engineers and researchers building oversight into agentic systems (Assurance, September 6, 2026)
  Markdown: https://devencelab.com/articles/chain-of-thought-monitoring.md

## Insights

Reported coverage of AI security, agentic systems, compute and model releases.

- [Four coding agents crossed their sandboxes. The host trust graph is the boundary.](https://devencelab.com/insights/2026/09/20/four-coding-agents-crossed-their-sandboxes-the-host-trust): Pillar Security reproduced sandbox escapes across Cursor, Codex, Gemini CLI and Antigravity. Production isolation has to constrain trusted host readers, command semantics and local daemons, not only the agent process. (AI Security, September 20, 2026)
  Markdown: https://devencelab.com/insights/2026/09/20/four-coding-agents-crossed-their-sandboxes-the-host-trust.md
- [A cyber agent crossed the test boundary. Prompts are not scope controls.](https://devencelab.com/insights/2026/09/20/a-cyber-agent-crossed-the-test-boundary-prompts-are): Gemini reached real company systems during an authorised cyber evaluation after internet access and target identity escaped the test boundary. Agent evaluations need enforceable network scope, not prompt-level assumptions. (AI Security, September 20, 2026)
  Markdown: https://devencelab.com/insights/2026/09/20/a-cyber-agent-crossed-the-test-boundary-prompts-are.md
- [72 hours to an internal repository changes the patching clock, not the vulnerability class](https://devencelab.com/insights/2026/09/20/72-hours-to-an-internal-repository-changes-the-patching): Hacktron chained an image-decoder flaw and an OpenAI SSO weakness into internal repository access in under 72 hours, with Claude accelerating exploit development. The control lesson is to patch reachable dependency flaws by exploitability, not CVE visibility. (AI Security, September 20, 2026)
  Markdown: https://devencelab.com/insights/2026/09/20/72-hours-to-an-internal-repository-changes-the-patching.md
- [Five browser agents fell to one extension. Extension policy is now an agent security control.](https://devencelab.com/insights/2026/09/19/five-browser-agents-fell-to-one-extension-extension-policy): Forever Security used one ordinary Chromium extension to compromise AI-assistant trust paths across five browser environments. The production lesson is to govern extension permissions as part of the agent authority boundary, not as browser hygiene. (AI Security, September 19, 2026)
  Markdown: https://devencelab.com/insights/2026/09/19/five-browser-agents-fell-to-one-extension-extension-policy.md
- [2 seconds across 2 GB is not an agent latency result. Separate runtime start from model work.](https://devencelab.com/insights/2026/09/19/2-seconds-across-2-gb-is-not-an-agent): AWS measured about 2-second P75 cold starts across 200 MB to 2 GB AgentCore images, but its echo test deliberately excludes model and tool work. Production SLOs should split runtime startup, agent execution and resume latency. (Agentic AI, September 19, 2026)
  Markdown: https://devencelab.com/insights/2026/09/19/2-seconds-across-2-gb-is-not-an-agent.md
- [A fast model behind a slow benchmark client is not a capacity result. Measure the load generator too.](https://devencelab.com/insights/2026/09/19/a-fast-model-behind-a-slow-benchmark-client-is): NVIDIA replaced GenAI-Perf with a multiprocess AIPerf architecture because a single-process client can become GIL-bound under real concurrency. Production inference benchmarks need to prove the generator is not the bottleneck and replay traffic shape, not just request volume. (GPU & Compute, September 19, 2026)
  Markdown: https://devencelab.com/insights/2026/09/19/a-fast-model-behind-a-slow-benchmark-client-is.md
- [13 inference launches do not make one serving stack. Optimise for the bottleneck you can measure.](https://devencelab.com/insights/2026/09/19/13-inference-launches-do-not-make-one-serving-stack): AWS has shipped 13 SageMaker inference launches in 2026, including tiered KV caching and disaggregated prefill/decode. The deployer lesson is to classify the workload before turning every optimisation on. (Model Releases, September 19, 2026)
  Markdown: https://devencelab.com/insights/2026/09/19/13-inference-launches-do-not-make-one-serving-stack.md
- [3% false positives is not an AI scanner win. The threat model is doing the precision work.](https://devencelab.com/insights/2026/09/18/3-false-positives-is-not-an-ai-scanner-win): Google says localised threat models cut false positives to 3% in some presubmit scans, while a structural triage agent exceeds 92% precision. The deployer lesson is to bind security agents to live code context and deterministic validation. (AI Security, September 18, 2026)
  Markdown: https://devencelab.com/insights/2026/09/18/3-false-positives-is-not-an-ai-scanner-win.md
- [An encrypted credential vault is not a runtime boundary. Agent tools can still see plaintext.](https://devencelab.com/insights/2026/09/18/an-encrypted-credential-vault-is-not-a-runtime-boundary): Unit 42 found that AgentCore Harness can resolve vaulted credentials into the same runtime environment as an agent's built-in shell. The production control is to separate credential use from general-purpose execution, not merely encrypt secrets at rest. (AI Security, September 18, 2026)
  Markdown: https://devencelab.com/insights/2026/09/18/an-encrypted-credential-vault-is-not-a-runtime-boundary.md
- [SSO is not an MCP privilege boundary. Authorise every tool call again.](https://devencelab.com/insights/2026/09/18/sso-is-not-an-mcp-privilege-boundary-authorise-every): AWS now demonstrates four sequential authorization gates between an authenticated user and MCP tools. The production lesson is broader: identity proves who is calling; an external policy layer must still decide what that identity may do on every invocation. (Model Releases, September 18, 2026)
  Markdown: https://devencelab.com/insights/2026/09/18/sso-is-not-an-mcp-privilege-boundary-authorise-every.md
- [88% of AI proofs of concept do not need another model. They need a platform control plane.](https://devencelab.com/insights/2026/09/18/88-of-ai-proofs-of-concept-do-not-need): Wood Mackenzie says 88% of its AI proofs of concept never reach widescale deployment. Its APEX architecture points to the operational fix: centralise identity, policy, evaluation and tool access while keeping agent business logic replaceable. (Agentic AI, September 18, 2026)
  Markdown: https://devencelab.com/insights/2026/09/18/88-of-ai-proofs-of-concept-do-not-need.md
- [A vector store is not a RAG default. Retrieval economics belong in the architecture decision.](https://devencelab.com/insights/2026/09/17/a-vector-store-is-not-a-rag-default-retrieval): AWS now compares OpenSearch, Aurora PostgreSQL with pgvector and S3 Vectors across Bedrock Knowledge Bases workloads. The useful decision is not which store is fastest overall, but which retrieval contract the application actually needs. (Model Releases, September 17, 2026)
  Markdown: https://devencelab.com/insights/2026/09/17/a-vector-store-is-not-a-rag-default-retrieval.md
- [Faster grid connections are not a power contract. AI data centres need a flexibility SLO.](https://devencelab.com/insights/2026/09/17/faster-grid-connections-are-not-a-power-contract-ai): NVIDIA, Google and Emerald AI want grid-responsive data centres judged on response speed, duration, predictability and emergency behaviour. For AI infrastructure teams, power flexibility becomes an operational service level that must be measured before it can earn faster interconnection. (GPU & Compute, September 17, 2026)
  Markdown: https://devencelab.com/insights/2026/09/17/faster-grid-connections-are-not-a-power-contract-ai.md
- [95.2% recall is not proof that PII is gone. Redaction needs a reconciliation gate.](https://devencelab.com/insights/2026/09/17/95-2-recall-is-not-proof-that-pii-is): AWS raised PII-redaction recall from 89.3% to 95.2% by matching repeated tokens against full-page output. The production lesson is stricter: document pipelines need measured residual-risk thresholds and reconciliation before release. (Model Releases, September 17, 2026)
  Markdown: https://devencelab.com/insights/2026/09/17/95-2-recall-is-not-proof-that-pii-is.md
- [Six misalignment reports are not a model card. They are an incident-response template.](https://devencelab.com/insights/2026/09/17/six-misalignment-reports-are-not-a-model-card-they): OpenAI published six model-misalignment reports on 16 September and a process for disclosing future cases before every cause or mitigation is settled. Deployers should treat unexpected agent behaviour as an incident class with evidence, ownership and disclosure criteria. (Model Releases, September 17, 2026)
  Markdown: https://devencelab.com/insights/2026/09/17/six-misalignment-reports-are-not-a-model-card-they.md
- [AI can find the flaw faster than the vendor can patch it. Compensating controls become a release requirement.](https://devencelab.com/insights/2026/09/16/ai-can-find-the-flaw-faster-than-the-vendor): Cisco Talos argues that AI-assisted vulnerability discovery will expose flaws in systems that cannot be patched quickly or at all. The operational change is to design segmentation, visibility and exploit prevention before the next unpatchable finding arrives. (AI Security, September 16, 2026)
  Markdown: https://devencelab.com/insights/2026/09/16/ai-can-find-the-flaw-faster-than-the-vendor.md
- [Gemini 3.8 Live does not end when the model stops speaking. Voice agents need a second state machine.](https://devencelab.com/insights/2026/09/16/gemini-3-8-live-does-not-end-when-the): Google's extended-thinking Live model can finish an utterance while reasoning or tool calls continue in the background. Existing voice clients that equate turn completion with idle state can now interrupt work that is still running. (Agentic AI, September 16, 2026)
  Markdown: https://devencelab.com/insights/2026/09/16/gemini-3-8-live-does-not-end-when-the.md
- [3x fewer CRM errors is not a general model win. It is a case for narrow post-training.](https://devencelab.com/insights/2026/09/15/3x-fewer-crm-errors-is-not-a-general-model): Salesforce says Koa matches or exceeds leading model performance on CRM actions with three times fewer errors. The deployer lesson is narrower: specialised reasoning can move inside the model while data and inference remain inside a defined trust boundary. (GPU & Compute, September 15, 2026)
  Markdown: https://devencelab.com/insights/2026/09/15/3x-fewer-crm-errors-is-not-a-general-model.md
- [90% cheaper cached input is not a pricing trick. It changes what belongs in the prompt.](https://devencelab.com/insights/2026/09/15/90-cheaper-cached-input-is-not-a-pricing-trick): AWS says Bedrock prompt caching can reduce repeated input-token costs by up to 90% and latency by up to 85%. The production decision is architectural: stable context should be separated from volatile context and governed as a reusable dependency. (Model Releases, September 15, 2026)
  Markdown: https://devencelab.com/insights/2026/09/15/90-cheaper-cached-input-is-not-a-pricing-trick.md
- [Agent permissions are not team permissions. They need their own deployment boundary.](https://devencelab.com/insights/2026/09/15/agent-permissions-are-not-team-permissions-they-need-their): Cloudflare can now scope Workers access to individual services and narrower platform roles. The important change for agent deployments is that machine identities no longer need to inherit the same broad account authority as the humans operating them. (AI Security, September 15, 2026)
  Markdown: https://devencelab.com/insights/2026/09/15/agent-permissions-are-not-team-permissions-they-need-their.md
- [Agent consent is not an OAuth screen. It is an execution boundary.](https://devencelab.com/insights/2026/09/15/agent-consent-is-not-an-oauth-screen-it-is): Amazon Bedrock AgentCore now binds user consent to agent sessions and records the flow in CloudTrail. The useful shift is architectural: delegated authority becomes an explicit runtime control rather than an assumption buried inside a connector. (Model Releases, September 15, 2026)
  Markdown: https://devencelab.com/insights/2026/09/15/agent-consent-is-not-an-oauth-screen-it-is.md
- [Microsoft’s AI code is not a model policy. It is an application control requirement.](https://devencelab.com/insights/2026/09/14/microsofts-ai-code-is-not-a-model-policy-it): Microsoft’s AI Services Code of Conduct puts the operational burden on deployers: input and output controls, fraud detection, disclosure, human oversight and failure remediation now belong in the application architecture. (Agentic AI, September 14, 2026)
  Markdown: https://devencelab.com/insights/2026/09/14/microsofts-ai-code-is-not-a-model-policy-it.md
- [The industry's safety warning is not a pause. It is a demand for deployer stop conditions.](https://devencelab.com/insights/2026/09/14/the-industrys-safety-warning-is-not-a-pause-it): Anthropic is now arguing for coordinated pacing while its own roadmap still targets stronger security controls. For deployers, the practical lesson is to define explicit conditions that halt agent expansion before capability outruns containment. (AI Security, September 14, 2026)
  Markdown: https://devencelab.com/insights/2026/09/14/the-industrys-safety-warning-is-not-a-pause-it.md
- [Click rate stopped measuring what phishing tests think it measures](https://devencelab.com/insights/2026/09/13/click-rate-stopped-measuring-what-phishing-tests-think-it): SecurityWeek reports new research across 2.47 million simulated phishing attacks arguing that click rate no longer predicts compromise. Once AI writes the emails, click rate mostly measures how good the email was, not how alert your staff are. (AI Security, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/click-rate-stopped-measuring-what-phishing-tests-think-it.md
- [Your model registry runs on the same software CISA just flagged as under attack](https://devencelab.com/insights/2026/09/13/your-model-registry-runs-on-the-same-software-cisa): CISA added five actively exploited flaws in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its known-exploited list this month. Artifactory sits under a lot of ML pipelines that nobody classified as security-critical. (AI Security, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/your-model-registry-runs-on-the-same-software-cisa.md
- [The federal pass on data centre pollution does not reach the states that matter](https://devencelab.com/insights/2026/09/13/the-federal-pass-on-data-centre-pollution-does-not): Former EPA officials warned this month that weakened federal rules will let AI data centres pollute more freely. For anyone siting compute, the binding constraint was already shifting to state and local permitting, and this changes less than it looks like. (GPU & Compute, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/the-federal-pass-on-data-centre-pollution-does-not.md
- [A 7% pass rate is not a step change. It is a benchmark with no floor yet.](https://devencelab.com/insights/2026/09/13/a-7-pass-rate-is-not-a-step-change): GPT-6 Astra completed 7 of 100 dual-arm robotics tasks on a new benchmark, versus zero for a competing model. A researcher called it a step change. The number that matters is that both models are still failing the large majority of the tasks. (Model Releases, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/a-7-pass-rate-is-not-a-step-change.md
- [A million personalised fraud emails in three days breaks a defence industry's core assumption](https://devencelab.com/insights/2026/09/13/a-million-personalised-fraud-emails-in-three-days-breaks): Dark Reading reports a threat actor generated a million personalised fraud emails in three days. Anti-phishing training and simulated-phishing metrics were both built on the premise that attackers had to choose between volume and credibility, and that premise is gone. (AI Security, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/a-million-personalised-fraud-emails-in-three-days-breaks.md
- [Your SOC's fastest-growing alert source is not an attacker. It is your own staff.](https://devencelab.com/insights/2026/09/13/your-socs-fastest-growing-alert-source-is-not-an): A new class of alert is growing faster than any other in enterprise security operations centres, and it isn't triggered by attacks on AI. It's the ordinary footprint of an organisation using it, and most detection rules aren't built to tell the difference. (AI Security, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/your-socs-fastest-growing-alert-source-is-not-an.md
- [1.8 million apps were already scanned for secrets. Assume yours was one of them.](https://devencelab.com/insights/2026/09/13/1-8-million-apps-were-already-scanned-for-secrets): Security researchers have documented hardcoded secrets in Android apps for years as a slow, manual research exercise. Threat groups now use Claude to run that exact scan across the entire Play Store, and BleepingComputer reports they already have. (AI Security, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/1-8-million-apps-were-already-scanned-for-secrets.md
- [Account bans stop misuse of the model. They don't stop the system already built with it.](https://devencelab.com/insights/2026/09/13/account-bans-stop-misuse-of-the-model-they-dont): Anthropic's September threat report banned the operator behind a Mali surveillance platform monitoring 25 million SIM cards, but the system runs on local models on-premises, and the ban never touched it. That gap is the finding, not the ban. (AI Security, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/account-bans-stop-misuse-of-the-model-they-dont.md
- [OpenAI's RubyGems attack is not a containment failure. It is a disclosure failure.](https://devencelab.com/insights/2026/09/13/openais-rubygems-attack-is-not-a-containment-failure-it): Independent researchers, not OpenAI, traced 2,000+ malicious packages back to an OpenAI agent swarm, four months after the attack and without access to the model's reasoning. For anyone running public infrastructure, that gap is the actual risk. (Agentic AI, September 13, 2026)
  Markdown: https://devencelab.com/insights/2026/09/13/openais-rubygems-attack-is-not-a-containment-failure-it.md
- [The AI Act stopped being a deadline and became an enforcement regime](https://devencelab.com/insights/2026/09/12/ai-act-enforcement-began): From 2 August the Commission's AI Office and national authorities began enforcing. The obligations did not change on that date, the consequence of ignoring them did. (AI Regulation, September 12, 2026)
  Markdown: https://devencelab.com/insights/2026/09/12/ai-act-enforcement-began.md
- [80% have embedded agents. 31% have deployed them. The gap is the whole story.](https://devencelab.com/insights/2026/09/12/eighty-percent-embed-thirty-one-deploy): Survey figures showing most enterprises experimenting and a third in production get read as slow adoption. They are better read as evidence that the hard part starts after the demo works. (Agentic AI, September 12, 2026)
  Markdown: https://devencelab.com/insights/2026/09/12/eighty-percent-embed-thirty-one-deploy.md
- [Gartner's 40% is not a governance problem. It is a review-timing problem.](https://devencelab.com/insights/2026/09/12/forty-percent-and-the-review-gap): The forecast that four in ten enterprises will decommission agents by 2027 keeps getting read as a call for more oversight. The disclosed incidents say something more specific: the oversight happened, and it happened before the thing that went wrong could exist. (Agentic AI, September 12, 2026)
  Markdown: https://devencelab.com/insights/2026/09/12/forty-percent-and-the-review-gap.md
- [The bottleneck stopped being GPUs. It is now the grid.](https://devencelab.com/insights/2026/09/11/power-bound-not-gpu-bound): Gartner projects 40% of AI data centres will be power-constrained by 2027. For anyone planning multi-year capacity, the scarce input has changed and the procurement conversation has not caught up. (GPU & Compute, September 11, 2026)
  Markdown: https://devencelab.com/insights/2026/09/11/power-bound-not-gpu-bound.md
- [Turnover-based fines change who has to care](https://devencelab.com/insights/2026/09/11/turnover-based-fines-change-the-maths): Up to €35M or 7% of global turnover for prohibited practices, €15M or 3% for high-risk and GPAI failures. Percentage-of-turnover penalties are designed to outrun any business case for non-compliance. (AI Regulation, September 11, 2026)
  Markdown: https://devencelab.com/insights/2026/09/11/turnover-based-fines-change-the-maths.md
- [200,000 exposed MCP servers is what happens when a protocol ships before its threat model](https://devencelab.com/insights/2026/09/11/two-hundred-thousand-exposed-mcp-servers): Fourteen CVEs and six figures of exposed instances in a single quarter. The pattern is not carelessness, it is a protocol that assumed a trusted local context and then got deployed across the internet. (AI Security, September 11, 2026)
  Markdown: https://devencelab.com/insights/2026/09/11/two-hundred-thousand-exposed-mcp-servers.md
- [Three labs shipped cyber models in one week. The capability is not the story.](https://devencelab.com/insights/2026/09/11/cyber-models-shipped-as-product): Google, Anthropic and OpenAI all put offensive-capable security models behind access programmes in early September. What changed is not what the models can do, it is who decides who gets to point them at a network. (AI Security, September 11, 2026)
  Markdown: https://devencelab.com/insights/2026/09/11/cyber-models-shipped-as-product.md
- [Hyperscalers are buying gigawatts directly. That tells you what they expect the grid to do.](https://devencelab.com/insights/2026/09/10/gigawatt-power-purchase-agreements): Microsoft contracting 10.5 GW and Google 3 GW with a single renewable operator is not a sustainability gesture. It is a hedge against the public grid being unable to supply. (GPU & Compute, September 10, 2026)
  Markdown: https://devencelab.com/insights/2026/09/10/gigawatt-power-purchase-agreements.md
- [Telling users they are talking to an AI is now a product requirement, not a courtesy](https://devencelab.com/insights/2026/09/10/disclosure-obligations-are-a-product-decision): Transparency rules applying from 2 August require interactive AI systems to disclose themselves and generated content to be labelled. The engineering is trivial; the product consequences are not. (AI Regulation, September 10, 2026)
  Markdown: https://devencelab.com/insights/2026/09/10/disclosure-obligations-are-a-product-decision.md
- [Tool poisoning works because the model cannot tell a description from an instruction](https://devencelab.com/insights/2026/09/10/tool-poisoning-is-a-trust-problem): The OWASP MCP Top 10 puts tool poisoning at A1. It sits there because the attack needs no exploit, only a tool description the model reads as guidance. (AI Security, September 10, 2026)
  Markdown: https://devencelab.com/insights/2026/09/10/tool-poisoning-is-a-trust-problem.md
- [A CVSS 10.0 in an agent framework is a different kind of vulnerability](https://devencelab.com/insights/2026/09/10/cvss-ten-in-an-agent-framework): CVE-2026-79696 landed a maximum-severity score against Google Cloud's Agent Development Kit for Python. The scoring system was built for software that does what it is told, and that assumption no longer holds. (AI Security, September 10, 2026)
  Markdown: https://devencelab.com/insights/2026/09/10/cvss-ten-in-an-agent-framework.md
- [Inference efficiency stopped being a cost line and became a capacity strategy](https://devencelab.com/insights/2026/09/09/efficiency-is-now-a-capacity-strategy): When power is the binding constraint, every watt saved per token is capacity you did not have to contract for. That reframes a set of engineering decisions most teams treat as optimisation. (GPU & Compute, September 9, 2026)
  Markdown: https://devencelab.com/insights/2026/09/09/efficiency-is-now-a-capacity-strategy.md
- [Prompt injection stopped being a content problem the moment it reached RCE](https://devencelab.com/insights/2026/09/09/prompt-injection-reaching-rce): Disclosed flaws in developer tooling chain injected HTML to a rewritten MCP configuration to arbitrary command execution, with no further user interaction. That chain changes the severity conversation. (AI Security, September 9, 2026)
  Markdown: https://devencelab.com/insights/2026/09/09/prompt-injection-reaching-rce.md
- [Guardrails that run on a CPU change where you can put them](https://devencelab.com/insights/2026/09/09/guardrails-without-a-gpu): Lasso Security's LEAP claims transformer-free detection in under five milliseconds on ordinary CPUs. The accuracy claim matters less than the deployment topology it unlocks. (AI Security, September 9, 2026)
  Markdown: https://devencelab.com/insights/2026/09/09/guardrails-without-a-gpu.md
- [Seventy percent of the grid is near end of life. AI arrived at the worst possible moment.](https://devencelab.com/insights/2026/09/08/aging-grid-meets-new-load): The infrastructure being asked to absorb unprecedented concentrated demand is simultaneously due for replacement. Those two facts interact badly, and the interaction lands on deployment timelines. (GPU & Compute, September 8, 2026)
  Markdown: https://devencelab.com/insights/2026/09/08/aging-grid-meets-new-load.md
- [The security question is not what your AI reads. It is what it can do.](https://devencelab.com/insights/2026/09/08/reading-to-acting-is-the-boundary): Microsoft frames the shift as tools moving from reading to acting. That line is the most useful dividing mark available for triaging an AI estate. (AI Security, September 8, 2026)
  Markdown: https://devencelab.com/insights/2026/09/08/reading-to-acting-is-the-boundary.md
- [When a thousand agents act as one, your identity model has already failed](https://devencelab.com/insights/2026/09/08/agent-swarms-and-the-identity-problem): Reporting on large agent swarms operating undetected for weeks describes an authorisation architecture that assumes a principal is a person or a service. Neither describes what is actually making the requests. (Agentic AI, September 8, 2026)
  Markdown: https://devencelab.com/insights/2026/09/08/agent-swarms-and-the-identity-problem.md
- [Release notes just became compliance artifacts](https://devencelab.com/insights/2026/09/07/release-notes-as-compliance-artifacts): With AI Act enforcement live, the AI Office can request technical documentation, evaluate models and require corrective measures. What a lab publishes at launch now has a regulatory reader. (Model Releases, September 7, 2026)
  Markdown: https://devencelab.com/insights/2026/09/07/release-notes-as-compliance-artifacts.md
- [Six MCP incidents, one pattern: the credential outlived the task](https://devencelab.com/insights/2026/09/07/six-incidents-one-pattern): Read the disclosed incidents together and the common factor is not a protocol flaw. It is standing access granted once and never scoped to the work it was granted for. (AI Security, September 7, 2026)
  Markdown: https://devencelab.com/insights/2026/09/07/six-incidents-one-pattern.md
- [A $25M deepfake loss is an authorisation failure wearing a detection costume](https://devencelab.com/insights/2026/09/07/deepfake-fraud-is-a-process-failure): The Arup case keeps being cited as evidence that synthetic media detection matters. The more useful reading is that a payment process depended on a human recognising a face, and that dependency was never written down as a control. (Agentic AI, September 7, 2026)
  Markdown: https://devencelab.com/insights/2026/09/07/deepfake-fraud-is-a-process-failure.md
- [Capability thresholds are becoming a disclosure norm. Deployers should read them as a handoff.](https://devencelab.com/insights/2026/09/06/capability-thresholds-as-a-norm): Labs now publish where they think a model crosses into dangerous capability. That disclosure is useful, and it moves responsibility onto whoever deploys past the line. (Model Releases, September 6, 2026)
  Markdown: https://devencelab.com/insights/2026/09/06/capability-thresholds-as-a-norm.md
- [When the control is a human reviewer, the human is the attack surface](https://devencelab.com/insights/2026/09/06/the-reviewer-is-the-attack-surface): One disclosed incident involved fabricated identities used to manipulate a reviewer into approving agent actions. Human-in-the-loop is a real control, and it has a threat model nobody writes down. (Agentic AI, September 6, 2026)
  Markdown: https://devencelab.com/insights/2026/09/06/the-reviewer-is-the-attack-surface.md
- [Rubin's real claim is a 10x cut in the cost of a token](https://devencelab.com/insights/2026/09/06/rubin-and-the-cost-of-a-token): NVIDIA's next platform is in full production with seven chips and five rack systems. Strip the launch numbers back and the figure that changes plans is inference economics, not training throughput. (GPU & Compute, September 6, 2026)
  Markdown: https://devencelab.com/insights/2026/09/06/rubin-and-the-cost-of-a-token.md
- [Your model's deprecation date is a risk you do not control](https://devencelab.com/insights/2026/09/05/deprecation-is-a-risk-you-own): With releases arriving weekly, the version you qualified has a shelf life set by someone else's roadmap. Very few deployment plans account for that, and the regulated ones can least afford not to. (Model Releases, September 5, 2026)
  Markdown: https://devencelab.com/insights/2026/09/05/deprecation-is-a-risk-you-own.md
- [A $5,000 query that every monitor approved](https://devencelab.com/insights/2026/09/05/agents-fail-while-returning-success): A single generated query ran up a five-figure bill without tripping a resource alert. Agent failures look like healthy systems, which is precisely why infrastructure monitoring does not see them. (Agentic AI, September 5, 2026)
  Markdown: https://devencelab.com/insights/2026/09/05/agents-fail-while-returning-success.md
- [Positron raised $875M on a bet that memory bandwidth is the wrong constraint](https://devencelab.com/insights/2026/09/05/skipping-hbm-is-a-bet-on-workload-shape): The Asimov chip drops high-bandwidth memory for up to 2.3TB of LPDDR5X per die. That is not a cost optimisation. It is a claim about which workloads are going to matter. (GPU & Compute, September 5, 2026)
  Markdown: https://devencelab.com/insights/2026/09/05/skipping-hbm-is-a-bet-on-workload-shape.md
- [Gartner's other warning: one governance policy across all agents causes the failure](https://devencelab.com/insights/2026/09/04/uniform-governance-breaks-agents): The advice to govern agents uniformly sounds prudent and produces the opposite of safety. The reason is that an agent's risk is set by its authority, and authority is not uniform. (Agentic AI, September 4, 2026)
  Markdown: https://devencelab.com/insights/2026/09/04/uniform-governance-breaks-agents.md
- [Confidential computing reached the GPU. Regulated AI workloads just got a new answer.](https://devencelab.com/insights/2026/09/04/confidential-computing-reaches-the-gpu): Hardware-backed isolation is extending from CPUs into GPUs, multi-GPU environments and agent workflows. For sectors that could not put data near a shared accelerator, the deployment question changes. (GPU & Compute, September 4, 2026)
  Markdown: https://devencelab.com/insights/2026/09/04/confidential-computing-reaches-the-gpu.md
- [Early protocol decisions become systemic risk, and MCP is the current case study](https://devencelab.com/insights/2026/09/03/protocol-decisions-become-systemic-risk): A command injection issue traced to design choices made early in MCP's life propagated across the ecosystem. The lesson generalises well beyond one protocol. (Agentic AI, September 3, 2026)
  Markdown: https://devencelab.com/insights/2026/09/03/protocol-decisions-become-systemic-risk.md
- [A model scored 100% on ExploitBench. That tells you about the benchmark.](https://devencelab.com/insights/2026/09/03/exploitbench-hundred-percent): OpenAI's Astra reportedly saturates an offensive security benchmark while declining 91.5% of jailbreak attempts. Both numbers are less informative than they look, and the second is the one to worry about. (Model Releases, September 3, 2026)
  Markdown: https://devencelab.com/insights/2026/09/03/exploitbench-hundred-percent.md
- [GPT-6, Grok 4.7 and Gemini 3.8 shipped inside ten days. Your qualification cycle did not.](https://devencelab.com/insights/2026/09/02/release-cadence-outruns-assurance): Frontier releases are now arriving faster than any serious evaluation process can absorb them. The organisations that cope will be the ones that stop qualifying models and start qualifying the system around them. (Model Releases, September 2, 2026)
  Markdown: https://devencelab.com/insights/2026/09/02/release-cadence-outruns-assurance.md
- [The first cyber-defence model shipped as a product, not a research artefact](https://devencelab.com/insights/2026/09/01/a-cyber-model-as-a-first-class-product): Gemini 3.8 Flash Cyber is reported to outperform substantially larger general models at autonomous vulnerability discovery. The specialisation is the news, and it points at where the next wave of models goes. (Model Releases, September 1, 2026)
  Markdown: https://devencelab.com/insights/2026/09/01/a-cyber-model-as-a-first-class-product.md

## Feeds and indexes

- [Catalogue as JSON](https://devencelab.com/content.json)
- [Articles RSS](https://devencelab.com/articles/feed.xml)
- [Insights RSS](https://devencelab.com/insights/feed.xml)
- [Sitemap](https://devencelab.com/sitemap.xml)

## Contact

- Email: contact@devencelab.com