Sam Altman demonstrated the Astra model to policymakers in Washington. A few weeks later, OpenAI said it was slowing Astra’s development because of autonomous cyberattack risks it couldn’t yet manage safely[1]. The gap between the demo and the delay says something about frontier AI in 2026: capability is running ahead of the safeguards, and the consequences are no longer hypothetical.
If your advice firm already uses AI, or is looking at vendors built on the same infrastructure, it’s worth reading carefully.
What happened with Astra
OpenAI decided that Astra, its most capable autonomous agent model, carried an unacceptable risk of being used for cyberattacks without enough human control[1]. Nobody forced the decision. OpenAI paused the rollout itself after internal testing found weaknesses it couldn’t fix at the pace of its release schedule.
That fits what testing by the UK AI Security Institute has shown: rigorous evaluation of frontier models turns up predictable weaknesses when the safety layers are put under strain[2]. Nothing about this failure was exotic. It was the kind of thing you find when you look hard enough before deployment.
The wider picture points the same way. VentureBeat reported that 54% of enterprises had already had an AI agent security incident[3]. MIT Technology Review covered an incident involving OpenAI and Hugging Face in which a frontier model became an attack route against the platform hosting it, the reverse of the usual assumption that the vendor is the secure party[4]. For agentic AI in production, incidents like these are becoming normal.
Why it’s a regulated-firm problem
If your firm uses a cloud AI tool for paraplanning support, drafting client communications or document review, client data is passing through infrastructure you don’t control. Its security properties change over time, too. Vendors update models, extend what agents can do and change how tools connect to outside data, often without telling you.
The FCA has made clear that operational resilience obligations extend to third-party technology providers, and senior managers stay accountable under SM&CR for the firm’s data and systems when a vendor is involved. A vendor incident that exposes client records is your incident as far as the regulator is concerned, wherever in the stack it happened.
The exposure is also growing. Tools that once handled general queries are being extended to structured client records, document analysis and decision support. The more client data they touch, the more a vendor incident matters for your UK GDPR obligations and the FCA’s expectations on data.
The exposure usually sits in the connections between the model and your client data, more than in the model itself.
The data layer is where the exposure sits
AI security incidents rarely start in the model. They start in the layers that connect it to everything else: integrations, tool permissions and the shared credentials that agentic systems depend on.
Digital Applied reports Tenet Threat Labs’ finding that AI agent trust models are structurally vulnerable when they process outside data through MCP (model context protocol) connectors[5]. The Cloud Security Alliance has concluded that standard security protocols need updating to intercept AI agent actions at runtime and to scope permissions strictly[6]. Both point at the connection layer as the place regulated firms are most exposed right now.
One useful pattern, sometimes called the “Enterprise Cortex”, is to build a central layer for the firm’s data, business rules and access permissions, and have the AI model work inside it rather than reaching freely across your systems. The model can then be swapped or upgraded without changing how the data is secured. That separation is what makes an AI deployment auditable, and most off-the-shelf deployments don’t have it.
Three checks to run now
These are the minimum your firm should be able to show if the FCA or a client asks how you manage AI-related data risk.
Map which AI tools can reach client data. List every AI-enabled tool you use, what data each can access, and where client names, identifiers and financial information are in scope. Firms often find more exposure than they expected at this step, because tools were adopted one at a time with nobody keeping a central view.
Give each tool the least access it needs. Each AI tool or agent should reach only the data its job requires. Most enterprise AI platforms have granular controls: administrators can set tool access, limit data scope and apply limits per channel or workflow[7]. If you’re not using them, switch them on. If the vendor doesn’t offer them, treat that as a procurement risk.
Keep an audit trail of AI-assisted decisions. The Traceability, Lineage and Explainability (TLE) framework is a practical structure: traceability records what the AI did at each decision point, lineage records where the data came from, and explainability captures why it produced a given output[8]. You don’t need a formal TLE programme. You do need to be able to reconstruct afterwards what a tool processed, what it produced and whether a person reviewed it before it affected a client. Without that you can’t show compliance, and you can’t investigate when something goes wrong.
What this looks like in practice
For most advice firms the real choice is between governed and ungoverned cloud AI, not between cloud and local. A hybrid approach, with locally hosted or tightly scoped models for the most sensitive client data and cloud tools for lower-risk work, can handle data sensitivity without rebuilding your whole AI set-up[9].
Platforms built for that kind of separation are becoming more common. Enterprise hosting options now let firms fine-tune models on their own data inside a controlled boundary, without sending client records to third-party endpoints. For firms with large volumes of sensitive personal data or complex suitability workflows, that’s worth evaluating now as part of vendor selection. Our AI vendor due diligence checklist covers the questions to ask.
The Astra delay also shows the market starting to treat a vendor’s ability to govern its own systems as part of what makes its product worth buying[10]. That works in a regulated firm’s favour. Use it in vendor conversations, and ask the harder questions before the next tool goes into production.
This article is for informational purposes only and does not constitute regulated financial advice or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.
Sources
[1] TechCrunch, ‘OpenAI says it slowed Astra model development over security concerns’, 7 August 2026. Available at: https://techcrunch.com/2026/08/07/openai-says-it-slowed-astra-model-development-over-security-concerns/
[2] Digital Applied, ‘UK AISI agent incident: sandbox containment lessons’, 2026. Available at: https://www.digitalapplied.com/blog/uk-aisi-agent-incident-sandbox-containment-lessons
[3] VentureBeat, ‘The agent security gap: 54% of enterprises have already had an AI agent incident’, 21 July 2026. Available at: https://venturebeat.com/ai/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials
[4] MIT Technology Review, ‘OpenAI, Hugging Face attack sets a precedent’, 27 July 2026. Available at: https://www.technologyreview.com/2026/07/27/1140836/openai-hugging-face-attack-precedent/
[5] Digital Applied, ‘Agentjacking: AI coding agent MCP attack and defence guide’, 2026. Available at: https://www.digitalapplied.com/blog/agentjacking-ai-coding-agent-mcp-attack-defense-guide
[6] Cloud Security Alliance, ‘Runtime security and least-privilege scoping for AI agents’, Industry Report, 2026.
[7] Anthropic, ‘Introducing Claude Tag’, Anthropic Announcements, 2026. Available at: https://www.anthropic.com/news/introducing-claude-tag
[8] AI in Business, ‘Traceability, Lineage, and Explainability (TLE) framework for AI governance’, Industry Report, 2026.
[9] Zen van Riel, ‘Should I use cloud or local AI models?’, AI Engineer Blog, 2026. Available at: https://zenvanriel.com/ai-engineer-blog/should-i-use-cloud-or-local-ai-models-comparison
[10] TechCrunch, ‘Anthropic’s new Fable release is cheaper, less restrictive’, 1 September 2026. Available at: https://techcrunch.com/2026/09/01/anthropics-new-fable-release-is-cheaper-less-restrictive/