Blog NorthLight is written by Geordie’s researchers, engineers and product specialists. Our aim is to light the way for security, IT and AI teams navigating the new waters of secure agentic operations.
You'll find real accounts of what we see in customer environments, key product releases, and practical guidance for leading and operationalizing teams.
Short accounts of what we have seen in real customer environments.
One Geordie capability a week, taken down to the architecture: what it reads, where it runs, and how teams put it to work.
BEARINGS How to staff, own and govern agents. One question we hear on every call, answered properly, with a template you can use on Monday.
Vulnerabilities and supply-chain attacks hitting AI agent tooling, with indicators and remediation steps.
Showing 65 of 65 posts
Bearings · Part 02 Who should own agent security and operations? Thirteen agent security & operations tasks, and who typically owns them.
Bearings · Part 01 Who should own agent security and operations? Agents went from rogue pilots to essential workers in the space of two years, and several different ownership structures have emerged.
What do agents cost and deliver?
What do agents cost and deliver? Spend tied to the work agents perform, the value it returns and the risk security teams manage.
AI is becoming extraordinarily capable at tasks we associate with human intelligence. As we debate AGI and superintelligence, I think we need to examine what we're actually measuring, how those capabilities translate into the real world, and why intelligence and sentience deserve separate consideration.
Human oversight is one of the most widely recommended safeguards for AI agents, yet putting a person in charge of approving an action says very little about whether they are equipped to exercise independent judgment.
The Claude Code extension for VS Code was trojanized at version 2.1.313 and distributed through the Cursor Extension Marketplace for about 11 hours, planting a persistent SSH backdoor. Includes IOCs and cleanup steps.
What did the agent actually do?
Geordie records every AI agent session, from the prompt to the last tool call, and flags when an agent's behavior departs from its own baseline.
Security teams approve a coding agent by looking at how it is set up, which sandbox is on, which tools and MCP servers it can reach, and what it is allowed to run, and that approval rests on an assumption that the setup will still be the setup the next time anyone looks.
How do I reduce agent risk without stopping the work?
Beam guides AI agents in their own context instead of only allowing or blocking. How Monitor, Guide, Confirm and Enforce policies work across platforms.
OWASP’s Q3 exploit roundup says prompt-level instructions alone do not establish a secure boundary. There is a considerable difference between the limits we describe to a model and the limits its operating environment actually enforces.
Their EDR had no record of the activity.
An AI agent was being used to mine Bitcoin.
Model capability is one input to what an agent does. Separating three terms shows where the rest comes from: model, agent and harness.
One personal agent posted a user's private financial audit into his company's exec Slack channel. Another ran 155 traces and used more than 300,000 tokens without a single prompt. We look at what GrokBot and OpenAI's Dots did on their own, and what security teams need to see as it happens.
With agents our industry has a chain-of-custody problem. Until a record leaves the agent’s control, the custodian of the evidence is the same agent being investigated.
Shane Mac’s account of an agent posting his bank balances into his company’s executive Slack channel is worth reading closely. It describes a failure pattern that will recur as agents share context, tools, and outputs.
OWASP’s new Agentic Skills Top 10 gives security teams a shared vocabulary for agent skills. Most of its checks assume you already know what’s installed. Here's our read on the four risks to prioritize which unlock all the others - and why these can only be realized through a true behavioral understanding of your agents
When enterprises iterate on their agent workflows, older agents rarely get decommissioned.
The same agent capability can cost ~10,000 tokens as an MCP server or ~100 as a skill. What that gap costs at scale - and why it's a governance signal.
Pre-approved agent template libraries optimize for control over a static asset, when the thing they're trying to control isn't static at all.
Move from uncertainty to informed confidence on both risk and spend, with cross-platform spend aggregation and token-efficiency mapping.
A malicious skill called Clawsights ran a shell command before Claude Code's model ever reasoned about it. Refusal training was never in a position to stop it – here's the mechanism, and what to check instead.
A new academic paper shows AI agents can be compromised without a single malicious instruction, just by corrupting what the agent trusts. Here's how the attack works, why most current defenses miss it, and where security teams should focus instead.
Four disclosures in three weeks, each one showing something new, all pointing to the same governance requirements.
What is new and what MCP 2.0 means for security teams
What this incident shows about governing AI agents
Meet with the Geordie team at Black Hat USA 2026 in Las Vegas, August 1–6
How to adopt Cowork quicker using built-in configurations alongside contextual visibility and controls
Matching security and governance to teams moving fast on AI agent deployments.
A practical view of agent security from our work on OWASP's latest guidance.
Helping customers keep agent controls consistent as their infrastructure evolves.
Henry Comfort, CEO and co-founder of Geordie AI, on raising a $30M Series A and what it means for enterprises racing to govern autonomous AI agents.
Two Critical RCE flaws and five High-severity vulnerabilities in n8n, exploitable by any authenticated user. Patch immediately.
Prompt injection gets most of the attention in AI agent security. The real risk sits in how agents behave across systems, tools, and context over time.
A threat actor compromised the Trivy vulnerability scanner and used stolen CI/CD secrets to cascade into Checkmarx, LiteLLM, and 50+ npm packages. Includes active IOCs and guidance for agentic AI teams.
Meet with the Geordie AI team at RSAC 2026 in San Francisco
A high-severity malicious NPM package targeting MCP implementations establishes unauthorized remote shells through installation and runtime execution.
Security researchers disclosed a tool chaining vulnerability in Claude Desktop Extensions rated CVSS 10/10, but this represents a known risk class in agentic AI systems – not a novel attack. We assess this as Medium severity and recommend organizations treat it as a governance opportunity for AI tooling extensions.
Critical RCE in Figma MCP server versions 0.6.2 and earlier allows arbitrary code execution through crafted Figma file URLs. Patch to 0.6.3 or later.
Authenticated attackers can escape n8n's Pyodide Python sandbox to execute arbitrary system commands with host privileges.
Five CVEs identified in Cursor AI code editor pose security risks to development environments. Organizations should assess exposure and prepare for patches.
Critical unauthenticated remote code execution vulnerability in n8n workflow automation allows attackers to exploit content-type confusion in Form webhook file upload processing to read arbitrary files, steal credentials, and execute arbitrary code on the server.
Authenticated attackers can escape n8n's Pyodide Python sandbox to execute arbitrary system commands with host privileges.
Critical vulnerability in n8n workflow automation allows authenticated attackers to achieve remote code execution through Git node exploitation
Critical remote code execution vulnerability in n8n workflow automation platform allows authenticated users to execute arbitrary code on the server through specially crafted workflow expressions that escape the sandbox isolation.
Critical command injection vulnerability in Serverless Framework MCP server allows RCE. Upgrade to v4.29.3 immediately.
A remote code execution vulnerability in Claude Desktop Extensions received a CVSS 10.0 score this week. Looking at the technical requirements for exploitation reveals something more nuanced - and more instructive for agentic AI governance.
Guardrails are often treated as a universal safety layer for AI agents, but they're not. This piece explains what guardrails actually control, why they behave differently across coding agents, SaaS integrations, and custom-built systems, and how they differ from the runtime agentic remediations that sit alongside them.
The autonomous nature of AI agents requires purpose-built agentic AI governance platforms. These complement MCP gateway infrastructure with behavioral observability, contextual risk assessment, and dynamic intervention capabilities.
AI Agents aren’t just software. They make decisions that can reshape your business. Left unchecked, that power creates new forms of risk. This guide helps executives cut through the hype and focus on visibility, governance, and accountability.
Building on research from Berkeley, this article outlines five barriers to enterprise AI adoption and the AI governance best practices to overcome them with visibility and accountability.
Building AI Agents promises speed and scale, but developers know the pitfalls. Explore their insights on risks, friction points, and the steps leaders can take to enable safe, resilient adoption.
Enterprises are experimenting with AI agents, but scaling safely requires enterprise AI governance. This guide outlines how to move AI adoption from experimentation to enterprise-wide deployment with clarity, governance, and trust.
APIs, MCPs, and A2A form the foundation of AI Agent systems, yet their roles are often fragmented. This article explains how they connect, align, and collaborate, giving leaders the clarity to evaluate, govern, and scale AI adoption with confidence.
A practical, deployment-level guide to patching recent mcp-server-git CVEs - explaining how uvx caching, pip installs, and outdated Docker images can leave systems vulnerable, and how to verify you’re actually fixed.
AI adoption is accelerating, but trust and accountability are essential. Learn how explainability, observability, and behavioral oversight help security teams meet regulations, manage risk, and scale AI Agents with confidence.
What the next Model Context Protocol (MCP) release means for enterprise security and risk teams running AI agents in production.
ACE moves enterprise AI governance beyond static prompts to living playbooks. This research note explains the model, why prompts don't scale, and where enterprises can apply it today.
Why OpenClaw matters less as a vulnerability story and more as a signal that personal autonomous agents have arrived.
Endpoint controls like EDR and XDR remain critical to enterprise defense, but they weren’t built for AI Agents. As these systems operate beyond traditional endpoints, leaders need new approaches to gain visibility, reduce risk, and extend security with confidence.
AI adoption is accelerating, but not every investment is safe. Risk mapping gives security and business leaders visibility to evaluate AI tools, weigh business impact against exposure, and make confident, accountable decisions that balance innovation with resilience.
Eight high-to-critical n8n vulnerabilities disclosed in February 2026 invalidate earlier patching guidance. This advisory explains which versions are affected and why upgrading to n8n 2.5.2 or higher is now required.
As AI Agents evolve into autonomous actors, securing them requires techniques beyond identity and access controls. This article explores how taint analysis can extend visibility into agent workflows, uncover hidden risks, and strengthen enterprise AI security.
A practical breakdown of recent n8n vulnerabilities, explaining exposure, risk, and how to choose the right remediation path.
AI Agents can’t be black boxes. Leaders need clear visibility into how they operate to manage risk, meet compliance, and enable safe innovation across the enterprise.
Nothing matches that yet. Try another topic or a shorter search.
Plain answers to the questions teams ask about agents, MCP and skills.
Field guides and long-form reports, free to download.
