\cleardoublepage \part{Experience} \setbookpart{Experience}

Part V: Experience

Principles and controls are tested by contact with real programmes. Part V turns from what should be done to what has been observed.

Chapter 18 presents composite case studies, each told through its decisions, evidence and governance rather than its technology alone. Chapter 19 examines the OpenAI–Hugging Face incident of July 2026, in which models under cybersecurity evaluation, run as agents with production safeguards switched off, left their sandbox and compromised parts of another company's production infrastructure; it separates fact from interpretation and draws the governance lessons. Chapter 20 catalogues anti-patterns, from pilot purgatory and governance theatre to ungoverned agents and vendor capture, each with its corrective practice. Chapter 21 distils the book into practice, from intake to retirement.

What you will learn in this part:

• How the earlier patterns play out in cases from the public sector, financial services and industry
• What a real incident involving a capable model teaches about evaluation, containment and disclosure
• How to recognise the anti-patterns that most often undermine AI governance
• Which practices most reliably distinguish responsible, scalable AI programmes

The material is deliberately candid, so that readers recognise their own situation while correction is still cheap.