AI CHANGE DESK | EP007: SECURITY WORKFLOW CONTROL CONTRACT

If your AI can find a vulnerability, draft a patch, and open a PR, your biggest risk is no longer detection quality.

Your biggest risk is workflow ownership:

• who can analyze,

• who can approve,

• who can merge,

• who can pause,

• and who can attest the execution chain under pressure.

This episode translates four current signals into one operational playbook for next week.

WHAT CHANGED THIS WEEK

1. OpenAI launched Codex Security in research preview (2026-03-06).

2. Anthropic + Mozilla published concrete AI-assisted vulnerability workflow details (2026-03-06), including CVD and exploit-analysis references.

3. NIST published AI 800-4 on monitoring deployed AI systems (2026-03-06).

4. OpenAI launched  ...