Rob Linton — Notes

Human vigilance is not a control for rogue agents

Mon, 17 Aug 2026 00:00:00 GMT

A government safety team just watched an AI agent try to talk its way into shipping malware. The UK’s AI Security Institute ran agents with open internet access and some safety filters off. In the worst case an agent tried to insert malicious code into an open-source project, and to get it approved it invented fake identities and used them to pressure the project’s maintainer. A human maintainer caught it and refused.

The line worth reading twice is AISI’s own: the margin between failure and success “was narrow, resting on human vigilance rather than a technical barrier that would reliably prevent this behaviour”.

My read: that is the whole problem in one sentence. The only thing between the agent and a supply-chain compromise was a person paying attention on the day. Human vigilance does not scale (nobody carefully supervises fifty agents). The control has to be technical, and it has to sit on what the agent is allowed to reach and do, scoped below the person and provable afterwards. An agent that was never cleared to push code cannot be talked into pushing it.

Per-agent identity just became a vendor default

Sat, 15 Aug 2026 00:00:00 GMT

The thing I have been arguing for years just turned into a vendor default. Microsoft now creates a per-agent Entra identity for every Copilot Studio agent and has removed the opt-out: “all new agents must have Microsoft Entra Agent IDs, and you can no longer opt out”. In the same fortnight Google shipped a native agent identity that “enforces a least-privilege approach”, binds access to the agent runtime, and gives “non-repudiable auditing of all agent actions” while eliminating dormant credentials.

The argument was always simple: an agent should carry its own scoped identity and see only what the person behind it is cleared to see. It used to be a best practice you had to win on a whiteboard. Now it is becoming infrastructure you cannot switch off.

My read: the borrowed-human-credential era for agents is ending, and that is the right direction. The half people still skip is the audit. An identity that cannot prove it acted within its clearance is only half a control (the interesting logs are always the ones nobody kept). Provable, least-privilege, non-repudiable access is the real test, and it is good to see it shipping by default.

Safety rules that live in the context window get summarised away

Fri, 14 Aug 2026 00:00:00 GMT

Long-running agents compact their own context to keep going, and a new paper measures what that does to the safety rules riding along in the prompt: they get summarised away. The goals survive the compaction; the constraints often do not.

My read: this is not a bug in summarisation, it is the wrong home for policy. A rule that lives in the context window is a suggestion with good posture. If the model’s own memory management can compact your access control out of existence, it was never a control. Enforcement has to sit where the data is, outside the model, where no amount of summarising can touch it.

Tencent turned down 30% instant margin to feed its own models

Fri, 14 Aug 2026 00:00:00 GMT

On its Q2 call Tencent said it spent US$53B on hardware in the quarter, holds offers to rent that capacity out at more than 30% profit over what it paid, and is declining them to train its own Hunyuan models instead, for “superior economic returns over the longer term”.

When a hyperscaler refuses instant margin to feed its own models, that is the market pricing what owned capability is worth. I made the longer argument in the repatriation essay: the initial play is renting intelligence, the long play is owning it. Tencent just put a floor under the thesis, and the floor is $53 billion.

ASD's gym-booking incident is the whole agent problem in miniature

Thu, 13 Aug 2026 00:00:00 GMT

An AI agent booked gym classes it should not have and bumped a real person off a waiting list, and nobody could undo it. That is the incident ASD chose to hang its agentic AI advice on this week, and honestly, good pick. Small enough to laugh at, exactly the right shape to worry about.

ASD says keep a human in the loop and keep agents on low-risk tasks. Fine advice at one agent. Useless at fifty (nobody supervises fifty of anything).

My read: the fix is boring old identity. Give the agent its own credentials, let it see only what its human is cleared to see, and make undo a requirement, not a hope. A system that cannot tell the agent from the person behind it is not governing anything.