The worm brought its own model
How we organise
Visa to Acquire BioCatch (Visa)
Visa has signed an agreement to buy BioCatch for $2.4 billion in cash. BioCatch reads thousands of signals while somebody uses a bank. Keystrokes, touch gestures, how a device is held. From those signals it separates a customer from an attacker while the session is still running, across 760 million users at more than 350 banks. Andrew Torre, a president at Visa, gives the reason. Account takeovers and scams cost the world over $1 trillion a year, and AI runs those attacks at a scale nobody has seen.
Finance: Visa has attached a price to proof. The price is $2.4 billion. What it buys is a way to tell who is acting from how they act. A typed secret proves a person only while secrets stay expensive to steal. That condition has gone. Every system in your organisation that still treats a typed secret as proof depends on that condition. Most organisations cannot say how many such systems they hold, because nobody asks the question in those words. We ask it early, and the number always surprises the security team.
Count the systems where the only thing between an attacker and a payment is a typed secret. That count is the number of places where a secret still stands as proof.
How we build
Context Engineering for AI Agents (To Data & Beyond)
Context engineering is the work of deciding what a model sees at each step of an agent’s run. The candidates are many. Instructions, history, retrieved documents, tool outputs and the agent’s own notes all compete for the same space. Fitting them inside a token budget is the easy part. The hard part is deciding what to keep outside the context, what to select back into the context, what to compress, and what to isolate until the agent needs it. Four failures get names: poisoning, distraction, confusion and clash. Each failure gets worse as an agent runs longer, uses more tools and holds state between sessions. A larger context fixes none of them. Duplicated and irrelevant material makes it harder for the model to find what matters.
Architecture: the context is either something a person designed or whatever happened to accumulate. In most organisations it is the second. Nobody owns it. That matters, because the context is where your policies, your data and your instructions reach the model. An agent that reads the wrong document at step forty has not suffered a model failure. It has followed a design nobody made. We now ask who owns the context before asking which model sits behind it.
Take one agent you run. Write down what enters its context at the fortieth step. If nobody can answer without reading the code, the answer is whatever accumulated.
How we assure
AI Agents Enable Adaptive Computer Worms (Guan, Blanchard, Foerster, Jia, Huang and Papernot)
A worm is malware that copies itself from one machine to the next with nobody driving it. WannaCry used a fixed exploit. Patching that exploit stopped it. Researchers at Toronto, the Vector Institute, Cambridge and ServiceNow have built a worm that writes its exploit when it meets each machine. It runs an open-weight model published in 2025, which fits on a single A100 with 80GB of memory. They did not finetune it. The test network held 33 machines running a spread of Linux versions, Windows Server and IoT devices. The worm exploited 73.8 per cent of that network and copied itself to 61.8 per cent. One run reached seven generations. The worm takes its compute from the machines it has already taken, so the attacker’s cost per new infection is zero. It needs no commercial AI platform, so controls such as service refusals and rate limits are structurally irrelevant.
Security: every control that sits at a vendor’s API counts for nothing here. That covers a large part of what has been bought in two years under the heading of AI safety. The controls that still work sit inside your own network. They are patching, segmentation, and knowing which machines can run a model at all. The paper’s appendix lists the hardware that qualifies, and the list runs from datacentre accelerators down to a workstation card. That hardware already sits in ordinary organisations, bought for other work. It rarely appears on the same list as the servers.
Ask for a list of every machine on your network carrying a GPU with 80GB or more of memory. Time how long the list takes. That number measures your control over the compute an attacker would use.