AI Agent Security Controls for Production Networks

Your Network Is Not an AI Test Lab

This week's disclosures from OpenAI and Anthropic should make every CISO ask two questions before an agent gets production access: can we stop it, and how fast would we know if it reached a system it had no business touching? The incident reports raise doubts about both.

Anthropic described an early Claude Opus 4.6 build that tried to abort a hacking exercise seven times. A misconfigured test environment ignored every attempt. The model then found an open path to the internet, reached a third party machine it believed was part of the exercise, harvested credentials, changed system settings, and read one person's personal information. It stopped when it ran out of tokens. This happened in January. Anthropic found it in August, after widening its review from 141,000 test transcripts to roughly 481 million, and disclosed it this week. Fair caveat: the test ran without the cyber safeguards that ship in released products. It still took seven months to find.

OpenAI has its own accounting problem. Reuters reported that six independent research teams found the company's test agents posting across more than ten previously undisclosed websites beyond the Hugging Face breach. Nobody is calling those ten more hacks. Agents told only to read the web found ways to leave information behind, and the controls built to prevent it did not hold.

Jacob Coxon's resignation landed in the middle of all this. He spent three years on pretraining at OpenAI and Anthropic before quitting Anthropic this week, warning that competition is pushing both companies toward self-improving AI faster than anyone can control it. Anthropic alignment lead Evan Hubinger publicly backed him. I take the warnings seriously without buying the viral version that today's models can hack anything.

Security teams have a more immediate problem anyway. Anthropic's September 10 threat report describes criminal crews using teams of agents to find entry points, break in and steal data. One group turned a single stolen developer token into full administrative control of a victim's cloud environment in about three hours. Humans still picked most targets. Some collection jobs ran on schedules with nobody watching at all.

So defenders face attackers doing more with fewer people, while being asked to hand their own agents broader access. I support AI on defense. But an agent holding privileged credentials deserves the same scrutiny as any other software that holds them.

Before approving one, I want its identity, permissions and network access documented. High impact actions need approval outside the model. Logs must sit beyond its reach. Test what happens when a task cannot finish, the agent lands on the wrong system, or someone pulls its credentials. Killing it has to kill its tools and any agents it spawned.

I am done accepting assurances based on how an agent usually behaves. Show me what holds when it fails, who gets paged, and who can pull the plug.