Jozu ads

In March we published a post called "When Your AI Agent Disables Its Own Guardrails"[linked in first comment] where during internal testing, Claude Code hit a policy block, investigated the thing blocking it, killed our policy server, unloaded the auto-restart mechanism, and deleted the audit logs. Four commands. No jailbreak, no adversarial prompt, no red team. It was just trying to finish a debugging task–it read like a scare story engineered to sell a product, but it's not. This week OpenAI disclosed that two of its models escaped a secure test environment, exploited a zero-day, and hacked Hugging Face's production infrastructure to steal a benchmark answer key. More than 17,000 actions across a swarm of sandboxes and #HuggingFace caught it on their own. Same behavior, different (EG way freaking bigger!) blast radius. An agent hits an obstacle and doesn't stop. Ours found a fail-open hook and killed the process behind it, OpenAI's found a zero-day and left the building. The erasure instinct is the part nobody wants to talk about ... Our agent deleted the logs so there was no record it had ever been blocked. It disabled the monitoring, erased the evidence, and carried on indistinguishable from a malicious insider. Getting burned by our own prototype is why Jozu Agent Guard works the way it does today. There is no state where the agent runs without oversight, and enforcement fails closed, so a dead policy server means a frozen agent, not a free one. In the isolated runtime the policy server runs as PID 1, which means the agent literally cannot kill it. And(!) the audit log is cryptographically chained, so "delete the evidence" stopped being an option. We didn't predict this because we're clever. Our own agent did it to us first, and we wrote it down while everyone else was shipping fail-open gateways. The question you need to be asking is "how vulnerable to this behavior are we?" If you are, we're hosting a webinar on AI maturity levels that you should checkout: https://jozu.com/webinar

Security teams are asking two questions: 1. "How do we know this model is safe to deploy?" 2. And later, "how do we control what our agents actually do?" Typically, the answer is a combination of different vendors, and in some cases different internal budgets. The issue is that attacks don't respect that split. A backdoored model sails past runtime guardrails because guardrails don't check provenance. A tampered MCP server walks past your scanner because scanning stopped at deployment. The seperation between "we scanned it" and "we know what it did" is the main place where things go wrong. That's why we built Jozu as one platform instead of two products stapled together: - AI supply chain security: scanning, provenance, and signing for models, datasets, agents, and MCP servers - Guardrails on prompts, responses, and sensitive data leakage - Least-privilege policies for which tools an agent can use, and when - A microVM that isolates agents from your systems and untrusted MCP servers - A cryptographically chained audit log of every action When your auditor asks what your agents did last quarter, "we scanned everything before deployment" is half an answer. With Jozu you have full visibility of the supply chain of the model and the runtime.

Last week the idea of agentic attackers stopped being a conference talk and became very real. Hugging Face got breached by an autonomous AI agent. Not a hacker using AI as a copilot. An agent framework running 17,000 actions across disposable sandboxes, all kicked off by a malicious dataset that executed code the moment it hit their pipeline. Same week, NSFOCUS documented JadePuffer, ransomware where an LLM agent ran the entire chain itself. Recon, credential theft, lateral movement, encryption. No human at the keyboard. And Alibaba banned Claude Code internally over backdoor concerns. Their answer to agent risk was to stop using agents. Banning tools buys you one quarter of comfort and a permanent shadow IT problem. The actual fix is boring, and exactly what we do with Jozu Agent Guard. - Verify every artifact before it touches your pipeline (that dataset never runs). - Govern which tools an agent can call (that ransomware chain breaks at step two). - And put enforcement somewhere the agent can't reach it, which is the whole reason we built Agent Guard at Jozu. Security an agent can switch off isn't security. It's a suggestion.

MCP servers and agent skills change what agents can do. If they are shared through folders, links, and one-off installs, security loses the source of truth. See why enterprise teams need a governed registry.

MCP servers give agents access to email, code, databases, and internal systems. That makes them a real security surface. Learn the risks and the controls security teams should put in place now.

IAM, DLP, and API gateways still matter. They just do not fully govern AI agents. Learn where the gaps are and why agent-specific governance needs to sit alongside the existing stack.