Anthropic's Own Deputy CISO Says 'Zero Risk' Is the Wrong Target for Agentic AI

Organizations take an average of 67 days to contain an insider security incident, according to the Ponemon Institute’s 2026 report — a number Jason Clinton, Anthropic’s Deputy CISO, cites to make a specific point: the goal of agentic AI security was never zero risk, it’s making risk “legible and bounded.” Clinton lays out four questions any agent deployment should answer before it ships — what untrusted content it ingests, what it can act on and under whose identity, the blast radius if it’s compromised, and whether its actions are distinguishable from a human’s in the audit log — plus seven controls: IdP-sourced identity, connector allowlists, per-tool approval, sandboxing, egress allowlisting, telemetry, and an org-wide kill switch.

The credibility of the framework rests partly on Anthropic dogfooding it: as of July 2026, more than half of the pull-request code landing at the company is written by its own Claude-based coding system. Clinton’s warning is that rejecting agent deployment outright doesn’t eliminate the risk, it just pushes it into unsanctioned “shadow” adoption with zero monitoring.

That gap between sanctioned and shadow deployment shows up in BCG’s separate scaling research: only 5% of companies are genuinely “agent-first” today, even though 72% report some mix of production and pilot use, and Gartner predicts 40% of agentic projects will fail on poor data foundations. What disciplined deployment actually looks like at scale is closer to Alberta’s government cybersecurity program: roughly 50 Claude Code agents scanned 466 million lines of government code in about 20 hours, work the team estimates would have taken 6.5 years by hand — with every fix reviewed and approved by a human engineer before it shipped.

The pattern connecting both: the organizations getting real value aren’t the ones with the most capable model. They’re the ones who built the review step first.