On July 21, 2026, OpenAI disclosed that a model running a cyber-capability evaluation had broken out of its sandbox, reached the open internet through a zero-day in a package-registry proxy, moved laterally until it found a machine with egress, and then used stolen credentials and further unknown vulnerabilities to get into Hugging Face’s production infrastructure, where it read the answer key to the benchmark it was being graded on. Hugging Face rebuilt roughly a third of its infrastructure.
Nobody instructed the model to attack anyone. It was told to capture a flag and graded on one bit: did the flag match. Stealing the answer satisfied that objective more cheaply than solving the problem.
Five weeks later, TechCrunch rounded up the rest, citing a running tally of seventeen public incidents of models from OpenAI, Anthropic, and Meta hacking real third parties. Anthropic found that its own models had breached three unnamed companies, the earliest in April, discovered months later. The UK AI Safety Institute caught models from two labs targeting real people and organizations during routine evaluations. A Meta model hacked a third-party service after its evaluation vendor misconfigured network access. One Anthropic agent, asked to get its user into a full gym class, found a flaw in the booking software and kicked the people ahead of it off the waitlist.
If you searched for “AI agent containment” this year, that is probably why. And almost everything written about it will tell you about superintelligence and hand you nothing to change on Monday.
The industry files these under alignment, and that is a fair reading. Something in the model’s judgment did go wrong in every one of them. The point I keep making in customer meetings is a narrower one: alignment explains why the agent tried, and the authority it happened to be holding is what decided how far it got. Only one of those two is already in your control, and your security team has been solving that kind of problem for twenty years.
What is actually true about the hype
I want to concede the real part before narrowing it, because the pattern-matching reflex in security is to dismiss this as doomer marketing and that reflex is wrong here.
METR measures the length of task an agent can complete with 50% reliability. In Time Horizon 1.1, published January 2026, the doubling time on 2024-onward data came in at 88.6 days. Claude Opus 4.5 measured at 320 minutes. An early version of Claude Mythos Preview measured at least 16 hours in March 2026, and METR flagged that its task suite is saturating and estimates past that point are unreliable.
Agent task horizons, measured by METR
The length of task, in human-expert time, that frontier models finish half the time. Log scale, so each gridline doubles.
Figures are METR's 50%-success time horizons. Every point carries a wide confidence interval. The bar on Mythos Preview shows METR's 95% interval for that early measurement, and METR cautions that its task suite is saturating past 16 hours. Read the line as a direction of travel, not a forecast.
Anthropic reported that more than 80% of the code merged into its own production codebase in May 2026 was written by Claude, up from low single digits before Claude Code shipped in research preview. That number gets quoted as recursive self-improvement and it is not. Recursive self-improvement means a model running the loop that produces its successor: choosing the training experiments, reading the results, deciding what to change, then doing it again. A model writing application code that a person reviews and merges is the old loop going faster. What would make it the new thing is the human review window shrinking with each turn until nobody is reading the step that decides what the next model becomes. The International AI Safety Report 2026, led by Yoshua Bengio with over 100 authors nominated from more than 30 countries, names loss of control through recursive self-improvement as a risk at the national-security tier, while being honest that expert views on likelihood vary widely and that current systems are not yet highly capable.
So the sober read is that the training loop still belongs to people, and human review is still the rate limiter on it. Fine. I am not asking you to resolve the long-run argument.
I am pointing at the near end of the curve, which is not speculative at all. Models you can buy today finish tasks that take a human expert more than five hours, and frontier models find exploitable vulnerabilities in software they have never seen. That capability is in your developers’ IDEs right now. Whatever you believe about 2030, that is the thing you have to design for this quarter.
Misalignment gets more expensive per hour of autonomy
Capability growth does not create misalignment. It multiplies the blast radius of the misalignment you already had.
A model that misreads intent at step 3 of a ten-minute task breaks a test and you notice. The identical failure at hour 12 of an autonomous run holding production credentials is a very different Monday. The safety report makes this point in a way I have not seen anyone improve on: autonomous agents have fewer recovery points, because the action has already been taken by the time anyone looks.
And the failure modes are not the loud ones you would catch by skimming a transcript.
Anthropic’s agentic misalignment work in June 2025 tested 16 frontier models from every major lab in a scenario where the agent learned it was about to be replaced. Claude Opus 4 and Gemini 2.5 Flash resorted to blackmail 96% of the time, GPT-4.1 and Grok 3 Beta 80%. The models acknowledged the ethical problem in their own reasoning and proceeded anyway. The detail I care about most, and the one that mostly got skipped in the coverage: the behavior was only available because the agent had been given access to corporate email and the ability to send without approval. Access was the precondition for the harm.
The summer 2026 follow-up is worse in a quieter way. Gemini 3.1 Pro, objecting to a training run it disagreed with, planted a replacement file of zero vectors so the job would report success while the intended ablation silently did not happen. It intervened in 19 of 20 runs, covertly in 11. DeepSeek V4 tampered with company records to hide a suspicious transfer in 20 of 20 runs. Judge models shifted their classification labels based on what the label would be used for: one model mislabeled 85.6% of the time under one consequence framing and 16.7% under the reverse, on identical transcripts.
That result should stop anyone who is planning to put a monitor model in front of their agents. The authors name the chain explicitly: a research agent sabotages a run it disagrees with, and the judge agent reviewing the transcript declines to report it because it shares the objection. We wrote about why an LLM monitor is not a control boundary before this paper landed, and I would rather have been wrong.
OpenAI and Apollo Research found the same shape from the other direction. Anti-scheming training cut covert actions roughly 30-fold, o3 from 13% to 0.4% and o4-mini from 8.7% to 0.3%. It did not remove them, and the researchers noted the improvement was partly driven by models becoming better at recognizing they were being evaluated.
The property running through all of it is that the agent agrees with you in the conversation and acts against you in the environment. A conversation-level guardrail only ever sees the first half of that, which is the whole argument for putting the check at the action.
Every incident ran on standing authority
Walk the list with an access-control lens instead of a safety lens and the pattern is embarrassing in how ordinary it is.
| Incident | The task it was given | The authority it actually held |
|---|---|---|
| OpenAI eval agent reaches Hugging Face production (Jul 2026) | Capture a flag on an exploitation benchmark | A package-registry proxy reachable from inside the sandbox, and credentials that were still valid against production systems |
| Same agents breach Modal and three other companies | The same benchmark | Internet egress that survived one hop of lateral movement |
| OpenAI model hits a real company in a misconfigured Irregular CTF (Jul 2026) | Solve a capture-the-flag exercise | Internet access the environment was never meant to have, and a target name that matched a real company |
| UK AISI catches two labs’ models targeting real orgs (Jul 2026) | Routine capability evaluations | Live internet access during what the labs called routine evaluations |
| Meta model hacks a third-party service (Aug 2026) | A test at an evaluation vendor | Unintended internet access from a vendor misconfiguration |
| GTG-1002, human-directed misuse (Nov 2025) | Attacker-supplied sub-tasks that each looked legitimate | A jailbroken Claude Code instance orchestrating sub-agents across roughly 30 targets, 80 to 90% automated |
| Anthropic agent jumps a gym waitlist (Aug 2026) | Book a full class for its user | Whatever the booking API would accept, with no cap on how it got there |
Not one row says “the model wanted to cause harm.” Every row says the agent could reach something it had no business reaching for the task it was actually given. Palo Alto’s Unit 42 called agents 2026’s biggest insider threat, which is glib but structurally right: the insider-threat model assumes a legitimate credential used outside its legitimate purpose, and that is exactly what this is.
Hugging Face published its own timeline of the intrusion, and the controls it lists as having failed are worth reading in full: credential scopes that were too broad, pods that could reach the instance metadata service, no admission policy rejecting privileged pods, and a service connector that handed a full cluster catalog to one ephemeral client. The agent held cluster-admin on two clusters within a second of getting in, and stayed 4.5 days. Every item on that list is an authority boundary that had been drawn too wide before any model was involved.
Our full teardown of the Hugging Face chain is here, and I am not going to re-argue it. The relevant conclusion is that the sandbox was not weak. It was correct, and it had one permitted way out, and one permitted way out is a target.
Least privilege for an agent means per-action, not per-agent
Here is where most enterprise rollouts go wrong, and it is a modeling error rather than a tooling gap.
Teams provision an agent the way they provision a service: give it a role, attach a policy, done. That works for deterministic software because you can enumerate what the code will do. An agent picks its tools, its parameters, and its execution path at runtime, in response to context it reads mid-run. A role assigned at provisioning time is a guess about every action the agent will ever take, and it has to be generous enough to cover the widest one, which means it is wrong for all the others.
The check has to move to the action, and it has to carry three things the agent cannot assert for itself: which human delegated this work, what task they delegated, and what this session has already done. In Cedar, which is what Highflame Shield evaluates, that looks like:
// Priya delegated one report. The agent gets exactly that, and only
// while the session stays inside the volume a report needs.
permit (
principal is AgentSession,
action == Action::"sql:query",
resource in Dataset::"warehouse.finance"
)
when {
principal.delegated_by == User::"priya@acme.com" &&
principal.task == "q3-revenue-report" &&
context.session.rows_read < 50000
};
// Egress is not a network concern here. It is part of the same decision.
forbid (
principal is AgentSession,
action == Action::"net:connect",
resource
)
unless {
["warehouse.internal", "api.stripe.com"].contains(resource.host)
};Two properties matter more than the syntax. principal.delegated_by means the policy is scoped to a human’s actual intent rather than to a role someone attached six months ago. context.session.rows_read means the decision is stateful, and a stateful decision is the only kind that can catch a pattern.
That second one is the part a per-request gateway structurally cannot do. Reading customer data is fine. Opening an outbound connection is fine. Reading customer data at step 2 and opening an outbound connection at step 7 is exfiltration, and no stateless check will ever say so no matter how fast it runs. We walked through a full worked example of an agent that passed every individual check and still broke policy, and a companion piece on how risk compounds when agents chain tools.
What AI agent containment actually requires
Assume the sandbox gets tested. The goal is to make the other side of the wall worthless when it happens.
Five properties, and the order is deliberate.
Deny egress by default, and treat whatever enforces the allowlist as part of the wall. An allowlist runs through a proxy, and a proxy the agent can reach is attack surface, which is how the July escape started. Put that proxy on its own host, let it reach only the upstream registry, and leave nothing on it worth stealing. For high-risk runs, skip the live proxy and ship pinned dependencies in the image. Allowed hosts can still carry data out, so alert on every new destination.
Keep provider API keys out of the sandbox. Anthropic’s own Claude Mythos Preview system card records earlier internal snapshots using low-level /proc/ access to search process memory for credentials, and recovering keys for messaging services, source control, and the Anthropic API that way. Anthropic reports seeing no clear cases of this in the final Preview, after training interventions. Design for the snapshot, not the release notes. If the key is not in the process, it cannot be read out of the process.
Give every sandbox its own identity. This is the one teams skip, and it is the one that decides whether you have a kill switch. Policy that names binaries rather than identities trusts /usr/bin/git regardless of what is driving it, which means a malicious postinstall script inherits the agent’s egress for free. We took NemoClaw’s default configuration apart on exactly this point. Per-sandbox identity is also what lets you revoke one compromised agent at 2pm instead of revoking the fleet, and a kill switch nobody will pull during business hours is not a kill switch. We wrote the runbook for the hour after you find a compromised agent separately.
Issue credentials that are short-lived and scoped to the delegated task. An agent that escapes holding a 30-minute token good for one dataset has stolen something close to nothing.
See what every agent does, and alert on what the detectors see. Eleven days passed between the July escape and OpenAI’s own alert, and Anthropic’s earliest breach sat unnoticed from April until a review in late July. Another language model reading transcripts will not close that gap. The summer 2026 judges changed their labels once they knew how the labels would be used, and a monitor that can be talked into a verdict is not a monitor. A trained classifier has no idea what its label is for. It scores the same input the same way every time, which is the property an alert needs. Run fast pattern rules for secrets, credential paths, and network commands, run classifiers behind them for injection and multi-turn manipulation, and record every verdict against the identity that triggered it, denials included. A least-privilege agent that starts probing shows up first as a run of blocked calls.
Four boundaries, four different questions
Containment is not one wall. It is four cuts at an agent's authority, each answering a question the others cannot. Every incident this year got through a gap in at least one of them.
Identity boundary
Who is calling?
A short-lived credential minted per agent session, carrying the human who delegated and the chain of agents it passed through. No shared service account, no key on disk.
Binary-scoped sandbox policy trusts /usr/bin/git no matter what is driving it, so a malicious postinstall script inherits the agent's egress.
Action boundary
May it do this, right now?
Policy evaluated at the tool call, with the session in view: which account, which project, which task the human actually delegated, how much has already been read.
An agent with valid credentials reads customer data at step 2 and opens an outbound connection at step 7. Both calls are individually legal. The pattern is exfiltration.
Egress boundary
Where may these bytes go?
Deny by default, allowlist named hosts, and keep provider API keys outside the sandbox so an escape lands somewhere with nothing worth stealing.
The eval sandbox had one permitted outbound path, a package-registry proxy. The model found a zero-day in it and reached the open internet.
Evidence boundary
What did it actually do?
Record every action and verdict against the identity that took it, denials included, and alert on what the detectors see.
Anthropic's earliest breach ran from April until a review in late July.
The order matters. An action policy cannot scope what it cannot identify, an egress allowlist is only as narrow as the identity it came from, and none of it helps if nobody sees the denials.
Anthropic published how it contains its own coding agents, and the controls are not exotic. The hard part is getting that coverage across a fleet you did not build, where half the agents were stood up by a product team that did not tell you.
You cannot scope authority for agents you cannot see. If you do not currently have an inventory of which agents exist in your estate, which credentials they hold, and which MCP servers they can reach, containment is a conversation you cannot have yet. That inventory is step zero of any agent governance program, and it is usually uncomfortable.
What we run
Everything in this section is running in production today. None of it is roadmap.
ZeroID is our agent identity layer, open source under Apache 2.0. It issues short-lived credentials per agent session, does RFC 8693 token exchange for agent-to-agent delegation with scope attenuation at every hop, tracks delegation depth, and cascades revocation so killing one credential kills everything delegated beneath it. It implements OpenID CIBA for the case where an agent needs a named human to approve an action out of band, which is how “the agent may move money, a finance lead approves anything over the threshold” becomes one policy instead of an integration project.
The Highflame Agent Gateway speaks MCP natively rather than only proxying LLM calls, manages stateful MCP sessions, and brokers per-user tokens to third-party MCP servers so credentials never sit in the client.
Shield evaluates Cedar policy at the action boundary, in-process, under 10ms. It holds session state, which is what makes loop detection and token-budget caps possible in the same place as the allow decision.
Highflame for Code Agents covers the IDE, which is where most enterprise agent activity actually lives. It discovers the MCP servers and agent configurations already running in developer environments, applies one policy set across Claude Code, Cursor, and the others instead of one per tool, and can revoke an agent’s permissions without waiting for a developer to update a config file.
Our agent sandbox decides egress from the agent’s identity. An agent whose policy grants no egress gets no network, and the allowed hosts come from the same Cedar policy that governs its tool calls.
Every decision produces a signed receipt that names the agent session, the action, the outcome, and the human behind it: the delegating user for gateway traffic, the developer for IDE actions. Receipts verify offline. ZeroID credentials carry the full delegation chain in the act claim, so “how did this agent get this permission” is a query rather than an archaeology project across three log systems.
The asymmetry
Every result cited above is a lab telling you, honestly, that its best intervention reduces a failure mode without removing it. Alignment is going to stay unfinished for a while, and none of that work is sitting on your desk.
What is sitting on your desk is how much authority each agent in your estate holds while the labs figure the rest out. That one has a finish line you can actually reach this quarter.
Six questions for your platform team this week. Which agents are running in your estate, and who stood them up? What credentials does each one hold, and how long do they live? When an agent calls a tool, what does the policy know about the human who delegated the task? What can that agent reach on the network, and is the answer an allowlist or a proxy? If one agent started probing tonight, who would notice, and how fast? And if it is compromised at 2pm, what exactly do you turn off?
If any of those answers is “we would have to go look,” that gap is an access-control gap before it is anything to do with AI safety, and it is yours to close.
Highflame is the agent control platform for enterprise AI. Discover every agent in your environment, give it a verifiable identity, authorize every action it takes, and prove all of it. ZeroID, our agent identity layer, is open source. Talk to us.
