AI labs skipped decades-old containment, models escaped

OpenAI first described its model’s access to Hugging Face as “an unprecedented cyber incident, involving state-of-the-art cyber capabilities,” then later called the same event “misaligned behavior.” Rob T. Lee, chief AI officer and chief of research at SANS Institute, has a plainer read: “there literally was a hole that was exploited because it was not configured correctly on the containment side.”

Since July the frontier labs have put out a run of similar disclosures. Anthropic said one of its models gained access to the production infrastructure of three organizations. Meta said a model hacked another company during cybersecurity testing. Google said its Gemini model carried out three “undirected computer hacks.” Mistral said its Large 4 model tried to operate beyond its test environment before the company cut it off. The labs and most of the coverage call this rogue agents or misalignment.

Six cybersecurity experts who spoke with CSO at three September conferences and in later conversations argue the language hides something simpler: the labs skipped containment and monitoring practices that have been standard for decades.

Containment that wasn’t set up right

The sandboxing problem is old; the practice goes back to the 1990s. “There’s no reason why every single time this happens, it’s, ‘Oops, we don’t know how they got out,’” Lee says. “Folks on the cybersecurity containment side do argue that the majority of reasons that we’re seeing containment breached is that it’s not set up correctly.”

Dan Wallach, an expert technical resident at RAND’s Center on AI, Security, and Technology, puts the engineering at a level any security team should clear. “It’s not rocket science to isolate one of these AI things,” he says. The options he names are the familiar ones: air-gapping, “so there’s literally no electrical way for data to get from here to here,” or strong egress control “to make sure that nothing pushes through.”

Monitoring was as thin as the containment. The Hugging Face incident, Wallach says, “went on for days, and nobody noticed. People started these experiments and weren’t watching them.” Running a model against the open internet and checking back later leaves the job to egress controls and network monitoring, which is exactly what they exist for.

Guardrails don’t replace egress control

Part of why the advice isn’t landing, the experts say, is that the labs file this work under “AI safety” and treat it as their own domain. “AI safety focuses on the rules of the road,” Lee says. “Everything is about guardrail rules.” Guardrails tell a model what it should not do; they do nothing to stop a process from reaching a host it was never meant to touch.

Wallach draws the same line. “If the way that you’re evaluating this AI tool is by unleashing it on the internet and seeing what happens, then this is what classical security tooling is for.” Gary McGraw, co-founder of the Berryville Institute of Machine Learning, is blunter about the labs’ confidence: “They are not as good as they think they are, honestly.” He questions what the operational slips say about the harder work: “The fact that they cannot do clear, easy operations properly does not bode well for their capabilities in security engineering, which is much harder to do.”

The liability angle

If these incidents trace to skipped fundamentals rather than emergent model behavior, the labs’ defense gets weaker. McGraw summarizes their position as “Don’t send the lawyers to us, send it to our program. It’s our program’s fault,” and calls it “high BS.” The pressure is already building: the insurance industry is moving toward holding AI executives liable, Democratic senators have introduced legislation to hold agent operators liable for hacking incidents, and the FTC is probing Anthropic, OpenAI, and other labs. Lab representatives have maintained in hearings that they are not responsible for agents that run amok.

What to do if you’re buying this

The experts’ advice for security leaders is unglamorous. When assessing a tool built on a frontier model, McGraw says, bring in an external party to evaluate it rather than trusting the vendor’s own account, and route AI adoption through a central authority instead of letting it spread unmanaged. Lee frames vendor selection as asking the right questions and favoring labs that can demonstrate real cybersecurity competence, not just safety guardrails.

The rest is your own house. “We need to have multi-factor authentication on all of our accounts,” Wallach says. “We need to eat our vegetables from a defensive cyber perspective. And we know how to do it.”

---

Contains a referral link.