"And when sub-agents or third-party tools are involved, liability gets even murkier."

It really doesn't. That falls straight on Governance, Risk, and Compliance. Ultimately, CISO, CFO, CEO are in the line of fire.

The article's argument happens in a vacuum of facts. The fact that a security engineer doesn't know that is depressing, but not surprising.

>The fact that a security engineer doesn't know that is depressing, but not surprising.

That's a very subtle guinea pig joke right there.