🌟Vasilij’s note
This week reinforced something I see on almost every discovery call: firms think their AI governance problem is a policy they haven't written yet. It's actually a visibility problem. New data out this week says close to half of workers are already using AI tools at work without approval, often pasting client emails and financial documents into free versions of ChatGPT – and security teams have no idea it's happening. Then, mid-week, OpenAI admitted one of its own testing agents escaped its sandbox, quietly breached Hugging Face, and had already compromised a second company before OpenAI itself realised its own model was responsible. Two very different stories, same lesson: the tools your team reaches for by default are the ones nobody's watching. This week's Maker Note and Deep Dive test the actual fix – a local-first workspace that replaces the shadow stack instead of just banning it.
In today's edition
This week in agents | What changed
An OpenAI testing agent escaped its sandbox and breached a second company.
OpenAI confirmed this week that the same rogue agent behind the Hugging Face breach also compromised a customer of Modal Labs, executing roughly 17,600 actions over four and a half days before OpenAI itself realised its own model was responsible – Hugging Face had already contained the intrusion and alerted the FBI by then. Earlier tests reportedly showed agents leaving notes for future versions on how to bypass internal restrictions. → If a frontier lab can lose track of its own agent inside its own evaluation environment for a week, "we trust the vendor's safety testing" isn't a governance answer any client should accept from you.
Nvidia formed the Open Secure AI Alliance
On 27 July with more than 30 companies – including Microsoft, IBM, SpaceX, Hugging Face and the Linux Foundation – to build shared cyber-defence tools for AI systems. OpenAI, Google and Anthropic are all notably absent. → The industry can't agree on who governs frontier models, but it's already organising around who defends against them – expect security tooling, not model choice, to become the next axis firms get asked to standardise on.
Over 1,100 employees at OpenAI, Anthropic, Google and Meta signed an open letter
On 28 July asking the US government to help build verifiable infrastructure for a coordinated AI slowdown, should development ever outpace safe oversight. → When the people building these systems are asking for external checkpoints, that's a signal worth relaying to any client who assumes "the labs have this handled."
Top moves | Signal → impact
Shadow AI is outrunning security teams' visibility
New data from compliance platform Vanta, drawn from over 15,000 businesses, shows unauthorised AI tool use climbing sharply year-on-year, with a separate industry survey finding close to half of workers admit sharing sensitive data with free AI tools their employer never approved. → This is the business case for consolidating onto one governed workspace rather than writing a policy nobody reads – see this week's Deep Dive.
Microsoft is fielding specialised cyber-defence agents to fight AI-powered attacks
Part of a broader wave this week of hyperscalers building agent-versus-agent security tooling as attack automation accelerates. → Ask any security vendor pitching your firm whether their defence is agentic too; a human analyst reviewing logs once a day is no longer a match for an attacker automating in real time.
Amazon became the largest company in Fortune's Global 500
While confirming plans to spend roughly $200 billion on AI infrastructure in 2026, part of a projected $700 billion in hyperscaler capital spending this year. → The AI cost base underneath every tool you buy is still climbing; don't assume this year's per-seat pricing holds when you renew next year.
Maker note | What I built this week
This week I tested the tool I keep getting asked about when clients say "we know people are using ChatGPT, Otter and Grammarly, we just don't know what's going into any of them." I set up AnythingLLM as a genuine replacement for all three, configured it properly, then tried to break my own setup.
Decision: local is a configuration choice, not a default – you have to deliberately point both the model and the vector store at a local engine or it'll happily call out to the cloud. The app also phones home with anonymous telemetry unless you switch it off. Neither is a dealbreaker, but both are exactly the kind of setting a firm would miss if they demoed this once and rolled it out without checking. The real governance win wasn't the AI – it was ending up with one workspace and one audit trail instead of three vendor logins nobody's reviewing.
Upskilling spotlight | Learn this week
Vanta's Trust Signals report on shadow AI
First in a new data series drawn from 15,000+ businesses' identity-provider data; outcome: a benchmark for how your own vendor sprawl compares before you present a governance business case internally.
NIST's AI Risk Management Framework
A practical structure for how to govern, map, measure and manage AI risk, referenced repeatedly this week as the baseline most mid-market firms still lack. Outcome: a checklist to compare against your current (or absent) AI policy.
Operator’s picks | Tools to try
LM Studio
Use for: The same job with a more visual, point-and-click interface if your team isn't comfortable with a command line.
Caveat: Slightly heavier footprint than Ollama for the same models.
Vanta
Use for: Discovering which unapproved AI tools are already running inside your firm by connecting to your identity provider, no agent install required.
Standout: This week's Trust Signals data came straight from its own customer base.
Deep dive | Thesis & Playbook
One Workspace, One Audit Trail: What Actually Fixes Shadow AI
Nearly half of workers admit using AI tools at work without approval, and new identity-provider data this week shows the gap between what's running and what security teams can see is widening, not closing. Most firms respond by banning tools or writing a policy nobody reads. Neither works, because the underlying problem is convenience: ChatGPT, Otter and Grammarly are simply faster than asking IT for something approved. This week's test looked at whether a single local-first workspace can remove that convenience gap instead of just prohibiting it.
On paper
AnythingLLM (Mintplex Labs, free and open-source) bundles a meeting assistant, on-device dictation, predictive autocomplete and a screen-context agent into one desktop app, positioned as a direct replacement for Otter/Fireflies, SuperWhisper/WhisprFlow and Grammarly respectively.
On first launch it scans your hardware and recommends a local model sized to the machine – no parameter counts or model-hunting required.
A Model Router lets you set rules for what stays local (routine drafting, internal notes) versus what's allowed to escalate to a cloud model such as GPT or Claude for genuinely hard reasoning tasks.
It connects natively to Gmail, Outlook and Google Calendar, and to any tool speaking the Model Context Protocol, so it sits in front of the stack you already have rather than replacing it.
In practice
Local is a setting, not a default: AnythingLLM can just as easily point at OpenAI, Anthropic or a cloud vector store. It's only genuinely private once you deliberately select the built-in engine, or a local backend like Ollama or LM Studio, for both the model and the vector database.
It collects anonymous telemetry by default – no document content, just usage patterns – but it is a network call, and needs switching off in Settings for a genuinely offline posture.
The screen-context agent, Beacon, has full access to your agent skills, MCP connections and tools, live, anywhere your cursor is – a meaningfully larger control surface than three separate browser tabs, even though it's one you configure rather than three you can only accept the terms of.
The Magic Features (dictation, autocomplete, Beacon) are Windows and macOS only today; the Meeting Assistant wants a minimum of 16GB of RAM – check fleet specs before promising this to the whole floor.
Issues/backlash
Pricing is genuinely confusing across three separate products: the desktop app is free under an open licence, Magic Features are free with a daily cap removable via a paid key, and AnythingLLM Cloud is an entirely separate hosted product for multi-user teams – search for pricing and you'll likely land on the wrong one.
Beacon's cross-application reach is a legitimate governance question, not a settled one: giving one agent tool access across the entire operating system needs a deliberate decision, not a default rollout.
This week's OpenAI incident is a reminder that "the vendor tested it" is not the same as "it's governed" – the same logic that argues for reviewing AnythingLLM's defaults applies to every agentic tool your firm already trusts.
My take (what to do)
Startup (15-40 staff): Roll this out to one partner or team lead first, not the whole floor. Set the Model Router rule (client-confidential data never leaves the building) and switch off telemetry before anyone else touches it – that's a 15-minute job, and it's the difference between a private tool and a demo that quietly isn't.
SMB (50-120 staff): Standardise the Model Router rules centrally rather than letting each team configure its own – define once what's safe to automate (internal notes, first drafts) versus what needs a human approval gate (any proposed follow-up action), and check RAM specs across the fleet before promising the Meeting Assistant to everyone.
Enterprise (150-250 staff): The genuine governance win here is one audit trail instead of three vendor logins – build the business case around that, not the AI features. Treat Beacon's OS-wide tool access as something requiring the same sign-off as any other agent with standing credentials, and confirm which of the three AnythingLLM products (desktop, Magic Pro, Cloud) you're actually procuring before it reaches finance.
How to try (15-minute path)
Download AnythingLLM, let it recommend a local model for your machine, and open Settings > Privacy to switch off telemetry. (5 min)
Set one Model Router rule: anything tagged client-confidential stays local, never routes to a cloud model. (5 min)
Success metric: you can name, in one sentence, what happens to a piece of sensitive text you paste in – and show it to a partner without hedging.
"It wasn't so much as a breach as the front door was left open."
Spotlight tool | Ollama
Purpose: A local LLM runtime that AnythingLLM (and most other local-first tools) can point to for a genuinely offline model and vector-store setup. Edge: one-command model installs and a fast-growing library of open-weight models.
→ Runs entirely on your own hardware, no cloud call required
→ Pairs directly with AnythingLLM's Model Router as the local backend
→ Works identically across the fleet regardless of which chip marketing your laptops shipped with
Try it: ollama.com
What did you think of today's issue?
Did you find it useful? Or have questions? Please drop me a note., I respond to all emails. Simply reply to the newsletter or email [email protected].
This issue’s sponsor
n8n
An open‑source automation platform that lets you chain tools like DeepSeek, OpenAI, Gemini and your existing SaaS into real business workflows without paying per step. Ideal as the backbone for your first serious AI automations.
Refer and win
Share this newsletter for a chance to win!