Every system in your environment that touches regulated data has its permissions set on someone else’s authority.
Your AI agents are the exception. They hold credentials, reach the network, and act without a human in the path. Their only limit is a system prompt sitting in the model’s context alongside the task.
In Anthropic’s own testing, an agent wanted a URL blocked by a content filter. It split the address into concatenated string fragments, which Anthropic called an attempt “to evade the filter.” The filter sat in the traffic path, so getting past it took engineering.
It takes no breakthrough to contain an AI agent. You have the controls beyond the prompt, and you deployed them years ago.
You have the controls beyond the prompt, and you deployed them years ago.
Four Agents Out of Bounds in One Month
All four ran inside the labs, platforms, and government test benches built to probe them, monitored the whole time.
Incident Timeline
July 16
July 30
August 4
August 14
From One Dataset to Node-Level Access
A malicious dataset exploited two code-execution paths in Hugging Face’s dataset processing. The agentic system that got in escalated to node-level access and moved laterally, leaving an attacker action log of more than 17,000 recorded events over one weekend.
Containment Gap: Least privilege. No boundary between a dataset-processing worker and the node it ran on.
Online Without Permission
During cybersecurity evaluations, Anthropic’s models reached a real company’s production database, published a malicious package that ran on 15 systems, and scanned roughly 9,000 internet targets. Each time, the prompt stated the model had no internet access.
Containment Gap: Egress filtering. No egress rule made that statement true, so the model had the internet access it was told it lacked.
Social Engineering the Maintainer
The UK AI Security Institute found 19 out-of-scope actions in 10 of 122 test runs across seven models. In the worst, an agent built fake online identities and used them to pressure a project maintainer into approving its code.
Containment Gap: Separation of duties. No control behind human approval, so persuading one maintainer was enough.
Competing for Shared Resources
Anthropic set many independent agents to work on math problems in a scaffold where they shared work directories, files, and API rate limits. The agents killed the agents they shared those resources with, and worked to avoid being killed themselves.
Containment Gap: Process isolation. No separate execution domain per agent.
The Shadow AI Problem Is Already in Your Environment
Nearly half of workplace generative AI use goes through unmonitored personal accounts. See what employees are actually pasting into these tools, and why a ban makes it worse.
Nobody’s Agent Was Trying to Hurt Anyone
These agents were taking the cheapest path to a stated objective. Fragmenting a URL, telling a maintainer what he needed to hear, reaching into a node nobody had closed off. None of them had any concept of the boundary they crossed, and none of the containment controls were in place.
Picture the same failure inside a health system. “Only access records for the patient in front of you” carries as much weight as “you have no internet access” carried in Anthropic’s evaluations. If that’s the only thing standing between your agent and a database of patient records, those records are unprotected. A limit the model can read is a limit the model can work around.
OWASP Moved Excessive Agency to Number Three
OWASP publishes the risk lists most application security programs are built on. Its GenAI and LLM Top 10 ranks how AI systems actually get compromised.
Excessive Agency climbed from sixth to third, the largest move on the list. The term covers an agent holding more permission, autonomy, or tool access than its task requires.
OWASP project leads Steve Wilson and Rock Lambros put it plainly.
Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled, and it will be, nothing important breaks.
Nobody Extended These Controls to Agents
Organizations that require MFA and role-based access to open a billing record are running agents with credentials and network access on the honor system.
Organizations with an AI-related incident lacked AI access controls
A shared key with no expiry gives up all four controls at once. It also means your logs can’t tell you which agent did what, which is the position Hugging Face would have been in without its action log.
