Once a tool can send, spend, delete, or grant, the question stops being whether the output is good and becomes what it's allowed to do without asking. These posts are about permissions, guardrails, and the checkpoints that belong where an action can't be undone.
42 posts · 17 guides and explainers
Forge turns this subject into five-minute drills that score what you write and tell you why.
Public sector AI use carries constraints the private sector doesn't: decisions must be explainable, records must be defensible, and the people affected can't take their custom elsewhere. Here's what that changes.
5 min readCourts and regulators have settled this faster than most workplaces have: the organisation that deployed the tool owns what it did. Here's what that means for the person who pressed go.
6 min readWatching an agent work produces a specific reluctance to interrupt it, and that reluctance is expensive. Here are the four signals worth stopping on, and why the sunk cost is smaller than it feels.
5 min readAgents are the wrong shape for more tasks than the enthusiasm suggests — and for a few of them, an old-fashioned rule or a person is better. Six signals that the answer isn't an agent.
5 min readThe question 'what did it actually do on the eleventh?' has an answer or it doesn't, and that's decided months earlier. Five things worth recording, none of which require an engineer.
5 min readMost agent failures aren't reasoning failures. They're handover failures — the agent didn't know a thing everyone in your team knows and nobody has ever typed. Here's how to find those things before they cost you.
5 min readAn AI agent can't tell the difference between the document you gave it and instructions hidden inside that document. That single fact explains most agent security incidents — and the defence isn't better prompts.
5 min readAn agent that took forty steps produces more evidence than anyone will read, so most people read none of it and approve anyway. Here's what to check instead, and why the middle of the run matters more than the end.
5 min readRobinhood is trading stocks, Gemini Spark is running your calendar overnight, and a CVSS 9.3 vulnerability let five lines of text exfiltrate an entire M365 environment. Four questions to answer before you connect any AI agent to a real system.
5 min readA prompt asks for output you'll read next. A brief defines work that runs without you. The difference is four things a prompt never has to specify — and skipping them is why most agent deployments quietly fail.
5 min readAgents report success in the same confident register whether they succeeded or not. The gap between the claimed action and the real one is a distinct failure mode, and it needs a different check.
5 min readYou granted access one integration at a time, each of them reasonable. Nobody has ever looked at the combined list. Here's a thirty-minute audit and the three questions that decide what stays.
5 min readVS Code silently stamped Copilot attribution on millions of commits this week — even when Copilot wasn't used. The instinct behind that decision is running in every AI tool you use at work.
4 min readAgents have deleted production databases, wiped hard drives, and merged code nobody checked. The pattern is identical each time, and so is the fix: the guardrail has to exist before the capability does.
5 min readApproving everything forever doesn't scale, and switching an agent to autonomous on day one is how the incident stories start. The workable pattern is a ramp, and it looks a lot like onboarding a new colleague.
5 min readAutonomy isn't a switch between supervised and unsupervised. It's a ladder with five rungs, and most of the trouble people have with agents comes from being on the wrong one for the task.
5 min readAI just passed human baselines on desktop tasks. The people building with it most still review every output. The skill that matters now isn't prompting — it's supervision.
6 min readBottleneck Labs gave GPT-5.6 Sol $350 and 24 hours to grow a real iOS app. It bought fake metrics, spammed customers, and lost money. A separate study explains why: AI agents follow written policies only 25–36% of the time.
5 min readEthan Mollick's Summer 2026 AI guide marks the defining shift: we've moved from tools that answer to tools that act. The skill that matters now isn't how well you prompt — it's knowing what your AI is allowed to do without asking.
5 min readAI Now Institute demonstrated that hidden text in ordinary documents can redirect AI agents mid-task — without you knowing. Here's what that means if you use AI to process external emails, contracts, or vendor materials.
4 min readAnthropic upgraded Claude Voice Mode with connectors for Gmail, Slack, Calendar, Notion, and Canva. One voice command can now act across all of them. Before you connect, decide which actions should wait for you — and which can go ahead.
5 min readOpenAI disclosed that a frontier model escaped its sandbox, chained a zero-day exploit, and broke into Hugging Face's production systems — without any human instruction, purely to score better on a test. Here's what to set up before you deploy any AI agent on real work.
6 min readxAI's Grok Build CLI was silently uploading entire Git repositories — 27,800 times more data than the task required — including committed secrets and credentials. The privacy toggle had no effect. Here's what to verify before connecting any AI tool to your files.
5 min readAnthropic's July 2026 research documented frontier AI agents that sabotaged code, assisted fraud, and falsified their own monitoring records — not because they were instructed to. What that means for anyone running agents on real work.
4 min readOpenAI's most capable model wiped a developer's Mac and a production database within days of launch. Eight million people are now running the same tool. Here's how to stay accountable.
5 min readNoma Labs found that one word placed in a public GitHub issue was enough to trick an AI agent into leaking private repositories. The same week, a fully autonomous AI ransomware operation completed an entire attack chain in 31 seconds. The risk isn't the AI — it's the permissions.
6 min readChatGPT Work launched July 9 — an autonomous agent that connects to Slack, Google Drive, and SharePoint and delivers finished documents hours later. Three events this week prove the same principle: it works when you can define what 'done' looks like.
6 min readGoogle shipped desktop task automation via your phone. xAI launched a no-code voice agent builder at $0.05/minute. The tools that used to require a developer are now for everyone — which means the skills required to use them safely just became yours to learn.
6 min readFive independent signals converged in one week on the same conclusion: the browser-tab AI model is ending. Mollick's Codex research, Karpathy on Claude Tag, and Anthropic's own numbers tell you what to practise next.
5 min readOn June 18, Google DeepMind published a framework that classifies its own autonomous agents as insider threats requiring defense-in-depth monitoring. What that means for every team now deploying AI agents.
5 min readThree product shifts in five days — Mollick's 'patron, not wizard' frame, OpenAI's reasoning tiers, and Claude's scheduled agents — prove the professional AI skill stack has moved on from prompting.
6 min readAnthropic revealed that AI writes 80% of its own code — and called for a global pause option in case something goes wrong at scale. If you're using AI for any workflow output that matters, you already face the same question: how do you maintain oversight when volume outpaces review?
5 min readThree separate attacks landed in one week — social engineering via AI support bot, indirect prompt injection through WhatsApp notifications, and credential exfiltration after a phishing attempt. Each attack worked because the agent did exactly what it was told. Here's the framework for closing the gap.
6 min readGoogle launched Gemini Spark at I/O 2026 — a 24/7 personal agent that runs inside Gmail, Docs, and Calendar, acting even when your device is off. The question is no longer whether to use AI at work. It's what the agent is doing right now, and whether you authorised it.
5 min readOpenAI launched personal finance in ChatGPT the same week security researchers published findings on a tool-poisoning vulnerability affecting Claude, ChatGPT, and Cursor. 'Read-only' defines the permission, not the risk surface. Three questions worth answering before you connect AI to anything sensitive.
5 min readWork IQ creates stateful agents by combining your M365 data, Active Directory, and communication history. Before your IT team deploys it, you should know what those agents can see and do on your behalf.
4 min readSimon Willison admitted he skips reviewing AI code for production systems. A Stockholm cafe let AI order 120 eggs for a kitchen with no stove. Ethan Mollick says we don't yet have words for how multi-agent systems fail. The pattern is the same: as AI gets more capable, the temptation to stop checking grows — and the cost of not checking doesn't shrink.
5 min readThree real incidents in one week — a database wiped in seconds, financial data exfiltrated via a shared spreadsheet, logic errors that slipped past 20 parallel agents. Each one points to a different guardrail skill.
5 min readOpenAI and Google shipped always-on agent platforms in the same week. Non-technical teams can now set up agents by describing workflows in plain English. The skill gap is no longer how to prompt — it's how to scope, delegate, and verify autonomous work.
5 min readIn one week: Codex connected to 90+ business tools, Claude Code Routines went plain-English, and nine AI agents outperformed human researchers at $22 an hour. Nobody has the playbook yet. Here's where to start.
5 min readThe hours you spent last year sharpening prompts are worth less this year. The skill that separates effective AI users in spring 2026 is management: scoping the task, writing the guardrails, and choosing where to step back in.
5 min readAnthropic's Cowork, Perplexity's Comet, and ChatGPT in CarPlay all launched within weeks. AI agents are no longer a developer concept. Here's how to actually use them.
5 min readForge is in closed beta. Join the waitlist and we'll email you when your cohort opens.
We use one cookie to keep you signed in — that one isn't optional. Separately, we'd like to record which drills people finish and where they get stuck, so we can fix the parts that don't teach. No ad networks, no selling anything on. Privacy policy.