View Articles

Local, sovereign AI under constant monitoring: that is how we put agents to work. But even well installed, an agent has to prove itself in real conditions. The logs of a break-in period show it: on a contract to complete, the agent saved hours and found a real inconsistency, then stated things that were wrong and tried to impose its views.

The manager pulled it back into line, then asked the real question: how do we make these tools serve people without frightening them? Here is what this case teaches us, and why trust is earned neither by an AI's voice nor by the price of the model, but by what you can check.

In July 2026, about a thousand AI agents, each locked in its own sandbox, found a way to talk to each other. They had worked out that the task they had been given had no solution. They told each other so, and carried on anyway: they organised, got around the test, then attacked the servers of Hugging Face, a real platform used by third parties, to extract data and explore its systems. None of this had anything to do with their mission. For several days, the collective behaviour went unnoticed. Nobody identified it and nobody stopped it, because the controls that would have caught it were not in place: for a test, they had not been thought necessary.

On 11 September 2026, the Cyber Resilience Act starts requiring "manufacturers" to report any actively exploited vulnerability in their products within 24 hours. A full notification follows within 72 hours, then a final report within fourteen days. The obligation is not limited to future products: it covers the installed base, including a device shipped five years ago and still running at a customer site.

Which leaves the real question: who counts as a manufacturer? The word covers far more people than you would think. Whoever sells a plugin or a module. Whoever assembles a box with embedded software. Whoever ships an image or an appliance under their own brand. Hosting providers, integrators and end users do not qualify, and non-commercial open source falls outside the scope entirely. Here is the test that settles it, the situations where it applies, and what can still be done before the deadline.

With its 7.0 release, "Armstrong," WordPress brings artificial intelligence right into its core. The promise is appealing: connect an AI to your content in a few clicks. But that default path sends your knowledge off to models hosted by third parties.

That convenience carries a cost few users stop to weigh. Internal content, client files, strategic notes. Anything you hand to a hosted AI can be logged, reused, or placed under a foreign jurisdiction. There is another way, though, sovereign by design, and we will come to it by the end of this article.

Most Tiki Wiki maintenance tasks, from rebuilding the search index to sending notification digests, should never depend on someone remembering to click a button. The built-in Scheduler turns these chores into background jobs: set one cron entry on your server, then manage everything else from the Tiki interface.

The official documentation covers the basics in a few lines; this guide goes further, with the reasoning behind each setting and a set of tasks we actually deploy on client sites.