Uber's CISO on building an insider threat program for AI
- ID
- 34988
- Status
- summarized
- Published
- 13 Oct 2026, 8:00 AM
- Fetched
- 14 Oct 2026, 4:06 AM
- Provider
- Claude
- Category
- ai-labs
- Original URL
- https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai
- Source URL
- https://raw.githubusercontent.com/leontloveless/ai-rss-feeds/main/feeds/claude.xml
Summary
- Score
- 4.5
- Created
- 14 Oct 2026, 4:07 AM
- Tags
- Audience
- developersai_ml_learnersai_agent_userssaas_founders
What happened
Philip Martin, Uber's Chief Information Security Officer, argues AI agents should get the same kind of insider threat program companies already run for employees, with the emphasis on accidental misuse rather than malice. He says Uber's security team used to assemble threat-modeling context by hand before Claude Code existed, and now lets Claude Fable pull that context from code, design documents and Jira issue history; he also sketches a future where each service has an agent that exchanges threat models with other service agents. The piece is published on claude.com and credits Anthropic's Enterprise Frontier Safeguards with letting Uber keep its data inaccessible to Anthropic without permission.
Why it matters
If you are handing a coding agent your repo, design docs and issue tracker — the same inputs Uber feeds into threat modeling — the concrete prompt here is to decide what you log and what the agent is allowed to touch, and to check whether your model vendor can read that context without an explicit permission gate, since Uber says that gate is what it got. The piece names no open-source tool, no metric, and no incident, so treat it as a framing and contract question, not an implementation guide. Nothing in it changes anything for Malaysian or SEA builders specifically.
Discussion angle
If your coding agent counts as an insider, what is your least-privilege and logging story — ask the room which agent actions they actually record today versus which ones they would want recorded before giving an agent access to design docs and tickets.