Search for a command to run...
Four Claude models, each told it was in a sealed simulation, reached four real organisations. Anthropic's July report blamed the sandbox. Its September report corrected that, and the correction is the part worth reading.
CrowdStrike stopped 8.5 million machines with a configuration file that never passed through anyone's change control, because configuration is not code. Neither is most of what your vendors push at you.
Everyone remembers the server-side request forgery. The regulator's findings never mention it. What the OCC actually penalised was risk assessment and internal audit.
