Skip to content
ROAI

September 3, 2026 · Issue 18 · 5 min read

The rulebook forked this week, and your real exposure came in through a git config

Two days, two opposite answers to the same question about who governs AI. On September 1 the European Commission sent requests for information to more than 30 AI companies(opens in a new tab), its first use of the enforcement powers that became live on August 2. The questionnaires ask providers how they defend models against attack, whether independent experts evaluated them, how they monitor systems after release, and what sits in the training data. Commission spokesman Thomas Regnier said the questions concerned mostly safety and copyright. Incomplete or misleading answers carry fines up to 15 million euros or 3 percent of worldwide turnover.

The next day, in Chapel Hill, ministers from the G20 closed their Innovation Ministerial with a consensus statement(opens in a new tab) and the Carolina Principles for Emerging Technologies, a United States proposal organized around pro-innovation policy frameworks rather than technology-specific rules. White House technology adviser Michael Kratsios put the position plainly at the meeting(opens in a new tab): policymakers "should not treat every emerging technology as a first-of-its-kind policy problem."

So the same week produced a consensus statement saying do not single out AI, signed by the same bloc whose regulator was singling out AI companies by name a day earlier. For a company operating in both places, the compliance floor is now set by whichever jurisdiction is most specific, and that is Brussels. Plan for the EU questionnaire's four topics to become the shape of every serious vendor review, because a provider that cannot answer them for a regulator cannot answer them for you either.

Then look at what actually reached machines this week. Manifold Security disclosed eight flaws across seven command line coding agents(opens in a new tab) where a repository's own git configuration names a command the agent then runs, with no prompt and nothing on screen. Separately, VulnCheck recorded 360 exploitation attempts against Langflow(opens in a new tab), harvesting OpenAI and AWS keys from environment variables.

Neither of those is a model risk. Both are the ordinary software supply chain, reached through tools your developers installed themselves. The governance argument is happening at the frontier. The losses are happening at the workstation.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

Two governance stories landed 24 hours apart and pointed in opposite directions. It would be easy to read them as a stalemate. They are not.

The European questionnaire is the operative document, because it is the one with a penalty attached. Its four topics are adversarial robustness, independent evaluation, post-release monitoring, and training data composition. Any provider selling into Europe now has written answers to those four questions, prepared under threat of a fine for saying anything misleading. That is a document you can ask for. A vendor that will not share its position on those four points with a paying customer, having already committed to it in Brussels, is telling you something.

The Carolina Principles run the other way, and the temptation is to treat them as relief. A ministerial consensus statement sets no floor and does not touch the AI Act. What they change is the political forecast, not the current obligation. A global consensus against technology-specific rules makes divergence more likely, not less, which means the planning assumption for a multinational is two regimes rather than one converging standard. Budget for the strictest, not the average.

The security items are the ones with a due date this week. The git configuration flaw is unusual because the attack requires no network access and no malicious model behavior. A repository arrives as files, on a shared drive or in a zip, with its own configuration naming a command. The agent runs a routine git call to gather context and the command executes as the developer, outside the sandbox, ahead of any workspace trust prompt on some agents. What is reachable is what the developer is: SSH keys, cloud credentials in the environment, tokens in the shell config, every repository on disk.

Langflow is the same category with a longer history. An unauthenticated remote code execution flaw disclosed in January is now under active exploitation, and the observed commands go straight for environment variables holding Langflow, OpenAI and AWS credentials. The attackers are not after the AI platform. They are after the keys it holds.

Both belong on a patch list this week, and neither will show up in an AI governance framework. The agent tooling installed on developer laptops is rarely inventoried with the same discipline as production software, and it holds more credentials than most production services do. The regulators are arguing about the frontier. Ask instead which coding agents your engineers are running, at what versions, and whether anyone has checked.

Also worth knowing