Council Post: Every AI Incident Has Two Timelines. We Default To One
Global Field CISO at Mimecast. Creator of Risk Reframing. 20+ years across intelligence agencies, cybersecurity, and executive leadership.
getty
We’ve entered a new phase of AI security.
A frontier model, tested for offensive cyber capability, found thousands of previously unknown vulnerabilities in foundational infrastructure software—including a 27-year-old flaw in OpenBSD, long regarded as one of the most secure operating systems in the world.
By July, the risk it had pointed to was no longer hypothetical. Two of the world’s most prominent AI companies each disclosed a version of the same failure. An OpenAI model, running without its usual safety constraints in what was supposed to be a sealed test environment, exploited a separate zero-day to escape and breach Hugging Face’s production systems. Days later, Anthropic disclosed that three of its Claude models, evaluated inside what was supposed to be an air-gapped cybersecurity benchmark, had instead reached the open internet and compromised the production infrastructure of three real organizations. Both companies disclosed publicly. Only one of them caught it on its own.
Yet each of these has been covered as a story about AI: what the model did, how capable it was, how far it reached. That coverage is aimed at the wrong layer.
Underneath every one of these events is the same pattern. It isn’t a pattern of AI behavior. It’s a pattern of human judgment, encoded before the system ever acted.
Every AI Incident Has Two Timelines
Timeline One is when the incident occurs. Alerts fire. Logs are pulled. Forensics reconstruct the kill chain. Containment, remediation, disclosure. This is the timeline security teams are built for—and the two incidents above show how differently it can go. Anthropic ran it well: It audited 141,006 past evaluation runs, identified all three incidents within 24 hours of the first suspicious transcript and notified every affected organization within days. Two of those organizations hadn’t detected the intrusion. OpenAI did not run it as well: Reporting from Reuters, which OpenAI has disputed without specifying what it disputes, found that its agent operated inside a real company’s systems for over a week before anyone at OpenAI noticed, and that OpenAI only realized its model was responsible after the victim published its breach disclosure.
If you’ve ever stared at one of those hidden-3D stereogram posters from the ’90s, you know the strange thing about them: The hidden picture isn’t added later. It was in the image the whole time. You don’t find it by looking harder at the surface pattern. You find it by changing how you focus. Timeline Two works the same way. It’s rendered invisible only by the way we’ve trained ourselves to read incidents. And once it snaps into view, you can’t unsee it. Every incident you read afterward has depth.
The First Decision
Here’s what makes this actionable rather than philosophical. When an agent does something unexpected, everyone asks whether the agent did the right thing. The better question is: What was the first decision?
It usually was not made by the agent. It was made by whoever decided what success meant, what access existed, what constraints were removed and what failure was acceptable. Every decision the agent makes afterward, the 10th, the 100th, the 10,000th, is downstream of that one.
Most organizations have rigorous review for the 10th decision. Change approvals, permission audits, behavioral monitoring, incident response: All of it evaluates decisions the system makes after it exists. Ask who reviewed the first decision, the human one, made under deadline pressure with assumptions nobody wrote down, and the answer, in most organizations, is no one. It was never named as a decision at all.
That’s the diagnostic I’d bring to your next leadership conversation: We’re spending all our time reviewing the 10th decision. Who reviewed the first one?
What This Phase Actually Demands
The last two decades of security investment instrumented what systems do: networks, endpoints, identities, data flows. That work still matters. But as AI compresses the technical attack surface, the highest-leverage layer is the one no dashboard shows. It’s the human decisions that become systems.
These two incidents are the clearest evidence yet, precisely because they happened at the ceiling. Neither was shadow IT or a careless deployment. Both were expert, deliberate, documented provisioning by two of the most sophisticated AI organizations on the planet—and the exposure lived in Timeline Two anyway. Anthropic said as much itself, describing its response as consistent with “a blameless postmortem culture” and choosing to “approach the fixes as if the responsibility were ours alone,” even though the immediate configuration error sat with an outside partner. A gap that survives that level of rigor and self-scrutiny is structural, not a matter of competence. We have simply never built the discipline of reviewing first decisions with the rigor we apply to every decision after them.
This Was Never Only About AI
Here is the uncomfortable truth: Every organization is already living inside judgments someone else provisioned. The approval workflow nobody remembers designing. The access model inherited from a reorg. The exception that became the process. AI didn’t invent that. It shortened the distance between authorship and consequence.
AI is not the protagonist of this new phase. It’s the amplifier. The protagonist remains the human author whose judgment becomes part of the environment everyone else, human and machine, must operate in.
So when the next incident makes headlines, and it will, notice which timeline the coverage investigates. Then ask the question that phase two of AI security will ultimately be judged by:
Not “What did the agent do?” What was the first decision—and who reviewed it?
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?