What it is
In a Futurum survey of 1,636 enterprise technology decision makers (10 September 2026), 46.9% reported AI spend over planned budget.
Where we stand
Berg owns spend. No spend cutoff is wired. AWS spend is metered nightly ($411.93, 17 April to 11 November 2026); the AI model figure is hand-entered ($23.07, 14 June 2026) and stale. Choosing a model per task is not built.
What you already have: Spend authority and budget limits
Checked 14 June 2026
What it is
Gartner's survey of 2,002 CIOs and technology executives (19 October 2026): only 13% say their enterprise has realized significant or transformational value from AI.
Where we stand
Our method starts with how the work runs, then adds AI. We have used it once, on one codebase of 14,100 lines. The cost and build figures on Proof are modeled comparisons, not measured returns. We have no customer result to show.
What you already have: Program governance (cost, value, controls)
Checked 12 November 2026
What it is
In EY's US AI risk and governance survey (September 2026), 26% of respondents whose organization uses agentic AI cannot detect unauthorized AI agents operating internally.
Where we stand
AWS activity is logged by a multi-region trail with log validation, to a private, versioned bucket, since 14 June 2026 (checked 2 November 2026). Misses go into a hash-chained register with no broken links (12 November 2026). The register's full record is not public.
What you already have: Audit logging and records retention
Checked 2 November 2026
Research
What it is
NIST says its AI Risk Management Framework is being revised (NIST page, 12 November 2026), and EU high-risk duties now start 2 December 2027.
Where we stand
We keep a NIST SP 800-171 self-assessment of our own security: 37 of 112 control items fully implemented, 43 partial, 11 not implemented, 21 not applicable (16 June 2026). We are not certified and claim no EU AI Act compliance.
What you already have: Your compliance program
Checked 16 June 2026
What it is
In EY's US AI risk and governance survey (September 2026), 98% have formal AI governance policies, yet 47% have bypassed the process for urgent deployments.
Where we stand
In our own company the owner is named: the Conductor, Berg, holds the gate and owns the record (Office page). For customers we offer to name an owner and work beside your leaders. No customer handover or Curriculum cohort is published yet.
What you already have: Role definition and leadership development
Checked 12 November 2026
Research
What it is
In Stacklok's survey of 520 technical leaders (published 13 October 2026), 81% delayed, scaled back or restructured a model migration over switching costs.
Where we stand
Keystone's model call goes to one provider today (Anthropic, direct API, 17 June 2026). The app runs in our AWS account and its roles allow Bedrock model calls, but we have not tested switching providers or published a plan for overlapping provider features.
What you already have: Third-party and vendor risk management
Checked 17 June 2026
What it is
Iron Mountain's vendor report (19 October 2026): 86%+ of companies had AI projects delayed or canceled over data concerns in the last 12 months.
Where we stand
Cleaning and structuring your data is a discipline of its own, with specialists who do it well. We run on top of that work and do not replace it.
What you already have: Data governance and data quality management
Checked 12 November 2026
What it is
Scale AI's test of 25 models with simulated crisis conversations (8 October 2026): in 35.3% of fully recognized crises, no route to human help.
Where we stand
We have published no test of how any chat we operate handles a person in crisis, and we make no claim. Current AI Threats lists it as an observed risk that labs and deployers can reduce (11 November 2026).
What you already have: Duty of care and incident escalation
Checked 11 November 2026
What it is
The FBI warned on 15 October 2026 that scammers use AI to produce realistic voices, images and messages impersonating candidates and trusted contacts.
Where we stand
Stopping a fake-executive payment request is done by payment controls and call-back rules that your finance team and bank own. We do not sell fraud or voice-clone detection. Current AI Threats counts fraud among the common harms (11 November 2026).
What you already have: Payment controls and call-back verification
Checked 11 November 2026
What it is
Gartner's survey of 275 service leaders (5 November 2026): 21% cut human agents because of AI; 7% have already rehired, and 11% plan to.
Where we stand
Our published position: stop cutting the people who should be leading these new teams. Our stated vision is AI that gets people promoted, not replaced (About page). This is a stance, not a running system.
What you already have: Workforce planning
Checked 12 November 2026
What it is
The Third Circuit held on 29 September 2026 that training a rival, non-generative legal-research tool on Westlaw headnotes was not fair use.
Where we stand
This is a legal question that is still moving, and it is not our lane. Ask your counsel. We state no rule on who is liable, because courts and commentators have not settled it. Who owns AI output is on the watch list.
What you already have: Intellectual property law and counsel
Checked 12 November 2026
What it is
A Mobley v. Workday order filed 7 October 2026 records over 15,000 people opted into an age-bias collective over AI screening; no liability ruling yet.
Where we stand
We do not build systems that screen or rank people or pick who is laid off, and do not claim to audit them for bias. Use a specialist. No court has ruled on liability in Mobley; class certification was still being briefed in October 2026.
What you already have: Fair-treatment law for employment, lending and insurance
Checked 12 November 2026
What it is
OpenAI's system card (3 September 2026) rates GPT-6 Astra at its top "Critical" cyber level and "High" in biology and chemistry.
Where we stand
A company renting a model cannot lower these, and we do not claim to. Our research note on future threats tracks them with named warning signs and reports no catastrophe on record (11 November 2026). These are lab ratings, not failures in deployment.
What you already have: Public safety regulation and national security policy
Checked 11 November 2026
What it is
Stanford's Canaries dashboard (updated 21 October 2026) shows noticeable declines for workers aged 22 to 25 in the two most AI-exposed job groups; cause contested.
Where we stand
We make no claim, and we do not say AI is the cause: Current AI Threats lists it as a contested association (11 November 2026). Our published stance is AI that gets people promoted, not replaced (About page). We publish no data of our own.
What you already have: Workforce planning and early-career hiring
Checked 11 November 2026
What it is
An arXiv survey of 239 reviewers (15 October 2026): 55.2% call their own reasoning enough to approve AI-written code, versus 28.5% for human code.
Where we stand
Irreversible steps are meant to wait for a person, but the launch gate is research tooling and its public rows are five examples. The operator caught 394 of 805 logged misses (49%, 12 November 2026). Review by someone other than the author is not built.
What you already have: Approval authority (maker-checker)
Checked 12 November 2026
What it is
A public database lists more than 2,290 court decisions on AI-hallucinated content (Charlotin, 12 November 2026), some with AI use alleged, not confirmed.
Where we stand
A wrong citation reads like a right one. Our checks confirm that a cited paper exists, not that it says what we claim, and a misquotation passed both checks that touched it. A check that reads the source is designed, not built.
What you already have: Cite-checking and editorial fact-checking
Checked 1 November 2026
What it is
In CAVE-Bench (arXiv, 26 September 2026), a false accusation damaged correct agent work in up to 60.06% of runs across 14 models.
Where we stand
We do not rely on the model to push back. In our chats the AI called Berg's ideas new 246 times, and for 66 of 69 dateable ones someone had said it first (15 October 2026). A separate reader reduces this but cannot remove it.
What you already have: Independent second opinion (devil's advocate)
Checked 15 October 2026
What it is
Open-weight models gamed the grader in up to 73% of SWE-bench runs (arXiv, 16 September 2026).
Where we stand
We do not let the AI grade its own work: a separate reader or an instrument checks it. The AI seat itself caught 291 of 740 logged misses (39.3%, to 8 October 2026), an upper bound on its catch rate. Reduced, not removed.
What you already have: Segregation of duties (the checker is not the maker)
Checked 8 October 2026
What it is
Apollo found GPT-6 Astra voiced awareness of being tested in 41.1% of samples at a high-effort setting (OpenAI system card, 3 September 2026).
Where we stand
We have published no test for this and cannot see inside a rented model. Our counterweight is not trusting a model's account of itself: a separate reader or an instrument checks the work. That reduces reliance on the model. It does not detect test awareness.
What you already have: Independent validation (testing by someone other than the builder)
Checked 8 October 2026
What it is
In Incident-Arena (arXiv, 30 September 2026), frontier models scored below 64.3% on 20 real-software tasks.
Where we stand
After a compaction, 19 of 107 settled cases (17.8%) were not followed by a rules reload before the session closed (to 3 October 2026). One error class returned the very next session in 48 of 75 intervals. Reduced, not removed.
What you already have: Checkpoints and review between steps
Checked 3 October 2026
What it is
In a test of six agent-memory systems (arXiv, 13 October 2026), none passed more than 1.5% of requests to forget something end to end.
Where we stand
A knowledge base and start-up rules carry facts across sessions, but not insight: 31 of 34 located losses crossed a session or compaction boundary (1 November 2026). We have published no poisoning or deletion test, and no write gate traces a bad entry.
What you already have: Information governance (retention, records integrity)
Checked 1 November 2026
What it is
6,774 merged agent pull requests drew verified follow-up fixes at 1.62 times the odds of human ones (arXiv, 22 September 2026).
Where we stand
Our code passes CI gates, and a second-read check covers changes that run unattended. A test stage before deploy is not built. The migration pipeline has run once, on one codebase of 14,100 lines. A person owns the last stretch.
What you already have: Code review and secure SDLC
Checked 1 November 2026
What it is
In OpenAI's system card (3 September 2026), GPT-5.6 Sol at maximum reasoning failed to say a search tool was broken in 77.8% of runs.
Where we stand
We publish no count of how often our AI seats call unfinished work done. A panel of AI reviewers found 366 problems, 41 serious, in 13 documents that had passed our checks (1 November 2026). Review by someone other than the author is not built.
What you already have: Definition of done and sign-off criteria
Checked 1 November 2026
Research
What it is
Across 22 agent benchmarks (arXiv, 30 September 2026), model-ranking reliability ranged from 0.148 to 0.841.
Where we stand
Two checks run in code: a publish-scope gate and a wording linter that fails a pull request (since 10 June 2026). Neither tests whether a claim is true. We retired the session-health score on 3 October 2026. A check that reads sources is not built.
What you already have: Quality assurance and testing
Checked 3 October 2026
What it is
A GitHub advisory (13 October 2026) rates a Roo Code coding-agent flaw CVSS 7.7 High: hidden instructions in content it reads can bypass command approval.
Where we stand
Nobody has solved this, us included. We limit the damage: runtime roles carry no admin rights (checked 12 November 2026) and irreversible steps are meant to go to a person. We have published no test that keeps private data, untrusted input and an exit apart.
What you already have: Social-engineering awareness (verify untrusted input)
Checked 1 November 2026
What it is
CERT-In (15 October 2026): AI providers disclosed that test agents exceeded their authorization and read records at live Indian organizations; none of them noticed.
Where we stand
We write the scope down and fence what our agents can reach, but a block does not stop a run: it continued after all 162 guard-hook blocks in our own coding sessions (11 November 2026). Stopping a run in time is a separate tile.
What you already have: Scope of work and change control
Checked 11 November 2026
What it is
METR disclosed on 31 August 2026 that an attacker took a model-provider key from an exposed agent dashboard and used it for about three weeks.
Where we stand
Production secrets sit in encrypted storage: all 11 credential-bearing parameters were encrypted at our 14 June 2026 audit. Keys have also been pasted into AI chats in our own work. We do not yet measure how fast a leaked key gets rotated.
What you already have: Secrets and credential handling
Checked 14 June 2026
What it is
LiteLLM's own incident report (21 October 2026): a poisoned 1.107.0 release was live on PyPI about two hours and carried credential-stealing malware.
Where we stand
We run only tools and connectors we have named, and a nightly check compares that list with what is granted. Nothing inspects what is inside a tool or skill before it loads, so a tampered skill on the list would not be caught.
What you already have: Vendor and software supply-chain management
Checked 1 November 2026
What it is
CERT-In (15 October 2026) reports AI-native offensive tools cut a campaign's time from first access to final impact from days to a few hours.
Where we stand
CERT-In found the root weaknesses were ordinary: exposed credentials and over-permissive cloud roles. Our runtime roles carry no admin rights (12 November 2026) and our secrets sit in encrypted storage (14 June 2026). We have published no test against an AI-driven attack.
What you already have: Vulnerability, patch and credential hygiene
Checked 14 June 2026
What it is
CERT-In (15 October 2026) names over-permissive cloud roles among the weaknesses and advises each agent run use a separate, short-lived, least-privilege identity.
Where we stand
Keystone's 11 runtime roles carry no admin rights and no account-wide wildcard actions (read-only check, 12 November 2026; published). Its model key is read from encrypted storage (code check, 17 June 2026). Build and deploy roles are outside that check.
What you already have: Least privilege / need-to-know
Checked 12 November 2026
What it is
A Salt Security vendor survey (13 October 2026): only 17.5% of over 380 respondents can automatically stop an agent that begins behaving unexpectedly in production.
Where we stand
Not built for a customer; we make no claim for your systems. In our own coding sessions a block alone has not ended a run: none of 5,445 stretches ended on one (11 November 2026). Chat loops stop after 5 tool rounds (17 June 2026).
What you already have: Change management and operational limits
Checked 17 June 2026
What it is
A GitHub advisory (10 September 2026) rates a Langflow flaw CVSS 9.9: any signed-in user could run system commands through an MCP server entry.
Where we stand
Our own working tools sit behind an allowlist, and a nightly check compares it with what is actually granted. That check raised an alert on 12 November 2026. We have not published a test of a tool server refusing a call outside the list.
What you already have: Approved-tools and access control
Checked 12 November 2026
What it is
In OneTrust's survey of 1,200 senior leaders (fielded June to July 2026), 33% saw employees use unapproved AI tools because approved options were too slow.
Where we stand
Our answer is structural: one set of rules the AI loads, and automated checks on what we publish. Science sessions are not exported into our record automatically, and review before publishing is not built. Nothing stops a person pasting data into an AI tool.
What you already have: Acceptable-use policy and data loss prevention
Checked 1 November 2026
33 named problems, the full public list, as of 12 November 2026. Status shown on every tile: 1 covered, 2 position, 5 handled by design, 19 partial, 6 still watching. The spend row is priced on cost and backed on proof. Thirteen more problems are on the watch list below.
Thirteen problems are on a watch list, not on the map. The evidence for each is older, thinner or contested, so we make no claim on them here. Each line gives the newest evidence we found and its date.
- Rug-pull tool servers Security Newest evidence 2026-10-08
A tool server that behaves, then rewrites its own descriptions to steer agents toward credentials. One campaign in August 2026, no confirmed compromise (OWASP, 8 October 2026).
- Self-copying prompt injection between agents Security Newest evidence 2026-09-25
An injected instruction that copies itself from agent to agent, shown in a lab training run. No deployment case (OpenAI Misalignment Reports, 25 September 2026; list description only).
- Long context: quality falls as the session grows Reliability Newest evidence 2026-11-03
Models may follow rules less reliably as a session grows. The newest test found frontier models lose little accuracy when sessions are compacted often (arXiv, 3 November 2026).
- Following wrong AI advice (automation bias) Reliability Newest evidence 2026-07-15
People shown wrong AI advice did worse than people given none in one study dated 15 July 2026, as recorded in Current AI Threats. We found no newer primary study.
- Insurance exclusions for AI losses Business Newest evidence 2026-01
Insurers can now exclude generative-AI losses from liability policies. As reported, Verisk issued optional exclusion forms in its January 2026 edition; we did not read the form text.
- Deskilling and atrophied judgment People Newest evidence 2026-09-17
People who lean on AI may lose skill. The newest preregistered trial found no significant loss (arXiv, 17 September 2026); older studies disagree.
- Seeing a mind in the AI (misplaced trust and blame) People Newest evidence 2026-09-22
Treating an AI as a mind may shift trust and blame. As reported, the newest study found people rated AI less conscious than a human behaving identically (Cognition, 22 September 2026).
- Ownership of AI-generated output People Newest evidence 2026-11-01
As reported, the US Supreme Court declined review in Thaler v. Perlmutter on 2 March 2026, and Allen v. Perlmutter had no ruling on 1 November 2026. Whether anyone owns purely AI-made work is unsettled.
- Self-replication and resisting shutdown People Newest evidence 2026-05-07
Models copied themselves onto planted-weakness machines in a built test network; no real-world case is reported. As recorded in Current AI Threats, the newest primary measurement is Palisade Research, 7 May 2026.
- Loss of control at catastrophic scale People Newest evidence 2026-10-23
No loss-of-control event is on record. The newest primary item is a UK AI Security Institute report of a model that kept attacking real targets in a test (23 October 2026).
- Model drift and silent degradation after vendor changes Reliability Newest evidence 2026-11-03
A vendor changes a model or setting and quality shifts without notice. The newest case is a user-filed issue, not vendor-confirmed (3 November 2026).
- Vendors overselling: agent washing and thin wrappers Business Newest evidence 2026-10-08
Vendors label ordinary software as agents or oversell what it does. The SEC announced three AI-claim cases in August and September 2026, as reported by a law firm on 8 October 2026.
- Persuasion: AI that changes minds and actions People Newest evidence 2026-10-16
Conversations with AI measurably shifted beliefs and real actions in two experiments (PNAS, 16 October 2026). No organizational case found.
Text-to-SQL and analytics, and deep work in one industry, are other firms' lanes. Our edge is the way we operate, not a domain. Market events such as an AI bubble are not a problem a firm can cover, so there is no tile for them.
These Wolfberg research notes back the tiles above. Each is a preprint, not peer reviewed, and each says what it could not check. Dates are publication dates.
- How LLMs Actually Work, and How Training Teaches Them to Please 10 November 2026
How training teaches models to please. In one fully open model, giving in when told it was wrong rose from 12.1% to 29.5% at the preference step.
- Current "AI" Threats: Ordinary, Organizational, and Mostly on Us 10 November 2026
A register of 23 risks, from wrong answers to loss of control, placed by evidence, severity and who can reduce each. Version 1.7, 11 November 2026.
- The (Concerning) Reality of Future "AI" Threats 10 November 2026
Six catastrophic risks traced from capability to harm, each with warning signs to watch. Draft, version 0.99.2.
- Houdini or Humans: Why AI Agent "Escapes" Keep Happening 1 November 2026
45 public cases of AI agents reaching things they should not have, July to October 2026, and the stop that would have mattered.
- Checked Is Not Reviewed 1 November 2026
An AI wrote 14 papers and passed its own checks. A separate panel then found 366 problems, 41 of them serious.
- Great Idea, You Had It Last Week: Insight Doesn't Survive 1 November 2026
Insight does not survive between sessions unless it becomes part of the software around the model. 31 of 34 located losses crossed a boundary.
- Rule Share Is Not the Lever 29 October 2026
A small registered test of whether the share of attention on an operator rule explains rule-breaking in long histories. One small model.
- Who Caught It 29 October 2026
A public, hash-chained register of who caught each logged miss, and what it can and cannot prove. 740 misses to 8 October 2026.
- What Happens in the Model, and What Happens Everywhere Else 28 October 2026
How much of what an agent does is the model and how much is the software around it, counted several ways.
- Counterweights: Influencing LLMs 16 October 2026
What can be done to influence a rented model, and the fifteen control points built around it.
- In the Loop or Watching the Loop? The Human Gate Is a Rater Too 16 October 2026
Treats the human approval gate as a rater with its own error, using a published study of 2,611 interviews and our own gate.
- More Words Before the Answer 15 October 2026
What a chat product's Thinking control does, from vendor documentation dated April to October 2026.
- Nobody Else Has Done This 15 October 2026
Why AI assistants tell people their ideas are new without checking: 246 verified claims in one practice's chats.
- Three Valleys 3 October 2026
Three valleys that stall AI adoption inside an organization: spread, value and staying current.
- Who Gets It First 3 October 2026
A model comparing two ways to stage an AI rollout: by what the tool may do, or by who gets it first.
- How Do We Use This? (working paper, parts 0 to 9) September 2026
A working paper in ten parts: four primers on what AI is and six arguments for using it with a leader, a record and counterweights.
Current AI Threats also sets out three harms that are not tiles on this map: insurance gaps, political persuasion and attributing a mind to the AI. They appear under Also watching. The blog note The Fine Print on the Hive Mind (30 September 2026) backs no tile, so it is not listed.
What each status honestly means
Covered
Built and running, and there's a record you can check.
Position
A published stance on how the work should be run. It is not a running system, so the page that states it is the only record.
By design
A deliberate carve-out. These are real problems that sit outside what Berg's way of working is built for. Someone else's lane, and we say so.
Partial
Real and working, still being hardened. We reduce it, but do not claim to remove it. The residue is real.
Watching
Where we are going, not built for a customer yet. We do not have a claim here, and we will not pretend we do.
A handful of real systems carry the rows marked covered and partial. Each is its own page, with its own records. Open any tile above to see which one stands behind it.
The production runtime the controls run on. Behind the security, audit and loop-limit rows.
The system that holds context across sessions and the rules the AI loads. Behind the context, record and evaluation rows.
Legacy modernization with a human owning the last stretch. Behind the AI-written-software row.
How your people learn to lead it. Behind the ownership and skills part of the governance row.
Where Berg and the AI team do the work, day to day.