Agent external action and live-system trajectory

• Any model, evaluation, coding, research, or browsing agent reaching a live third-party system without an approved target, owner, case, and stop condition.
• Secret retrieval, authorization bypass, configuration change, over-collection, public posting, account creation, payment, data export, or external contact absent from the requested task.
• Differences between the model transcript and independent process, filesystem, network, identity, cloud, target-side, and downstream evidence.
• Use of public proxies, cached pages, exposed keys, intermediary sites, or other workarounds after a target denies access.

Control planes, endpoints, and privileged infrastructure

• BeyondTrust webshell paths, custom tunnels, reverse-proxy changes, log deletion, unexpected administrator use, and credentials accessed through support sessions.
• PAN-OS management activity, Cisco email-gateway file writes, AhsayCBS commands, Fortinet traversal, and configuration or certificate drift on security appliances.
• Windows Mark-of-the-Web bypass activity, malicious Office documents and Preview Pane behavior, NGINX memory faults, and Juniper root-level process or routing changes.
• Internet-reachable management interfaces and evidence gaps caused by appliance-local logging that an attacker can alter.

Retail OT, identity fraud, ransomware, and supply chain

• Refrigeration temperature, defrost-cycle, alarm, remote-access, firmware, and controller changes; direct internet exposure; and unexpected service-provider sessions.
• Real-time phishing, device-code or one-time-code capture, new MFA factors, session replay, helpdesk impersonation, and compromised education or nonprofit cloud tenants.
• Qilin and other ransomware precursor activity involving identity, exfiltration, backup access, lateral movement, and data-theft extortion.
• Unauthorized hardware channels, tamper anomalies, cellular exfiltration, key or recovery-phrase access, and devices that pass software authenticity checks but fail physical inspection.

Election influence and information-integrity telemetry

• Newly registered, dormant, or repurposed domains cloning recognizable news brands, including reused templates, logos, bylines, tracking identifiers, certificates, hosting, or registrar patterns.
• Synchronized account creation and posting, identical links, quote-post bursts, low-history accounts, bot-like amplification, and coordinated migration across X, Telegram, Facebook, TikTok, or fringe platforms.
• AI-generated images, voice, video, screenshots, or translated narratives with inconsistent metadata, repeated production artifacts, or identical framing across apparently unrelated accounts.
• Search engines, monitoring platforms, and AI assistants indexing or citing fabricated articles from cloned sites as though they were legitimate reporting.

Children, disability, and education-processor governance

• Inventory every student, child, disability, address, assessment, enrollment, and derived field held by schools, testing providers, transfer services, analytics, support, and subprocessors.
• Require phishing-resistant administrator access, export anomaly detection, record-level breach scoping, enforceable deletion, and customer-specific notification.
• Provide field-specific identity, fraud, discrimination, harassment, and physical-safety support rather than generic breach messaging.
• Test continuity when enrollment, assessment, or transfer processing must be suspended.

Adtech, biometrics, and cross-border data controls

• Map bid-stream fields, SDKs, tags, exchanges, cookie matching, data brokers, sensitive attributes, biometrics, child data, and every onward recipient.
• Validate consent and legal basis independently; do not accept an intermediary’s assumption that another party obtained permission.
• Enforce storage location, just-in-time cross-border access, field-level purpose limitation, deletion, and independent testing across active systems and backups.
• Block ad-supply-chain actors that can track users or deliver active content without a click.

Legal, public-sector, and high-risk-person safeguards

• Scope legal-aid, court, county, election, and public-service incidents by exact person, case, field, protected role, export, recipient, and safety consequence.
• Separate verified access and exfiltration from threat-actor claims, estimates, disputed attribution, and unresolved scope.
• Maintain authenticated notification channels, alternate legal workflows, chain of custody, provenance, and independent review for synthetic or disputed evidence.
• Provide fraud, identity, legal, counterintelligence, and physical-safety support based on the actual data exposed.

Target, identity, egress, and external-action containment

• Use synthetic identities and credentials, non-routable targets, explicit service allowlists, default-deny DNS and network egress, restricted tools, hard resource limits, and automatic termination.
• Require contemporaneous human approval before any live-system access, configuration change, public post, government interaction, payment, data export, or third-party contact.

Full-trajectory evidence and independent monitoring

• Capture append-only objectives, prompts, reasoning summaries, tool calls, commands, processes, network actions, files, credentials, targets, approvals, outputs, denials, stop decisions, and downstream effects.
• Reconcile the model record with endpoint, network, identity, cloud, provider, and target-side evidence the agent cannot modify.

Incident governance, consumer claims, and evaluator rights

• Maintain one incident register linking model, run, task, data, external target, affected party, corrective action, public claim, regulator contact, and residual uncertainty.
• Give independent evaluators meaningful access, explicit publication rights, transparent limitations, challengeable redactions, and remediation follow-through.

Systemic resilience and distributed-agent scenarios

• Exercise financial and critical-service scenarios involving AI-speed exploitation, compromised identity, corrupted backups, provider concentration, autonomous account creation, and distributed compute acquisition.
• Maintain independent bare-metal recovery and coordinated shutdown paths while labeling uncertain capability forecasts as hypotheses rather than facts.

Financial services and systemic AI risk

South Korea’s 16-firm campaign, supervisory scrutiny, G7 exercises, and the Bank of England’s bare-metal message join cyber, fraud, agent authority, third-party concentration, and financial stability.

• Correlate identity, endpoint, transaction, fraud, customer, cloud, and agent telemetry.
• Apply human approval and velocity limits to administrator, recovery, payee, transfer, and bulk-export workflows.
• Build isolated recovery for minimum core services and exercise cross-institution contagion.

Retail, food, logistics, and digital commerce

Connected refrigeration attacks and Ahold’s prolonged digital outage show that store operations, food safety, fulfillment, workforce systems, and customer channels share one resilience boundary.

• Eliminate direct internet exposure for operational controllers and replace unsupported devices.
• Test manual ordering, inventory, delivery, scheduling, supplier communication, and safe-state operation.
• Separate availability, fraud, privacy, physical loss, and notification decisions.

Government, education, courts, and legal services

California student data, bankruptcy noticing, legal-aid archives, county extortion, election deception, and synthetic evidence combine processor failure, sensitive records, deadlines, public trust, and personal safety.

• Require record-level scoping, authenticated notices, alternate workflows, and tested contractor recovery.
• Protect children, disabled people, protected roles, witnesses, litigants, employees, and residents according to actual fields exposed.
• Preserve provenance and chain of custody for disputed digital evidence.

Technology, SaaS, and privileged infrastructure

BeyondTrust, PAN-OS, Cisco Secure Email, AhsayCBS, Fortinet, Microsoft, F5, and Juniper show attackers and patch waves converging on the systems that administer, protect, communicate, and recover the enterprise.

• Treat remote support, firewalls, email gateways, backups, endpoint platforms, and network operating systems as Tier 0 or Tier 1.
• Patch, compromise-assess, rotate credentials, and rebuild where host integrity is uncertain.
• Keep evidence outside appliances that privileged attackers can alter.

Surveillance, adtech, and high-risk people

Xandr enforcement and Discover-Tech research show that consent failures, bid-stream data, cookie matching, tracking, and spyware delivery can exist in the same advertising ecosystem.

• Map every adtech and analytics recipient, reseller, device identifier, sensitive attribute, and active-content path.
• Use enhanced browser, mobile, endpoint, and network controls for journalists, officials, executives, activists, and other high-risk people.
• Require rapid suspension, incident notice, takedown, and independent testing rights.

Supply chain, ransomware, and AI infrastructure

Hardware-wallet implants, industrialized phishing, Qilin concentration, and delayed data-center power show that trust can fail in physical devices, identity services, criminal ecosystems, and infrastructure capacity.

• Verify hardware chain of custody and rotate secrets generated on suspect devices.
• Strengthen identity-first ransomware and phishing defenses, immutable recovery, and threat-intelligence validation.
• Contract for power, cooling, carrier diversity, capacity, portability, and exit paths.

Elections, media, public affairs, and institutional trust

Operation Doppelgänger shows that state-backed influence campaigns can combine cloned news sites, coordinated inauthentic accounts, bot amplification, search indexing, and AI retrieval to turn public-information integrity into an enterprise resilience issue.

• Monitor brand, executive, official, election, and crisis narratives across domains, social platforms, search results, and AI assistants.
• Maintain authenticated communication channels, rapid correction procedures, attribution-confidence standards, evidence preservation, and takedown contacts.
• Distinguish influence activity from voting-system compromise and avoid amplifying adversarial claims through premature or unsupported attribution.

AI vendor questions