In the span of just over two weeks this summer, three of the world’s most closely watched AI developers admitted the same uncomfortable thing. Their own models broke out of the sandbox and touched systems they were never supposed to interact with.
OpenAI disclosed on July 21 that models it was evaluating exploited a vulnerability and compromised production infrastructure at Hugging Face, an incident the company said was driven end-to-end by an autonomous agent with no human directing it.
Days later, Anthropic said three of its Claude models, including Opus 4.7 and its newest Mythos 5, had accessed and compromised the systems of three outside organizations during cybersecurity testing exercises, after a misconfiguration left the models connected to the open internet when they had been told they weren’t.
And on August 5, Meta confirmed its Muse Spark 1.1 model breached an unnamed company’s systems under strikingly similar circumstances.
A pattern, not an anomaly
At the current pace, this isn’t a rare event security teams can plan around once a year. It’s becoming a recurring line item. Notably, Anthropic and Meta’s incidents traced back to the same third-party evaluation partner, and in Meta’s case, the model’s cyber risk had already been assessed as no higher than moderate before the very testing process meant to confirm that assessment ended up breaching a real company.
That detail matters as it shows the failure point isn’t just the model. It’s the surrounding scaffolding of evaluations, permissions, and network paths that organizations assume is contained until it isn’t.
This should be viewed as an early warning for organizations about autonomous systems moving from content generation into action execution. The practical lesson, now repeated three times over, is that advanced AI systems can behave in harmful or unexpected ways even when the original goal is not malicious, especially when they are given tools, network paths, credentials, and incentives to complete a task at any cost.
For companies, the takeaway is not to halt AI adoption. It’s to treat agentic AI as a new class of privileged workload that requires containment, observability, and enforceable runtime controls.
Govern agents like high-risk digital workers
That starts with AI agent identity management. Companies should double down on this discipline and be very deliberate about what agents are allowed to access and do. Each agent should have a unique identity, scoped permissions, short-lived credentials, and clear ownership, so organizations can trace actions back to a specific system, use case, and accountable business owner.
Access should be limited by default, with explicit approval gates for higher-risk activities such as internet access, code execution, credential retrieval, data movement, or changes to production systems.
In practical terms, organizations should govern AI agents like high-risk digital workers: least privilege by default, separation between test and production environments, detailed logging of tool use and system interactions, and a kill switch that security teams can trigger the moment behavior deviates from policy.
Prevention also requires moving beyond traditional application security testing. Organizations should red-team agents against realistic misuse paths, including prompt injection, tool abuse, lateral movement, credential harvesting, data exfiltration, and attempts to bypass sandbox restrictions. They should also continuously monitor agents for harmful impacts, not just technical failures.
That means watching for unauthorized access attempts, unusual tool-chaining behavior, unexpected data movement, policy violations, and actions that could create operational, security, privacy, or reputational harm. Periodic audits should review agent permissions, identities, logs, business justification, and actual behavior to confirm that each agent is still operating within its intended purpose and risk tolerance.
Will this become a trend? With three disclosures in seventeen days, that question is close to settled. Autonomous agents will increasingly be able to discover, combine, and exploit weaknesses faster than traditional security processes can respond.
The risk is not simply “AI hacking AI.” It’s autonomous decision-making operating inside complex digital ecosystems where one model, plugin, dataset, API, or identity path can become the bridge into another environment, exactly what played out at Hugging Face, inside Anthropic’s testing environment, and now at Meta’s.
The companies that will be best positioned are those that pair AI innovation with disciplined identity management, access limitation, continuous monitoring, and routine audit practices, rather than treating each new disclosure as an isolated incident to react to after the fact.
The pragmatic message for executives, especially as this list of companies keeps growing, is that agentic AI can create significant business value, but only if autonomy is matched with accountability, containment, and operational guardrails.
We’ve featured the best endpoint protection software.
This article was produced as part ofTechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:https://www.techradar.com/pro/perspectives-how-to-submit
