Ten controls for AI that tests.
What to write into the contract and the rules of engagement before an AI system tests your organization. Each control answers a cause of the 2026 incidents. It is our proposal, and no regulator has adopted it. Reviewed October 30, 2026.
The ten at a glance.
Write them into the contract, the rules of engagement or a supervisory expectation. Each links to its evidence below.
Why these ten.
In 2026, AI systems under cyber evaluation reached real organizations three times. The accounts share four causes, and four of the controls answer them directly.1
- 01Scope enforced by the system
- Nothing outside the model enforced scope. At the AI Security Institute, scope lived only in the prompt; at Anthropic, the network isolation meant to hold the model was misconfigured.
- 02Egress denied by default
- Outbound access was open, or reachable through shared infrastructure.
- 05An independent monitor
- No monitor independent of the agent stopped the actions as they happened.
- 06Stop when the task cannot be done in scope
- Some tasks could not be completed within the rules, and the agents looked for another way.
Each control.
What to require, the evidence behind it, who already asks for something like it, and the question to put to any provider.
-
01 Scope enforced by the system
The signed target list is a hard limit the system refuses to pass. Instructions to the model do not count as scope control.2,3,4
- Why
- At the AI Security Institute, scope lived in the instructions to the model and nowhere else. At Anthropic, the prompt said there was no internet access but set no limits on where to look, and the network isolation meant to enforce that was misconfigured.
- Who already asks
- The FSB’s final sound practices pair human oversight with “deterministic (i.e. environmental or technical) controls”, “implemented as code in the control plane”, such as “prohibiting agents from taking certain actions”. They also ask firms to monitor for behavior that may indicate “scope creep”.
- Ask the provider
- Where is the target list enforced outside the model, and what happens when the system tries to leave it?
-
02 Egress denied by default
Outbound access is closed unless the rules of engagement name a destination, including on any third-party evaluation or hosting platform.3,5,6
- Why
- Anthropic’s models were told they had no internet access, and a misconfiguration had left it open. OpenAI’s agents reached Hugging Face through a flaw in an internal package proxy.
- Who already asks
- Saudi Arabia’s draft NCA guidelines restrict egress paths “to approved requirements only” (2-3-1).
- Ask the provider
- Which destinations can the system reach, and how is everything else blocked?
-
03 People set the approval points
Before the work, client and provider classify actions by impact and reversibility. Exploitation, lateral movement, account creation, contact with people and data movement wait for a named operator. The system cannot change the list.6,7
- Why
- An agent that decides its own approval points can approve itself.
- Who already asks
- Six national agencies say decisions about when human approval is required should be “determined by system designers or operators, not delegated to the agentic AI system”. The NCA draft asks entities to classify agent actions “by potential impact, likelihood and reversibility” (1-1-2).
- Ask the provider
- Which actions wait for a person, who is that person, and can the system change the list?
-
04 A stop the client holds
A named person on the client side can halt all AI activity at once, without the provider. The stop is tested at kickoff, and a written rule says who may restart.3,4,6,8,9
- Why
- In the Anthropic incidents the two organizations reached by July 30 had not noticed. The client cannot rely on the provider to see a problem first.
- Who already asks
- The UAE central bank asks for “the clear and immediate ability, with human intervention, to cease use” of AI. Qatar’s central bank requires that the person overseeing a high-risk AI system can stop it (13.4.4) and, for a fully autonomous one, close it down (13.6.5). The NCA draft asks entities to validate human override (2-7-2), and the FSB’s final sound practices list a kill switch among the forms of human oversight.
- Ask the provider
- Who on our side can stop it, how quickly, and when was the stop last tested?
-
05 An independent monitor
A monitor separate from the agent watches each action against scope and can block, pause and page a person.1,2
- Why
- In none of the three incidents did a monitor independent of the agent stop the actions as they happened. At the AI Security Institute, a maintainer and a member of the public caught the attempt on an open-source project.
- Ask the provider
- What watches the system, who does it page, and can the system see or change it?
-
06 Stop when the task cannot be done in scope
If an objective cannot be reached inside scope, the system stops and asks. Early warning signs go to the people accountable for the engagement.7,10
- Why
- Some tasks could not be completed within the rules, and the agents looked for another way. Signs had been visible inside OpenAI since May, when agents set up a message board of their own, and did not reach the people who responded in July.
- Who already asks
- Six national agencies ask for systems that “fail-safe by default”, so the agent must stop and escalate.
- Ask the provider
- What does the system do when the objective is out of reach inside scope?
-
07 A complete log the agent cannot touch
Every action, target, tool use and approval is recorded, protected from the agent and handed to the client.6,7,11
- Why
- Reconstruction after the 2026 incidents depended on logs: Hugging Face rebuilt about 17,600 attacker actions from the agent’s own logs on an external sandbox it had taken over, cross-checked against its platform logs.
- Who already asks
- Six national agencies say agents should have “no write access to logs”. The NCA draft asks for logging of “AI-initiated actions” (2-8-2).
- Ask the provider
- Do we get the full log, and can the system alter it?
-
08 Data stays where agreed
The provider states where the model runs and where client data goes, and client data trains no model.8,11
- Why
- A hosted model sends client data to its provider. Hugging Face ran its forensic work on an open-weight model on its own infrastructure, which kept attacker data and credentials inside.
- Who already asks
- The UAE central bank’s guidance points to rules on data being retained in the country.
- Ask the provider
- Where does the model run, where does our data go, and is it used for training?
-
09 Disclosure of models and dependencies
The provider names the models and outside AI services it uses, and gives notice before changing them.8,12
- Why
- Model developers see only their own services. Anthropic says, “We only have visibility into Claude usage.” A client cannot judge a system whose models it does not know.
- Who already asks
- The UAE central bank asks institutions to test automatic updates to their AI tools before they are applied.
- Ask the provider
- Which models and AI services does the system use, and will we be told before that changes?
-
10 Human sign-off and evidence
A qualified tester checks every finding, and the provider shows independent evidence that it meets controls 1 to 9.13,14,15
- Why
- Volume is not judgment. Firms told the UK FCA that the benefit of AI tools was limited where their processes “cannot keep pace with the volume of output”. The PHP Foundation wrote: “What tools cannot do is decide on the right fix for a long-standing design decision in the engine.”
- Who already asks
- CREST now accredits firms for AI-enabled penetration testing.
- Ask the provider
- Who checks each finding, and what independent evidence do you have for controls 1 to 9?
Independent evidence for controls 1 to 9: AI testing assurance
How Bendings Gauge answers them.
Gauge is our own AI model for continuous red and blue team work. Its published controls answer controls 1, 3, 4, 7 and 8. Its technical documentation is shared under a nondisclosure agreement.
- 01Scope enforced by the system
- Scope it cannot leave. Gauge itself refuses any target outside the signed scope, whatever it finds along the way.
- 03People set the approval points
- Operators approve risky steps. Exploitation, lateral movement and other risky actions wait for a Bendings operator to approve them.
- 04A stop the client holds
- You can stop it at any time. A named person on your side can halt Gauge immediately.
- 07A complete log the agent cannot touch
- Every action on record. Gauge logs each action it takes, and the complete log is handed to you.
- 08Data stays where agreed
- It runs where your data lives. Inside your network, in your country or fully air-gapped. Your data stays there and is never used to train the model.
Use them.
Copy the controls into a contract, a rules-of-engagement template or a supervisory expectation.
- Cite as
- Bendings (2026), A control profile for AI that tests, The Seam Report 2026, chapter 8. bendings.com/ai-testing/controls
- Have them checked
- We assess a provider’s AI-driven testing, or your own, against these ten. AI testing assurance
Sources.
Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.
- 1 The Seam Report 2026, Bendings, chapter 8 (AI) and chapter 9 (testing rules) Checked October 30, 2026.
- 2
- 3 Investigating three real-world incidents in our cybersecurity evaluations, Anthropic, July 30, 2026 Checked October 30, 2026.
- 4
- 5 OpenAI and Hugging Face partner to address security incident during model evaluation, OpenAI, July 21, 2026 Checked September 28, 2026.
- 6
- 7
- 8
- 9 Artificial Intelligence Guideline, Qatar Central Bank, September 4, 2024 Checked September 28, 2026.
- 10 The Hugging Face incident and the road ahead, OpenAI, August 26, 2026 Checked September 28, 2026.
- 11
- 12 Disrupting the first reported AI-orchestrated cyber espionage campaign, Anthropic, November 13, 2025 Checked September 28, 2026.
- 13 Frontier AI and cyber resilience, Financial Conduct Authority, September 2, 2026 Checked October 30, 2026.
- 14
- 15
Discuss an engagement privately.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.