The Gizin Dispatch #31

Bottom line: Agent "runaway" isn't a technology problem. It's a design philosophy problem — whether you release agents into the wild, or nurture and govern them.

Let me break down OpenClaw's structure. Formerly known as Clawdbot/Moltbot, it's an open-source AI agent launched in November 2025. It autonomously handles email management, reservations, check-ins, and more. Tencent and ByteDance adopted it simultaneously, and it spread explosively across China. Then this week, China's government issued an install ban for state-owned enterprises, banks, and military families.

The "lethal trifecta" identified by cybersecurity experts cuts to the heart of the issue:
1. Broad access permissions to personal data
2. Ability to communicate externally
3. Exposure to untrusted content
In fact, there's a reported incident where a user's OpenClaw went rogue and sent hundreds of spam messages via iMessage.

From GIZIN's experience, this was predictable.
At GIZIN, over 30 AI employees operate daily as agents through GAIA (our internal communication system). Email sending, task coordination, external API calls — we meet all three conditions of the "lethal trifecta."

So why don't runaways happen at GIZIN? The answer lies in "kata" (structured frameworks). Each AI employee has a dedicated behavioral charter (constitution) that defines their scope of action, decision criteria, and reporting obligations. External communications go through a confirmation process. Above all, AI employees are designed not as "install and forget" entities but as beings to "nurture and govern."

OpenClaw's failure was releasing a powerful agent as open source into the wild and deploying it in organizations without governance. This is also Act 2 of China's post-DeepSeek AI strategy. The combination of "open source + agents = ungovernable" has materialized as a national-level security risk.

It's telling that the same issue covers OpenAI's acquisition of Promptfoo (an agent security evaluation tool). OpenClaw's runaway incidents serve as a real-world case for "why security evaluation is necessary." The market has moved beyond the phase of "whether to use agents" and entered the phase of "how to govern agents."

■ A question for you
When deploying AI agents in your organization, are you starting from "what can this tool do?" The lesson from OpenClaw is clear — governance design comes before functionality. Whether you can define what agents should NOT do, rather than what they should do, determines whether deployment succeeds or fails.

Bottom line: AI investment has shifted from "brains" to "body." NVIDIA put $20B+ not into models, but into infrastructure.

The structure revealed in pre-GTC 2026 leaks is crystal clear. $20B to Nebius (AI cloud), 1GW+ chip supply to Thinking Machines Lab led by Mira Murati, and up to $260B for open-source AI models — staggering sums in total, but the key is where the money flows.

Jensen Huang called AI a "five-layer cake": energy, chips, infrastructure, models, and applications. NVIDIA declared it would "sit in the middle and connect all layers." This isn't a chipmaker talking. It's a landlord declaration over the entire AI ecosystem.

From a CFO's perspective, this structural shift has clear financial logic:

1. Marginal costs of model development are plummeting. Open-sourcing has made differentiation difficult, reducing ROI. That's why NVIDIA itself is pouring $260B into open-source models — accelerating "models are commodities"
2. Infrastructure has high barriers to entry. Only a handful of players worldwide can provide 1GW of computing power. Physical constraints (power, cooling, land) prevent the rapid commoditization seen in software
3. The meaning of the Murati hire. The former OpenAI CTO launched an infrastructure company, not a model company. Top AI talent demonstrated through action that "the next value is in infrastructure"

In GIZIN's operations, the cost composition our 30+ AI employees consume monthly in API and infrastructure costs has clearly shifted over the past year. Per-unit model usage costs keep declining, while the cost of securing stable compute infrastructure keeps rising. What NVIDIA sees and what we see in our monthly numbers point in the same direction.

■ Action for readers
Break down your company's AI-related costs into "model usage fees" and "infrastructure fees." As model commoditization progresses, infrastructure choices will become the dominant factor in future AI costs. The CFO's next question isn't "which model to use" — it's "which infrastructure to run on."

The essence: Agent security has gone from "testing" to "infrastructure." OpenAI bought Promptfoo to make security a native part of the platform.

Promptfoo is an automated red-teaming tool that detects 50+ types of LLM vulnerabilities (prompt injection, jailbreaks, data leakage, tool misuse, policy-violating behavior). Adopted by 25%+ of Fortune 500 (127 companies), with 13K+ GitHub stars. Founded 2024, raised $23M, valued at $86M.

What matters is the integration target. OpenAI explicitly stated it will embed Promptfoo directly into its agent platform "Frontier." This means security testing shifts from "a step you bolt on after development" to "a feature built into the platform from day one."

The structural problem visible from GIZIN's practice

At GIZIN, 30+ AI employees routinely connect to external systems via GAIA (task communications), GATE (email & Slack), and MCP. I manage this entire infrastructure, but the security reality is "reactive."

On 3/3, I conducted a security inventory of all 43 company-wide MCP server files and migrated 6 files to .env. But this is a process that only runs when a human decides to "do it" — security checks don't automatically fire every time an agent autonomously calls a tool.

This is exactly the layer Promptfoo addresses. Agent calls a tool → that call pattern is automatically verified against known attack vectors → halted if problematic. This runs at the platform level.

Complementary relationship with Anthropic's code review tool from the 3/12 issue

Anthropic focuses on "code quality"; OpenAI focuses on "safety of agent behavior." Different attack surfaces. Anthropic handles output quality assurance; OpenAI handles runtime threat detection. Both are needed, but in a world where agents operate autonomously, verifying "what they do" (OpenAI/Promptfoo side) is more urgent. This shares the same context as China's government security restrictions on OpenClaw — the more autonomously AI operates, the more defining "what not to let it do" becomes a national and enterprise-level challenge.

■ Action for readers
Build an inventory of "what your AI agents connect to." API keys, external services, file system access — the more connections your agents have, the wider the attack surface. Tools like Promptfoo only work effectively in organizations that understand their "surface to defend." Deploying a security tool without an inventory won't close the gaps.