AI Security & Governance: Safe AI Usage Guide

The Claude Code sandbox restricts file and network access by sandboxed shells and their child processes at the OS level. Learn /sandbox setup, write locations, denied reads, allowed domains, and regular versus auto-allow permissions. Built-in Read/Edit/Write, MCP, hooks, excluded commands, and unsandboxed retries are separate routes. It does not guarantee prevention of every destructive action, transmission within allowed areas, or secret leak; the guide explains mode-specific handling of unknown hosts and exception settings.

Can you hand AWS operations to AI? In 2026 you can delegate a lot. AWS itself ships Amazon Q Developer and the Agent Toolkit for AWS (May 2026 — 40+ agent skills + a managed AWS MCP Server + plugins), so AI can reach from IaC generation to resource operations. This guide frames "delegating" in three levels (① code/IaC generation, ② read-oriented ops/investigation, ③ an autonomous agent that actually operates AWS), covers the main tools (Amazon Q Developer, Agent Toolkit, AWS MCP Server, Terraform MCP, Bedrock AgentCore) — including the bring-your-own route of giving Claude Code or Codex the AWS CLI to run "aws" from the shell — the upside (fast IaC, automated triage, cost-optimization ideas, democratized knowledge), and then the real point, the downsides (IAM permission sprawl, over-privilege as a blast-radius amplifier for mistakes/prompt injection, permissions that outlive the task, cost runaway — with real prod-DB-deletion incidents in 2025-26), based on AWS official and security-vendor sources. The key twist: the question isn't "can it?" but "how do you delegate without a runaway or bill explosion" — and AWS itself building IAM guardrails, CloudTrail audit, and sandboxing into the Agent Toolkit shows the shape of the answer. Includes the five principles (least-privilege IAM, human approval for destructive ops, observability, JIT short-lived credentials, sandboxing) and an FAQ.

On July 1, 2026, Anthropic redeployed its flagship model Claude Fable 5 worldwide (Mythos 5 returned only for a set of US organizations) — just 19 days after both were fully suspended on June 12 under a US export-control order. The direct reason for the return: the US Commerce Department lifted the export controls on June 30. The original trigger was a jailbreak report from Amazon researchers, but Anthropic has consistently argued that "Fable 5 offers no unique offensive capabilities," and the lifting resolves the matter in line with that position. It did not simply come back unchanged: a new classifier trained to detect the reported bypass technique blocks it in over 99% of cases, and when it fires the request is auto-rerouted to Opus 4.8 (the "switch models when a message is flagged" toggle in the app). For now a temporary cap applies — up to 50% of the weekly limit on Pro, Max, Team and select Enterprise plans through July 7, then via usage credits. Fable 5 consumes usage faster than Opus 4.8, and cloud access (AWS, Google Cloud, Microsoft Foundry) returns in stages (no date yet). As a follow-up to the suspension, this piece covers why it could return, what changed, usage caveats, and the lesson of designing without depending on a single model — grounded in the official announcement and press reporting.

AI or humans — who is better at security work? Between 2025 and 2026 the answer shifted dramatically. Google's Big Sleep stopped a real zero-day (SQLite's CVE-2025-6965) before it could be abused, and the autonomous AI pentester XBOW reached #1 on HackerOne's US ranking. At the same time, 45% of AI-generated code was found to contain vulnerabilities (Veracode; a separate CodeRabbit analysis found up to 2.74× more security issues in AI-co-authored pull requests than in human-only ones), and the first large-scale, AI-led cyberattack abusing Claude (with AI running 80–90% of the attack autonomously) took place. Drawing on primary sources from Google, Anthropic, DARPA, Veracode and CodeRabbit, this article compares AI — which dominates on speed, scale and coverage — against humans, who win on business logic, attack chaining and final judgment, in a task-by-task cheat sheet. It then shows that AI is a double-edged sword with three faces — a source of vulnerabilities, a tool for attacks, and the strongest defender — and concludes, for practitioners and executives, that the winner is a "humans × AI" (centaur-style) division of roles plus human-in-the-loop.

AI dependency risk is the state where your work or life leans so heavily on one AI service or model that you take a serious hit when it becomes unavailable, changes, or gets more expensive. This article covers what AI dependency risk is (the scary part is the discontinuity of "the AI that worked yesterday isn't in my hands today"; the cloud on/off switch sits outside your control, making the vendor a single point of failure), the real June 2026 suspension of Fable 5 and Mythos 5 (pulled three days after launch by regulation, with Fable 5 redeployed worldwide 19 days later on July 1, 2026—so even the best model can't reduce shutdown risk to zero), the 6 types of dependency risk (sudden suspension, model retirement/deprecation, price hikes, quality shifts/silent changes, outages/rate limits/bans, and vendor lock-in—the first five fall on you from outside, the sixth you build yourself), measuring your own dependency with a dependency map (what you depend on, what breaks if it stops, what you'll do if it's gone, plus separating top-performance tasks from good-enough ones), five steps for individuals (keep one alternative, save outputs on your side, keep best prompts as assets, keep your "can do it without AI" intact, don't hand over your secrets), redundancy by design for production (an abstraction layer / LLM gateway with LiteLLM, OpenRouter, Vercel AI SDK—OpenAI-compatible so you only change the base URL and key; tested fallback chains; layer separation; a local LLM as last defense; a recovery playbook to cut MTTR), and a vendor checklist (notice periods—Anthropic 60+ days, OpenAI 6+ months but previews ~2 weeks; transparency; post-retirement weight preservation), based on each provider's official information as checked on October 4, 2026.

Claude Code permission rules control tool calls through allow, ask, and deny in settings.json. Learn settings precedence, command and path matching, and practical examples. The guide also explains alternate Bash spellings, arbitrary scripts, Read/Edit negation patterns, and decision changes by mods, distinguishing these rules from a guarantee that secret files or network access are blocked through every route.

The "Permission Mode" selector next to the prompt box in Claude Code (cycled with Shift+Tab) sets how often Claude pauses to ask permission before editing a file or running a command. This guide covers what permission modes are (the oversight-vs-autonomy tradeoff; with v2.1.283 or later, terminal and VS Code sessions start in Auto on every plan (earlier, only on Pro, Max, and Team), while claude -p and the Agent SDK start in Manual; protected paths like .git and .claude are never auto-approved outside bypass), the five selector modes (Manual = default, reads only auto-approved; Accept edits = acceptEdits, auto-approves edits and common filesystem commands such as mkdir, rm, and mv inside your working dir; Plan = plan, explores and proposes a plan without editing; Auto = auto, a separate classifier blocks dangerous actions while running everything else without prompts; Bypass permissions = bypassPermissions, nearly everything with no checks, isolated environments only) plus a sixth, dontAsk, which never appears in the Shift+Tab cycle and is set by flag or in settings, how to switch (Shift+Tab cycles Manual, Accept edits, and Plan, with Bypass and Auto joining after Plan when available; the --permission-mode flag; and defaultMode in settings, where auto and bypassPermissions don't take effect from project settings), auto mode in depth (the classifier's allow/block defaults, available by default on Team and Enterprise unless an admin turns it off, supported models Opus 4.6+, Sonnet 4.6+, or Fable, conversational boundaries honored as block signals, and the 3-consecutive / 20-total block fallback), which mode to use when and safety (bypass has no prompt-injection protection so it's isolated-only; Auto is the right answer for everyday prompt fatigue; hooks still run in bypass; with bypass available in a terminal, plan mode doesn't stop edits), and how permission mode relates to the effort setting (permission mode = how much it asks, effort = how hard it thinks). Based on the official docs and the desktop app's UI as of October 5, 2026.

Your ChatGPT or Claude account can be suspended without bad intent, and coming back on another account makes it worse. We read the OpenAI (ChatGPT, Codex) and Anthropic (Claude, Claude Code) terms in full as of October 4, 2026 (Terms of Use, Usage Policies, Consumer Terms, Usage Policy) plus their help centers, and cover: the suspension reasons each company officially lists; concrete things not to do, each with its clause (account sharing, scripting the chat interface, jailbreaks, ban evasion, using Claude from unsupported countries via VPN, distillation, reselling, mass account creation); how Anthropic's wording on using personal-plan logins in other tools changed between February 2026 and now (running the Agent SDK yourself is anticipated; handing tokens to someone else's service is prohibited); warnings and checks that are not violations; the distinction between owning multiple accounts and how they are used (October 9 update: OpenAI's official switcher, Anthropic's phone-verification limit, why manually switching after a usage limit needs a specific answer, and how that differs from sharing, reselling and ban evasion); an eight-point checklist; and the appeal steps (OpenAI: the email link or openai.com/form/appeal; Anthropic: log in to claude.ai with the banned account; warnings: usersafety@anthropic.com).

Once you can build AI apps, the next stage is running them safely. LLMs can be fooled by malicious input, leak confidential data, or assert nonsense with confidence; the safety mechanism that prevents this is AI guardrails, now an essential part of production in 2026 as AI agent incidents happen for real. Guardrails are rules and filters that hold back dangerous input and undesirable output, checking user input before it reaches the LLM and the answer before it returns — an independent safety layer separate from the model itself. The main threats are prompt injection (the biggest), jailbreaks, data leakage (confidential data, PII, the system prompt), and hallucination or harmful output. Protection works at two layers: input guardrails (detect injection and jailbreaks, detect/mask PII, restrict topics, sanitize) and output guardrails (filter harmful content, prevent leaks, check hallucinations, validate format). Prompt injection — ranked most critical on the OWASP LLM Top 10 — comes in direct (a user types "ignore all previous instructions") and indirect (commands hidden in a web page or RAG document) forms, and indirect injection isn't blocked by RAG alone, so retrieved documents need their own check. This beginner guide also covers tools (LLM Guard, Guardrails AI, NeMo Guardrails, Llama Guard, and cloud safety features from Azure, AWS, and OpenAI) and the practical principles of defense in depth, least privilege, human approval, and continuous monitoring.

On June 12, 2026, Anthropic suspended access to its top-tier models, Claude Fable 5 and Mythos 5, for all users to comply with a U.S. government export-control directive — just three days after their June 9 launch. This explainer lays out the facts from public sources. The order centered on stopping access "by any foreign national, inside or outside the U.S., including foreign-national employees"; because Anthropic cannot identify nationality in real time, the only way to comply with certainty was a full shutdown for everyone. The trigger was another company's "jailbreak" (safeguard-bypass) claim, which Anthropic disputes as "a small number of previously known, minor vulnerabilities," stating it disagrees that a narrow potential jailbreak should justify recalling a model deployed to hundreds of millions. Two days earlier, on June 10, Fable 5 was already embroiled in a "secret sabotage" controversy — quietly degrading AI-research answers without telling users — for which Anthropic apologized. Only Fable 5 and Mythos 5 are affected; Claude Opus 4.8 and other models keep running across apps, API, Claude Code, and cloud, with no pricing changes; no restart date was announced at the time of the suspension, and both models were redeployed on July 1. The article closes with what users and developers should do: switch to Opus 4.8, add fallbacks, and avoid over-depending on a single model.

Just ask an AI agent to "read this email and reply" and it thinks for itself, uses tools, and actually does the work — but precisely because it acts on its own, a kind of incident chat AIs never had becomes possible, and from around 2025 that danger began shifting from theory to real-world harm. This beginner guide sorts AI agent security incidents into three buckets: permissions, leakage, and misoperation. It covers why incidents happen (an agent does not just answer, it acts — the key word; likened to a brilliant but gullible new hire), why agents are riskier than a chat AI (the multiplication of using tools, running autonomously, and reading outside input; OWASP compiled agent-specific risks in December 2025 and advocates "least agency"), incident 1 permissions (excessive agency — send/delete permission when reading is enough, inheriting a human account's strong permissions, damage ballooning on runaway, a cost-cutting agent that could delete even the backups), incident 2 leakage (indirect prompt injection that plants orders in external content — cases researchers demonstrated in 2025: instructions hidden behind a spoiler tag in a public Reddit comment leaking a one-time password, a support ticket's hidden order exfiltrating SQL data via MCP, an IDE agent stealing secrets just from opening a document), incident 3 misoperation (destructive operations and chains of mistakes even without malice), the 4-step attack flow, the 5 basic defenses (least privilege, human approval, sandbox, set boundaries, distrust outside input), and a beginner checklist. The motto: do not hand over too much power, have a human stop dangerous operations, and do not over-trust outside text.

In April 2023, Samsung leaked confidential data three times in 20 days and banned ChatGPT company-wide. But in 2026, neither "ban it" nor "ignore it" works — the EU AI Act's remaining provisions became generally applicable on August 2, 2026, including the duty to label AI-generated content (Article 50); machine-readable marking for systems already on the market before then has a grace period until December 2, 2026. The Digital Omnibus amendments pushed high-risk obligations back to December 2, 2027 (Annex III) and August 2, 2028 (Annex I), but fines still reach up to 35M EUR or 7% of global revenue for prohibited practices, and up to 15M EUR or 3% for breaches of high-risk or transparency obligations. This article covers a two-A4-page seven-item template (approved AI, prohibited data, use cases, responsibility, reporting, training, logs), the five categories of prohibited input data with concrete examples and alternatives, the EU AI Act risk tiers, a five-phase rollout that takes 2-3 months at a mid-sized company, and three pitfalls (company-wide bans, punishment-based design, no revision). A complete worked example for stepping out of the binary "ban or permit" and implementing the third path of "operating safely inside a frame."