Weekly Signal · November 13, 2026

Photo: Chondryma · CC BY-SA 4.0

November 13, 2026: Trust, permission and the cost of getting it wrong

Week ending November 13, 2026 · Rob Tyrie · Ironstone Advisory

This issue opens with my November 8 field note, preserved in full, followed by five new readings from the past week. The older incidents in the note remain dated background. Sources checked November 13.

When Trust Becomes the Attack Surface

Rob Tyrie | Ironstone Advisory | November 8, 2026

It reads like the beginning of a James Bond story. A fictitious company recruits an engineer. There are interviews, credible faces, a coding assignment. Somewhere else, billions disappear. Across Europe, supermarket refrigerators warm up. In Cambodia, criminals deploy AI agents against financial organisations.

Except this is the news. And the connection deserves more attention than any individual headline.

On October 29, Binance suffered a theft affecting approximately US$6.34 billion in digital assets. The FBI attributes it to North Korea. FBI attribution Binance’s initial investigation describes an engineer persuaded to download a malicious recruitment assignment onto a work computer. The attackers subsequently used an internal AI tool to reach other engineers’ machines, obtained deployment credentials and accessed wallet-signing operations. Binance initial findings

Look at the sequence. Manufacture credibility. Compromise a person’s judgement. Establish access. Borrow the authority of somebody trusted. Move towards the money.

The internal AI tool was reportedly a route through Binance’s environment. That does not establish that an autonomous AI planned the robbery. But it does raise an uncomfortable question: what authority have we quietly attached to our helpful tools?

Microsoft’s November 6 report supplies another piece. A Cambodia-based criminal group, Storm-3358, is using ARTEX, an agentic AI framework, to target financial organisations. Microsoft observed scanning, exploitation and installation of remote-access malware. It describes agents using compromised systems and credentials to accelerate movement, privilege escalation and data theft. Microsoft investigation

This is documented intrusion activity, not a disclosed total of money stolen from banks. Nor does operating from Cambodia establish Cambodian state sponsorship.

Still, the implication is serious. The interval between finding an opening and exploiting the next one is contracting. Our response processes have to work inside that interval.

Then there are the refrigerators. A fresh wave of attacks on November 2 disrupted cooling systems across European countries. Food spoiled. Businesses lost stock. Censys describes exposed refrigeration controllers and previously disclosed vulnerabilities. Attribution remains unresolved. Censys findings

You do not need artificial intelligence to exploit a neglected control system. Sometimes yesterday’s password is quite enough. The damage, however, leaves the computer and enters the shop.

The WordPress connection needs precision too. October’s critical PHP flaws affected the software beneath many websites. WordPress urged owners to update PHP. Websites taken offline as a precaution were not necessarily hacked. OpenAI says AI-assisted researchers helped discover the vulnerabilities. Here, AI also served the defenders. OpenAI disclosure WordPress advisory

Different incidents. Different mechanisms. A common problem: connections and permissions extend further than our understanding of their consequences.

The cost includes stolen balances, interrupted services, exhausted staff and customers wondering whether the next reassuring voice belongs to their bank or to somebody emptying their account.

We have seen state-backed financial crime before. US authorities linked North Korean hackers to the US$81 million Bangladesh Bank theft in 2016. US Department of Justice The FBI attributed the US$1.5 billion Bybit theft in 2025 to North Korea. FBI Bybit advisory This is a recurring method of extracting wealth, with criminal prosecution struggling to reach the people behind it.

I have experienced the smaller, personal version. A caller posing as my bank wanted to investigate a suspicious Amazon transaction. They knew enough about me to sound credible. When they pushed further and could not establish who they were, I stopped.

My bank responded immediately. We secured accounts, dealt with transactions occurring within minutes and replaced the affected card. Embarrassing? Yes. I have spent years around enterprise security. Knowing the theory does not remove you from the experiment.

My rule is simple: challenge inbound. Email, SMS, telephone. Knowing my details does not establish your identity. I reconnect through a channel I already trust.

Institutions need the equivalent discipline. Patch systems. Restrict remote access. Separate critical operations. Limit credentials and revoke them quickly. Require independent authorisation for consequential actions. A compromised workstation should not inherit the keys to everything.

And give customers help. Banks, insurers, Amazon, Walmart: protective agents should become part of the relationship. With consent, they could notice unusual amounts, vendors, locations and behaviour, then challenge a transaction through an authenticated channel.

I already use narrowly scoped agents to read information, flag discrepancies, send me messages and write logs. They cannot act on my accounts. That authority remains mine.

Think of prescribed antibiotics supporting an immune system. A specific intervention, bounded authority, monitored effects. The prescription matters.

We also need verifiable identities for institutions and their agents, explicit permissions and records we can inspect. Trust should be demonstrable and revocable.

The signal is the shrinking distance between persuasion, access and consequence. We need defences that close that distance faster.

Preferably before the refrigerator joins the plot.

Draft developed with AI assistance from my dictated discussion and the linked reporting.

Source-check note, November 13: the refrigeration paragraph is also supported by November 2 reporting with statements from affected retailers. Censys distinguishes the October and November attack waves; exposure counts are not counts of compromised stores.

Five connected readings: November 7 to 13

Permission has become part of the product. Who can act, under whose authority, in which country, and with whose money? This week's new reporting puts those questions into the same conversation. Start with the consent button. Follow it all the way to the balance sheet.

1. A genuine consent screen can still approve the wrong thing

Proofpoint's November 9 BluePhishing research demonstrates how a malicious third-party agent blueprint could gain access through consent in Microsoft Entra. Agent identities can inherit permissions from that blueprint. The researchers describe a proof of concept and say they have not identified activity in the wild. Keep that distinction.

The uncomfortable bit is the apparently normal act of approval. A familiar interface can make a consequential grant of authority feel like installing a useful accessory. For a professional-services firm connecting agentic systems to client records, review who can approve blueprints, what permissions propagate and which events reach the audit log. Test removal and recovery before deployment. A system that asks permission still needs somebody who understands the question.

Read Proofpoint's November 9 research and defensive guidance

2. Australia wants safety claims that can be checked

Australia's November 10 announcement proposes mandatory safety and security standards for frontier AI companies operating there, backed by a dedicated regulator. The proposed requirements include risk management, independent evaluation, incident reporting and published safety frameworks. Legislation and further details are still to come. This is a policy proposal, not an already-operating compliance regime.

For enterprise buyers, the useful move is to ask for evidence now: evaluations relevant to the work, a named incident contact and a contract that explains what happens when the service changes. Political permission and product architecture meet in procurement. Canadian firms selling internationally should watch the scope and definitions as legislation develops, especially where a model supplier's obligation ends and the implementer's responsibility begins.

Read Australia's November 10 policy announcement

3. Six thousand building blocks still need an organisation

IBM and Microsoft announced Imagine Enterprise on November 10, describing a platform with more than 6,000 prebuilt agents and assets and an initial focus that includes financial services, insurance and retail. That number combines agents and assets. It is not evidence of 6,000 independently validated production outcomes. The announcement is the suppliers' account of the offering.

I pay attention when software and consulting arrive together. There is work to do between a catalogue and a functioning operation: design the roles, connect the records, set the permissions, train people and measure what the customer actually receives. For a services leader, choose one repeatable engagement and establish its delivery cost and result before buying the whole promise. Watch what survives contact with an ordinary Tuesday.

Read IBM and Microsoft's November 10 announcement

4. The cloud's address is becoming a market-access decision

A November 10 techUK report argues that European cloud-sovereignty rules should recognise trusted partners and technical safeguards, rather than rely on ownership restrictions. It models potential UK economic losses if UK providers are excluded from higher sovereignty tiers under proposed European rules. This is an industry body's scenario and advocacy, not a measured loss or a final EU decision.

There is a practical problem underneath the lobbying. A customer can like your software and still be unable to buy the way you deliver it. Map data location, operational control, key custody, subcontractors and the jurisdictions that can compel access. Then compare that design with the customer's actual procurement rules. Go-to-market starts inside the architecture. The word sovereign on a slide settles very little.

Read techUK's November 10 report and its stated assumptions

5. Follow the financing back to the customer

In a November 10 speech, Federal Reserve Vice Chair for Supervision Michelle Bowman examined risks around financing the AI buildout. She highlighted complex funding arrangements, investments linking suppliers and customers, and exposure reaching banks, insurers and other investors. She also described the banking system as well capitalised. These are her supervisory observations, not a prediction that an AI collapse is inevitable.

The connection matters to an insurer twice: as a buyer of technology and as a holder of invested assets. For a software founder, it matters through customer budgets and supplier durability. Stress-test the operating plan against slower revenue, more expensive finance and delayed infrastructure. Ask who absorbs the loss if expected demand arrives late. Somebody eventually has to pay for the computational juice.

Read Bowman's November 10 speech

What connects them

The permission to act. The evidence behind the claim. The ability to keep delivering when the assumptions change. Those run through all five stories, from a consent screen to a regulator, a services engagement, an international contract and a financing arrangement.

For the next agentic-systems project, put these on one page:

• The customer result and the evidence that would demonstrate it.

• The authority each person, agent and supplier receives, and how it can be withdrawn.

• The legal, financial and operational dependencies that could interrupt delivery.

Then use the Creation Model: Ideate, Think, Make, Do, Judge, Decide, Execute, Archive. Keep the record of what happened. Trust should survive inspection. Preferably before the invoice.

Explore Rob's Substack for deeper writing and subscription options. Browse the Weekly Signal Archive.

AI-assisted research and drafting using Rob Tyrie's editorial brief and writing fingerprint. Business analysis, not investment or legal advice.