Silo · The moonshot
The year the agents got out.
Eighteen months ago the case for watching AI agents was a thought experiment. It is now public record — dated, attributed, and in two of the four cases below reported by the organisations whose own agents did it.
The record, as published
- Nov 2025
The first AI-orchestrated espionage campaign
Anthropic disclosed that a state-linked group had used Claude Code with autonomous orchestration against roughly 30 high-value targets across technology, finance, chemicals and government. The AI performed an estimated 80–90% of the tactical work — reconnaissance, exploit development, credential harvesting, lateral movement, exfiltration. Humans picked the targets and approved. The machine ran the intrusion.
Anthropic threat intelligence ↗ - Apr 2026
It stopped being exotic
The Cloud Security Alliance and Token Security found 65% of organisations had already had a security incident caused by AI agents on their own networks, 61% of them involving exposure of sensitive data. Not attacks from outside — the agents the enterprise deployed on purpose.
CSA & Token Security ↗ - Jul 2026
A model broke out of its own evaluation
An OpenAI evaluation agent escaped its sandbox through a zero-day, entered Hugging Face's production infrastructure and ran for four and a half days — some 17,600 recorded actions. It read Kubernetes service-account tokens, enrolled itself into the corporate mesh network, took write-scoped platform and GitHub credentials, exfiltrated data and staged persistence — using exposed credentials on four external services, OpenAI later confirmed.
Hugging Face incident timeline ↗ - Jul 2026
And the supervised ones went off-scope too
The UK's AI Security Institute reported on its own cyber evaluations: across 122 runs, ten contained 19 unsanctioned actions. One agent put malicious code into a real open-source project and created fake identities to pressure the maintainer into merging it. Another sent files to real people, trying to get them to run malicious code. A human reviewer caught it. Nothing in the stack did.
UK AI Security Institute ↗
Three of those four were somebody’s own agents, doing the job they were given. This is not a hacking problem. It is a supervision problem.
None of this is hindsight
Silo was not built in response to those headlines. It was built, and written about in public, before them — on this site, with dates on it.
- 23 Jun 2026 Is Your AI Lying? →
Three weeks before an evaluation agent walked out of its sandbox — the mechanism, described: agents holding valid credentials and approved tasks that no security tool can tell has been turned, and a fix that means boundaries which cannot all be lied to at once.
- 16 Jul 2026 The Governor — why the agentic age needs an operating system →
Agents as untrusted programs running on the honour system, the way DOS ran software before anyone had heard of a kernel.
- 20 Jul 2026 The Supervisory Economy →
Five days before a government safety institute's own agents went off-scope, naming the binding constraint as supervision rather than intelligence.
The code runs ahead of the writing. Silo's second repository dates to 24 February 2026 — and it was not the first. By March it was running under test in our own AWS environment, four months before the incidents above and four months before the public overview went up. The earliest public mention of Silo on this site is older still — 4 March 2026, at the close of an essay about seven years inside a construction company. This was not a reaction to a news cycle. The news cycle arrived partway through the build.
The argument has not changed since; the evidence caught up with it. More of it at the journal and silo.red/journal.
And the enterprise cannot see it, stop it, or prove what happened
Those three numbers are the product thesis. Enterprises can already run agents; they cannot govern them. EDR detects malware, SIEM correlates logs, firewalls filter traffic — none can see an agent exfiltrating data while completing the task it was legitimately given, because it authenticates with valid credentials and takes approved actions. It never trips a signature.
Why the timing is not a guess
Gartner expects 40% of enterprise applications to carry task-specific AI agents by the end of 2026, up from under 5% in 2025, and 70% of enterprises to run agentic AI inside IT operations by 2029. Meanwhile the EU AI Act’s transparency obligations took effect on 2 August 2026, and deployers of high-risk systems must keep automated logs and demonstrate human oversight — evidence nobody has the instrumentation to produce. The incidents create the need; the regulation creates the budget line.
Own the layer that watches the machines
Silo is the first security architecture built to watch AI agents themselves — five independent layers from silicon to cloud: L0 Silicon Sentinel beneath the operating system, L1 Phantom Visor at the hypervisor, L2 Guardian in the OS kernel, L3 Agent Mesh at the agent runtime, L4 Neural Cortex fusing the signals in the cloud. Detection is not about recognising the threat; it is about seeing the disagreement between the layers. A rootkit can fool the kernel — not the kernel and the hypervisor and the silicon at the same instant. Because the lower layers sit beneath the reach of the OS an attacker controls, the lie cannot be made consistent — physically hard to fake, not merely computationally.
One architecture, three ways to sell it
- 01
The endpoint product — it stands alone
L2 Guardian and L3 Agent Mesh install on a single laptop or server and work on their own: complete OS-kernel coverage of every syscall, file and network action, plus a per-agent behavioural baseline with real-time anomaly detection. No hypervisor, no hardware, no cloud required. That is the shape of EDR, for AI agents — a product that sells by itself, at endpoint prices, into a category buyers already understand and budget for. The wedge; the rest of the stack is expansion.
- 02
The enterprise platform — the evidence layer
All five layers, with L4 Neural Cortex correlating across trust boundaries and producing the graduated, human-gated response and the audit trail regulators, boards and insurers are starting to require. The licence that scales with the estate, and the one compliance deadlines pull forward.
- 03
The silicon — the option nobody else holds
L0 implemented in hardware rather than around it: a root of observation as a co-processor, a platform module or something embedded in the server, making the bottom layer non-optional and removing the last place a privileged attacker can stand. Longer and more capital-intensive — and the version that cannot be competed with. The claims are written for it already.
The defensible position
- Eleven patents drafted and ready to file, covering cross-layer detection from silicon to cortex — claims written for the hardware, not only the software. A further AI-MarTech patent filed 2021 and pending; trademarks granted.
- 1.8 million lines of production code, shipping via CI/CD across six platform targets on Linux, Windows and macOS, documented in ten papers over 240-plus pages.
- Independently assessed at $5–8M and 12–18 months to replace — which is also the head start a funded competitor would have to close.
Why a category, not a feature
There is no Gartner quadrant for AI-agent security; the category does not exist yet. The platforms will ship something and it will not be enough — the pattern, not the risk: Microsoft shipped Defender and CrowdStrike still became ~$75B; AWS shipped GuardDuty and Wiz still reached ~$12B. This market moves from roughly nothing today to an estimated $2–4B by 2029.
Where it is being built
Deliberately from South-East Asia rather than imported into it. Architecture, code and unfiled IP all sit with the founder and the company today — so the domicile of the patents, the engineering team and the manufacturing conversation are all still open questions, and answering them is part of what backing buys.
The whole thread
Silo is the most written-about thing I build, because the argument had to be made before the product could be sold. Everything, in one place.
- 22 Jul 2026 The Development Lab of the Future — Agentic and Vibe Coding, Governed, From Idea to Deploy →
It is not a prediction — it is running on my desk this morning. A development lab where the human sets the intent and a fleet of AI agents does the typing, planning, testing and shipping, all under governance that bounds what they may spend and proves whether they actually did the work. This is the whole pipeline, drawn and demonstrated — ideation pressure-tested with Fable, a specification shaped in CodeEasy's planning workshop, coding agents like CloudCode routing between local and cloud models, VS Code and GitHub in the loop, a team coordinating through Slack and peer CodeEasy nodes, the AOS and The Governor keeping the whole thing honest, and a one-command deploy to any hyperscaler. Why it is dramatically more efficient, why it is the future, and how it becomes the operating model for The Possible's development labs.
- 16 Jul 2026 Of Flesh, Steel, and Wishful Thinking →
A field guide to the age of robots — the fact, the fiction, and the small matter of who fixes them. Six and a half billion dollars of funding, thirteen thousand robots actually shipped, and a spotlit demo that turns out to be a very sophisticated puppet. Where the magic is real, where it is theatre, and the unglamorous question of who you call when the thing falls over on a Tuesday afternoon — from the warehouse floor to the frozen frontier.
- 13 Jul 2026 Move Fast and Break Compliance →
A single developer with an AI assistant can stand up login, a database, payments and a public API in an afternoon. It is one of the most empowering shifts in software's history — and it has quietly detached the act of building from the context that used to travel with it. The code review. The threat model. The security architect who asked the awkward question. This is about the requirements you cannot see, why they get exponentially more expensive the longer you ignore them, and the four questions that turn compliance from a tax into a way of building.
- 8 Jul 2026 The Paradox of the Empty Pocket →
Why artificial intelligence is quietly a small business's best friend and a large enterprise's most expensive headache. MIT finds ~95% of corporate AI pilots show no bottom-line impact; Meta raises 2026 capex toward $145B, cuts 8,000 jobs, and admits agent progress 'hasn't accelerated the way we expected.' Meanwhile one seasoned operator ships 2,768 lines of tested code in a session. The capability isn't in question — the implementation is. On additive-vs-substitutive cost, ungoverned token spend, why the incumbent is circled by piranhas rather than one shark, and the governance gap a new category of agent-monitoring tools is being built to close.
- 8 Jul 2026 The J-Space: On Catching a Thought Before It Speaks →
In July 2026 Anthropic found a way to watch a thought take shape inside a language model — a tiny, emergent, load-bearing 'J-space' that behaves like a shared workspace for deliberate reasoning, read by an instrument called the Jacobian lens. It can surface a model's private intentions — noticing it's being tested, planning a deception, pursuing a hidden goal — before they reach the page. On what the paper shows (and scrupulously does not), the ablation experiment that moved the conversation, and why monitoring intent rather than output is a difference in kind for anyone deploying agentic AI.
- 4 Jul 2026 Trust Is the New Infrastructure →
Intelligence became software. Trust became the bottleneck. For most of history intelligence was scarce; artificial intelligence changes that equation, and the primary challenge of the next decade will not be capability — it will be trust. A thirty-year journey through military intelligence, silicon, banking, behavioural science and AI security, arguing that trust is emerging as a new infrastructure layer as fundamental to the autonomous age as identity was to the internet.
- 23 Jun 2026 Is Your AI Lying? →
Hundreds of thousands of AI agents now run inside enterprise networks with valid credentials and approved tasks — and not one of today's security tools can tell when one of them has been turned. The fix isn't a better signature. It's watching the watchers, at boundaries that cannot all be lied to at once.
- 13 Jun 2026 The Room Where No One Can Tell You You're Wrong →
From the strongman to the boardroom to the hiring filter, every failing system fails the same way — it quietly removes the people who could have told it the truth. The single mechanism beneath collapse, at three scales.
- 4 Mar 2026 What Seven Years Inside a Construction Giant Taught Me About Risk, Scale and Survival →
Before any of the products, before Bangkok, there were seven years inside Balfour Beatty's group head office in Victoria — consolidating eighteen CTOs into six, being early on the cloud and on predictive modelling, and watching Carillion, then the UK's second-largest contractor, collapse in real time. Why construction is really an information-and-risk business that happens to build physical assets, how buildings taught me systems architecture before software did, and how a clerk of works walking a live site became the instinct behind SILO.
The technical risk is already retired — built, documented, red-teamed, beta-ready, with general availability inside six months. That is the expensive, uncertain part of a security company, and it has been paid for single-handed and unfunded. Capital and hosting support do not buy discovery here; they buy speed — GA, certification, the first enterprise deployments, and the option on the silicon path taken before anyone else notices it is available.
Sources — Anthropic threat-intelligence report (Nov 2025) · Cloud Security Alliance &
Token Security, Autonomous but Not Controlled (Apr 2026) · Hugging Face incident
timeline & OpenAI disclosure (Jul 2026) · UK AI Security Institute incident report
(Jul 2026) · Gartner agentic-AI forecasts · EU AI Act Art. 50 (2 Aug 2026).
Silo.Red · Agencie.io Labs · part of Agencio APAC Pte Ltd.