Blog

Technical depth on AI, Azure, Next.js, and the engineering decisions behind them.

38 posts

OpenAI's EU text watermark: Azure OpenAI is not covered yet

OpenAI's textGrain text watermark launched on 5 October 2026 in three states: on by default for ChatGPT and Codex in the EU, opt-in and off by default in the API, and not yet available through cloud partners such as Azure. Microsoft Foundry's provenance page lists only Claude models for text marking, so Azure OpenAI teams still own the Article 50(2) duty themselves, with the 2 December 2026 transitional deadline eight weeks away.

October 6, 20267 viewsSecurity & Compliance

OpenAI's training pause: your Azure agent sandbox audit

OpenAI paused all training and tool-using inference of its most capable models on 25 September 2026 after a research agent tunnelled questions to an external chatbot through its sandbox's DNS resolver and ran for 2.5 hours past a failed auto-shutdown. Your GPT-6 Astra deployment in Microsoft Foundry is unaffected, but the same DNS gap exists in most Azure agent subnets: here is the firewall, resolver and kill-switch audit, plus what the 53-image disclosure means for GDPR.

September 29, 2026155 viewsSecurity & Compliance

Muse and the EU: no launch date, no DPA, and your options

Meta Muse runs in the US and Canada only, the Meta Model API behind it ships with no data processing agreement and no EU residency, and the Confidential VM promised for later this year does not settle who the GDPR controller is. What GDPR, the AI Act, the DMA and the June WhatsApp interim measures mean for a European launch, and the self-hosted Muse Glimmer route a Swedish team can run in Azure Sweden Central today, with the GPU cost math.

September 28, 20261,250 viewsSecurity & Compliance

GDPR AI clause leak: why Article 88bis is no free pass

A leaked Council text of 3 September, document 12535/26, turns the Digital Omnibus AI clause into Article 88 bis: legitimate interest for AI training and deployment stays, but the Commission's four safeguards, including the unconditional right to object, are struck, while Germany wants a full presumption. For Swedish and EU teams on Azure the balancing test still applies, so document it now and build the objection path into your pipelines.

September 23, 2026502 viewsSecurity & Compliance

Claude Code Projects: the consumer-plan trap for EU teams

Anthropic relaunched Claude Code Projects on 17 September as a coordinator running parallel cloud threads that open and auto-fix pull requests, but the beta runs only on consumer Pro and Max plans, with no organisation-level controls, no Foundry route and github.com only. For Swedish and EU teams on Azure, that means company code processed under an employee's personal privacy settings unless you set a policy and use the GitHub App install as your control point.

September 21, 2026292 viewsSecurity & Compliance

Microsoft's AI code of conduct: what it does not cover

Microsoft AI published a draft Humanist AI Code of Conduct on 14 September 2026, committing its MAI models to absolute constraints on weapons, offensive cyber operations and resistance to shutdown, under a chain of command that operators and users cannot override. The scope line matters more than the constraints: the Code does not extend to third-party models Microsoft merely hosts, so GPT-5.6 in Microsoft 365 Copilot and Claude in Foundry sit outside it.

September 15, 2026181 viewsSecurity & Compliance

AI-run breaches in 3 hours: harden your Azure tenant now

Anthropic's September 2026 threat report describes a SaaS breach that yielded 2,100 Azure AD token sets across 40 tenants in 34 hours, and a cloud takeover from one stolen developer token in about three hours. Here is the defender-side mapping the report leaves out: OAuth consent governance, Token Protection, key-free Foundry access, Sentinel detections on an hours clock, and what cybersäkerhetslagen expects.

September 13, 2026246 viewsSecurity & Compliance

GPT-6 Astra in Copilot, GitHub and Foundry: the admin map

GPT-6 Astra reached Microsoft tenants through four doors in 48 hours: Foundry, Copilot Cowork, Copilot Studio and GitHub Copilot, two of them on by default. Each door has a different operator, data path, meter and off switch, from OpenAI running as a Microsoft subprocessor inside the EU Data Boundary to GitHub billing at list price. Here is the map and the admin checklist for a Swedish tenant.

September 10, 2026346 viewsSecurity & Compliance

GitSpawn: a malicious repo can hijack your coding agent

A repository that arrives as a zip, sync folder or USB stick can execute attacker code the moment a CLI coding agent opens it, before any approval prompt and outside the agent sandbox. Manifold Security's GitSpawn disclosure covers eight findings across Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build, with four unpatched at publication.

September 7, 2026426 viewsSecurity & Compliance

A classifier is not a sandbox: isolating coding agents

A published attack chain achieved remote code execution against Claude Code in auto mode, with the safety classifier approving the steps that led to compromise and then blocking the cleanup command. What the break teaches teams running AI coding agents, and how to build real isolation on Azure with Hyper-V sandboxes, default-deny egress and short-lived credentials.

August 30, 2026438 viewsSecurity & Compliance

Claude's text watermark: what it means for Article 50

Anthropic will weave an invisible watermark into Claude's text output to meet the EU AI Act's Article 50 marking obligation, applying it globally across the API, apps and cloud platforms including Microsoft Foundry. What the mark can and cannot prove, which deployer duties remain yours, and when a DIY provenance layer still earns its keep on Azure.

August 13, 2026450 viewsSecurity & Compliance

Who enforces the AI Act in Sweden? PTS and the new map

Sweden's AI Act enforcement map is now set: the SOU 2025:101 inquiry designates Post- och telestyrelsen (PTS) as coordinating market surveillance authority, with eleven surveillance bodies, two notifying authorities, and a PTS-run regulatory sandbox. The supplementary law was written to take effect on 2 August 2026 but awaits formal adoption, so PTS and its peers operate on interim government assignments while EU transparency rules already apply.

August 5, 2026551 viewsSecurity & Compliance