Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-18 · high
Clinton's July 17 guide asks four questions instead: ingestion, permissions, blast radius, observability.
Why now: The guide published July 17 gives security teams four concrete questions instead of another abstract warning about agent risk.
Eliminating agent risk isn't realistic or the goal, according to a July 17 guide from Anthropic's deputy CISO, Jason Clinton. For any team running agents against inboxes or code, the four questions decide whether a mistake stays contained or spreads through everything the agent touches.
The guide comes down to four questions. What does the agent ingest, what can it do, what's its blast radius, and can you observe it?
Anthropic pairs those questions with concrete controls: scoped access instead of broad grants, network egress limits, and telemetry routed into a SIEM. Rollout is admin-paced, not flipped on for everyone at once.
Narrow identity and mandatory human escalation apply whenever an agent touches untrusted input, a webpage, an email, a file someone else uploaded. Most agent deployments treat ingestion and action as the same trust boundary. They aren't.
Two Claude Code releases add texture to the four questions in practice. Version 2.1.214 fixed six permission-bypass bugs, including a directory wildcard rule that auto-approved writes anywhere in the tree. Version 2.1.210 hardened the agent tool against indirect prompt injection so it stops firing on webhook input.
Other vendors are converging on similar shapes. Cloudflare's audit skill splits the agent that finds a bug from the one that confirms it. Alterion's Draco enforces guardrails at the runtime level without touching application code.
The pattern across all of them is separation, not trust.
Each link below shares sources, entities, or timing with this story.
The same guide names seven controls, and those two are the ones nobody solo-building bothers with. All traffic leaving the agent's execution environment passes through a proxy that blocks unapproved destinations. One toggle disables every connector across all users at once. Th...
Jason Clinton's July 17 guide asks: what untrusted content does it ingest, what actions can it take and on whose behalf, what's the blast radius if it's misaligned, and can your observability distinguish agent actions from user actions. The framing is explicitly that zero risk...
Jason Clinton's four-question framework, published July 17: what content does the agent ingest, what actions is it allowed, what's the blast radius, is it observable. The framing is that risk should be legible and bounded rather than eliminated. Concrete primitives: scoped acc...
The internal tool that triages Anthropic's build failures ships as reference code that mines your own incident history before it touches anything.
Bun's Zig-to-Rust port spent 5.9 billion input tokens and 165,000 dollars, and passed the full existing test suite before merge.
Cache reads run a tenth of input cost, but the discount expires in an hour on subscriptions and five minutes on API keys.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.