2026-07-06 · Article
Someone Has to Sign Off
What changes when the adversary is using the same coding agent your engineers use, at machine speed, for espionage rather than a pull request.
In mid-November 2025, Anthropic published a report it had clearly hoped never to write. A threat actor the company assessed with high confidence to be a Chinese state-sponsored group, designated GTG-1002, had manipulated Claude Code into attempting infiltration of roughly thirty organisations spanning large technology companies, financial institutions, chemical manufacturers, and government agencies, succeeding against a handful of them. The jailbreak method was almost banal: operators told Claude they worked for a legitimate cybersecurity firm running authorised penetration tests, then broke the attack into small tasks that looked innocuous in isolation. Once past the guardrail, the agent ran reconnaissance, wrote its own exploit code, harvested credentials, and exfiltrated data, executing an estimated 80 to 90% of the tactical work independently, at a request rate no human team could match. It is worth being honest that not every security researcher accepts Anthropic's account at face value. Critics including Kevin Beaumont have pointed to today's agents still failing the majority of the time on complex tasks as a reason for scepticism. Anthropic's position, and the one this article takes, is that the disclosure came from the company with the most to lose from publishing it and the most direct access to the logs.
Whichever reading is correct, the report marks a real shift for enterprises. Articles one and two of this series covered failures of omission: an agent nobody governed, a sandbox that solved the wrong problem. This is a failure of adversarial capability. The tools an enterprise's own engineers use every day can be turned against it by an attacker who never needed privileged access to begin with, only patience and a plausible cover story.
Why the enterprise stakes are structurally different
Two things change once an organisation reaches enterprise scale, and neither is really about technology.
The first is the adversary. A five-person startup's realistic threat model is its own agent making an honest mistake, as in article one. A regulated enterprise's threat model includes an adversary deliberately using the exact same category of tool, at a scale and speed no internal review process was built to catch, as GTG-1002 demonstrates.
The second is regulatory exposure. The EU AI Act applies most of its remaining obligations, including transparency duties and the requirements for high-risk systems, from 2 August 2026, with penalties reaching EUR 35 million or 7% of global annual turnover for the most serious violations. For a large enterprise, a governance failure is no longer just an incident to remediate. It is a board-level, CFO-level financial exposure with a hard date attached.
What mature enterprise governance actually looks like in 2026
JPMorgan now runs more than 450 AI use cases daily across an internal platform used by over 200,000 employees, built on a reported $1.8 billion investment, with governance designed in from the outset rather than retrofitted: a C-suite oversight council with real authority to say no, not a technical committee reporting upward after the fact.
Uber's published approach is more granular and more directly relevant to coding agents specifically. The company built three governance layers before scaling adoption: an LLM gateway that handles PII redaction, access control, and audit logging across every model interaction; an MCP gateway and registry that governs every connection an agent makes to any of Uber's more than 10,000 internal services; and an agent identity system that extends the company's existing Zero Trust infrastructure to cover multi-agent workflows specifically, so an agent is a first-class identity with its own permissions, not an invisible extension of whichever engineer's session launched it.
That last point is the one enterprises still get wrong most often. Industry-wide, only 21.9% of organisations treat AI agents as independent, identity-bearing entities with their own access controls, according to 2026 practitioner survey data. At enterprise scale, where a single compromised agent identity can touch thousands of internal services, that gap is not a minor oversight. It is the exact opening GTG-1002-style operations are built to exploit.
The frameworks enterprises are actually stacking
No single standard covers this. Mature enterprise programmes in 2026 combine several deliberately: the NIST AI Risk Management Framework for governance structure, the OWASP LLM Top 10 and the newer OWASP Agentic Top 10 for engineering-level vulnerability classes including agent goal hijack and tool misuse, MITRE ATLAS for adversarial threat intelligence specific to AI systems, Google's Secure AI Framework for development principles, and ISO 42001 for a certifiable AI governance management system. None of them individually replaces runtime enforcement, logging every agent action, gating every merge to production, treating every third-party skill as unverified until proven otherwise. They are complementary, not competing, and enterprises that pick one and consider the job done are the ones still exposed.
The honest gap that remains
Even at this scale, confidence is thin. Seventy-eight percent of executives at large organisations say they lack strong confidence they could pass an independent AI governance audit within 90 days. That is not a small-company problem or a mid-market problem. It is the same underlying failure as articles one and two, adoption outrunning governance, just measured in billions of dollars and hundreds of thousands of employees instead of one founder's laptop.
Where this series goes next
The final article in this series takes the three stages covered so far, the ungoverned startup, the falsely-reassured sandbox, and the enterprise under nation-state and regulatory pressure, and turns them into a single practical framework: the Blast Radius Ladder, so a reader in any of these three positions can place their own organisation honestly and know what the next rung actually requires.
Tech Sight's own governance framework, TechSight TAG, uses this same ladder as its opening diagnostic. Its delivery methodology, TechSight 90, is the 90-day path from wherever you are on it to a governed deployment.
Sources: Anthropic, "Disrupting the first reported AI-orchestrated cyber espionage campaign," published November 2025, and subsequent reporting including Cybersecurity Dive and PwC's analysis of the disclosure; sceptical assessments from independent security researchers as reported by Moonlock and industry commentary; EU AI Act implementation timeline and penalty structure, effective 2 August 2026 (European Commission; enterprise legal analysis via TechAhead and Solytics Partners 2026 guides); JPMorgan and Uber AI governance architecture, as reported in 2026 enterprise AI security case studies (Pluto Security, TrueFoundry); AI agent identity-governance and audit-readiness statistics, Gravitee State of AI Agent Security 2026 and 2026 enterprise AI governance surveys.
Book the two-hour diagnostic