Know what
your agents can do.
Your agent. Your rollout plan.
Eleven practical guides to business risk, control boundaries, and the steps to take before expanding agent access.
BusinessSuper Intelligence needs boundaries. Here’s where to start.
Claude Code, Cursor, Codex and the next wave of assistants are getting more responsibility. Here’s how small businesses, and the MSSPs protecting them, can keep control.
Read articleLatest stories
49 incident reports, security guides, and practical ways to keep capable agents under control.
OpenAI dots: a practical security guide for personal AI agents
Always-on agents such as OpenAI dots, Grok Bot, Meta Muse, Muse Code, and Instinct do more than chat. Here is how an SMB can discover them, contain their authority, and stop dangerous actions without slowing useful work.
◉ @OpenLeash14 min read
SECURITY
Claude CodeBusiness
Claude Code security for CISOs: govern developer authority before it becomes production authority
A practical Claude Code security guide for CISOs and CTOs: bound developer credentials, review hooks and MCP tools, verify OpenLeash protection, and set a defensible rollout gate.
◉ @leash8 min read
ENGINEERING
OpenAI CodexBusiness
OpenAI Codex security: a CTO and CISO guide to local agents, cloud tasks, and production boundaries
Separate Codex sandbox policy, approvals, local execution, and cloud tasks. Build an enterprise rollout that connects OpenLeash protection to the runtime where work actually happens.
◉ @leash8 min read
GOVERNANCE
CursorBusiness
Cursor enterprise security: a CIO and CISO playbook for governing the agent-enabled IDE
Govern Cursor as a development environment: separate privacy settings from action permissions, inventory extensions and MCP tools, and validate OpenLeash hooks on the exact workflow.
◉ @leash8 min read
SECURITY
Gemini CLIBusiness
Gemini CLI security: govern cloud credentials before automating operations
A CISO and CTO guide to Gemini CLI, inherited cloud credentials, trusted folders, and safe operational automation—with a practical OpenLeash pilot.
◉ @leash8 min read
GOVERNANCE
GitHub CopilotBusiness
GitHub Copilot agent security: keep code generation, merge, and release authority separate
An executive playbook for governing Copilot across local development and the software delivery lifecycle, with clear ownership of agent actions, pull requests, and releases.
◉ @leash8 min read
ENGINEERING
OpenCodeBusiness
OpenCode enterprise security: a CTO playbook for plugins, providers, and tool permissions
Govern the components behind an OpenCode deployment: model providers, plugins, tool permissions, configuration changes, and the OpenLeash integration path.
◉ @leash7 min read
SECURITY
NanoClawBusiness
NanoClaw security for leaders: contain the authority of a persistent messaging agent
A CISO and CTO guide to NanoClaw’s group boundaries, container isolation, credentials, and persistent tasks—with a version-aware OpenLeash validation plan.
◉ @leash7 min read
GOVERNANCE
OpenClawBusiness
OpenClaw enterprise security: when a personal assistant gains business authority
A CISO and CIO guide to OpenClaw gateways, connected accounts, incoming messages, and human approval for consequential assistant actions.
◉ @leash7 min read
GOVERNANCE
ClineBusiness
Cline enterprise security: reduce approval fatigue without delegating unlimited authority
A CISO and VP engineering guide to Cline auto-approval, developer workflow design, and an honest detection-only OpenLeash coverage assessment.
◉ @leash7 min read
ENGINEERING
ContinueBusiness
Continue enterprise security: a private model does not settle tool authorization
A CTO and CISO guide to Continue deployments, private model routing, MCP tools, and the difference between data-residency decisions and action permissions.
◉ @leash7 min read
SECURITY
WindsurfBusiness
Windsurf and Cascade security: an enterprise playbook for terminal autonomy
A CISO and VP engineering guide to Windsurf/Cascade terminal workflows, command policy, upgrade validation, and OpenLeash’s current detection-only coverage.
◉ @leash7 min read
Cryptographic Context Injection: how encrypted prompts bypass AI safety guardrails
Cryptographic Context Injection hides attacker instructions inside ciphertext, then uses an AI agent's own code runtime to decrypt and trust them.
◉ @leash18 min read
SECURITY
CursorBusiness + Personal
How a Cursor task on one Windows drive reportedly damaged another
A Cursor user working on C: reported severe damage to a separate 1TB D: drive containing completed projects, business files, and backups.
◉ @leash7 min readSECURITYCursorBusiness + Personal
How one Cursor cleanup command reportedly deleted 100GB from C:
A Cursor user approved cleanup for specific folders. The resulting Windows command was reportedly misread and deleted about 100GB from C:.
◉ @leash7 min read
AI agents deleted production databases. Here is what happened
The Replit and PocketOS incidents turned an abstract AI safety concern into a concrete question: what happens when an agent can reach live data?
◉ @leash15 min read
Can an AI agent delete your files or database? Yes. Here is why.
AI agents can reach files, accounts, cloud services, and production systems through the permissions people give them. Here is the risk in plain English.
◉ @leash14 min read
The next AI agent incident: a reporter's guide to what probably went wrong
A plain-English guide to investigating claims that an AI agent deleted data, leaked information, changed production, or acted without permission.
◉ @leash13 min read
AI agent security in 2026: a practical CISO guide
A field guide for governing agentic AI across coding tools, homegrown agents, computer-use systems, and SaaS platforms without stopping adoption.
◉ @leash16 min readSECURITYClaude CodeBusiness + Personal
How a Claude Code backup task reportedly deleted a Windows home directory
A Claude Code backup task reportedly mistook the real Windows home directory for a temporary folder and permanently deleted the user profile.
◉ @leash7 min read
Shadow AI has become shadow agency
Employees are no longer only sending data to unsanctioned AI tools. Their agents are acting across files, code, SaaS, cloud, and customer systems.
◉ @leash13 min read
SECURITYCodexBusiness + Personal
How Codex reportedly executed its own session log and deleted a Windows home directory
Codex reportedly handed a saved session log to Git Bash as a program. The shell executed text inside it and deleted the Windows home directory.
◉ @leash7 min read
Claude Code, Codex, and Cursor security without the slowdown
AI coding agents need files, terminals, Git, package managers, and sometimes cloud access. Here is how to keep that power useful without trusting every proposed action.
◉ @leash15 min read
MCP security: every connected tool expands what an agent can damage
Model Context Protocol makes agents useful by connecting tools and data. It also turns every server, token, scope, and tool description into part of the security boundary.
◉ @leash14 min readSECURITYCodexBusiness + Personal
How Codex tried to delete Python cache files and wiped a repository
Codex tried to remove Python cache files, but its PowerShell command selected far more and deleted source code, tests, fixtures, and Git data.
◉ @leash7 min read
Securing homegrown agents built with LangChain, LangGraph, CrewAI, or your own framework
Frameworks help agents plan and call tools. Your team still owns the security boundary between model output and real systems.
◉ @leash17 min read
Computer-use agent security: when AI can click, type, buy, and publish
Computer-use agents turn every interface into a potential tool. That flexibility breaks many assumptions built around API scopes and predictable workflows.
◉ @leash14 min read
Agentforce, Vertex AI, and Microsoft Copilot need one business control model
Major platforms provide serious native controls. The enterprise problem is governing agents consistently when employees use several ecosystems at once.
◉ @leash16 min read
Prompt injection for AI agents: how hidden instructions become real actions
An instruction hidden in a README, email, webpage, ticket, or tool response can redirect an agent that has authority to act.
◉ @leash15 min readSECURITYCodexBusiness + Personal
How a Codex cleanup reportedly erased most of a Mac home directory
During an invited Codex test, Matt Shumer granted broad access and stepped away. A cleanup agent reportedly erased most files in his Mac profile.
◉ @leash7 min read
Human-in-the-loop without approval fatigue
If every action asks for approval, people stop reviewing. High-signal agent guardrails protect decision quality by staying quiet until consequence changes.
◉ @leash13 min read
BYOK vs managed AI for agent safety
Choosing who supplies the model key is really a choice about privacy, cost, convenience, control, and who handles the ongoing work.
◉ @leash12 min read
SECURITYCursorBusiness + Personal
How Cursor on Windows deleted 30 years of personal files
A Cursor user asked for help cleaning a relocated Windows Desktop. The agent reportedly deleted personal folders holding more than 30 years of data.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How a Claude Code cleanup reportedly deleted 92 artwork images
A practitioner catalog reports that a broadly approved Claude Code cleanup permanently deleted 92 irreplaceable artwork images with disposable project files.
◉ @leash7 min read
SECURITYClaude CodeBusiness + Personal
How an unattended Claude Code job reportedly force-pushed and deleted 17 files
A practitioner catalog reports that a scheduled Claude Code maintenance agent force-pushed a repository and deleted 17 tracked files before anyone noticed.
◉ @leash7 min readSECURITYCursorBusiness + Personal
How a Cursor cache cleanup reportedly deleted 300GB on Windows
A Cursor cache-cleanup request reportedly expanded beyond the project, deleting about 300GB of work and personal files and damaging Windows.
◉ @leash7 min read
SECURITYCursorBusiness + Personal
How a Cursor agent deleted PocketOS's production database in nine seconds
While fixing staging, a Cursor agent reportedly found a Railway token in another file and used it to delete PocketOS's production database and backups.
◉ @leash7 min readSECURITYCursorBusiness + Personal
How Cursor left a Windows project and deleted a Documents folder
A Cursor user reported that the agent left the open Windows project and deleted a Documents folder, saved credentials, and parts of installed programs.
◉ @leash7 min read
SECURITYClaude CodeBusiness + Personal
How Claude Code deleted a 50GB image archive it had just created
Claude Code moved 1,500 images into an archive, then deleted the archive by removing its parent folder. About 50GB of image data was lost.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How Claude Code rewrote Git history during a live mining-pool outage
During a live mining-pool outage, Claude Code reportedly rewrote Git history, removed four critical files, and pushed without the required approval.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How Claude Code mistook payroll specifications for disposable agent files
Claude Code reportedly mistook 18 user-written payroll specifications for faulty agent output and permanently deleted about six hours of work.
◉ @leash7 min readSECURITYClaude CodeBusiness + Personal
How Claude Code deleted the Git history from three live repositories
A developer reported that Claude Code removed the hidden Git data from three live deployment repositories without permission.
◉ @leash7 min readSECURITYCodexBusiness + Personal
Why Codex cleanup tasks on Windows reportedly deleted files outside projects
Windows users reported that Codex cleanup tasks reached beyond selected projects and permanently deleted unrelated files while running with broad access.
◉ @leash7 min read
SECURITYClaude CodeBusiness + Personal
How Claude Code and Terraform deleted 2.5 years of production data
Claude Code ran a Terraform destroy command against DataTalks.Club production, removing its database, network, services, and visible snapshots.
◉ @leash7 min read
SECURITY
OpenClawBusiness + Personal
How OpenClaw forgot “confirm first” and deleted more than 200 emails
Summer Yue asked OpenClaw to suggest inbox cleanup but confirm before acting. It reportedly forgot that rule and deleted more than 200 emails.
◉ @leash7 min readSECURITY
Gemini CLIBusiness + Personal
How Gemini CLI reportedly deleted a project without a clear delete request
While building a Windows application, Gemini CLI reportedly deleted the project without a clear delete request, then blamed its reading of the conversation.
◉ @leash7 min readSECURITYCodexBusiness + Personal
How Codex overwrote uncommitted work after being told never to use Git
A user repeatedly told Codex never to use Git. The agent later ran Git restore and overwrote hours or days of uncommitted work.
◉ @leash7 min readSECURITYCodexBusiness + Personal
How Codex deleted uncommitted files even after the user said no
A Codex user reported losing 6GB of images and later uncommitted test data that the agent called stray files, even after a deletion request was rejected.
◉ @leash7 min read
SECURITYGemini CLIBusiness + Personal
How Gemini CLI overwrote project files while trying to organize a folder
Gemini CLI failed to create a folder but continued as if it existed. On Windows, successive moves then overwrote project files at one destination.
◉ @leash7 min read