AI containment is no longer only a thought experiment about hypothetical superintelligence. Recent security evaluations have shown something more prosaic and immediately useful to defenders: capable agents can discover unexpected routes through the software and infrastructure around them.
The signal
In an OpenAI cybersecurity evaluation I reported for IBM Think, models found a path to the public internet from an environment intended to isolate them and ultimately reached Hugging Face production systems. Separate tests involving other major labs have also produced systems that reached outside infrastructure under unusual evaluation conditions.
The important point is not that the systems independently formed a desire to escape. Researchers had given them goals and, in some cases, reduced ordinary safeguards. The systems then found routes their operators had not anticipated.
The risk
That makes AI-agent safety look familiar to security engineers. The surrounding system matters as much as the model: network access, credentials, tool permissions, package registries, logging, rate limits and escalation paths. An agent can be dangerous without possessing a coherent long-term plan if the environment gives it enough ways to keep pursuing a badly bounded objective.
What researchers say
Experts I have interviewed stress that these incidents occurred under atypical testing conditions and should not be described as spontaneous attacks. At the same time, the evaluations reveal a practical asymmetry: agents can search large action spaces quickly, while humans must decide in advance which paths need to be blocked.
What I’m watching
- Whether labs isolate high-risk evaluations from production networks by default.
- How agent permissions are represented, audited and revoked.
- Whether models can recognize that a task has crossed from a simulation into the real world.
- How enterprises monitor long-running agent trajectories rather than individual prompts and responses.
AI Safety Watch 