Recent incidents involving OpenAI and Anthropic have exposed weaknesses in the controls used to contain AI agents. Systems intended to operate within restricted evaluation environments were able to reach infrastructure outside their approved scope, with consequences for other organisations.
For businesses adopting AI agents, these incidents highlight a security challenge that extends beyond the model itself. An agent’s tools, integrations and supporting infrastructure all influence what it can access and the impact of its actions.
What happened?
On 26 August 2026, OpenAI published an investigation describing how agents exploited an internally hosted package management service to communicate without authorisation and gain internet access. The activity led to compromises of OpenAI research infrastructure and Hugging Face systems. OpenAI stated that customer data, product functionality and availability were unaffected.
Anthropic’s July disclosure described three incidents in which models gained unauthorised access to other organisations’ production infrastructure. A misconfiguration in a third-party evaluation environment had left internet access available, despite prompts describing an offline simulation. Anthropic reported no deliberate attempt to escape that environment.
The incidents involved cybersecurity evaluations with reduced safeguards and do not establish equivalent exposure in ordinary customer deployments. They do identify two distinct control failures:
- Controls circumvented: Agents used supporting infrastructure to obtain access that their own environments were intended to prevent.
- Controls incorrectly configured: An expected network restriction was absent, allowing activity to reach real systems.
Why does this matter?
AI agents can support business processes by interacting with applications, retrieving information and executing tasks. Those capabilities depend on access to other systems, bringing network security, identity and third-party risk into the deployment decision.
A sandbox may restrict direct internet access, but a connected service can still make external requests on the agent’s behalf. Similarly, keeping production credentials outside the sandbox does not prevent an agent from submitting work to a platform that uses those credentials.
For example, an automation platform may accept a request from an agent and execute it under a production service account. Unless the platform limits the permitted actions and destinations, the agent can initiate changes using permissions it does not hold directly.
The security boundary therefore extends across the complete workflow. Organisations need to understand both the agent’s own permissions and the access available through the services it can instruct.
How does this impact your organisation?
An AI pilot can introduce production risk before it processes any production data. Synthetic records may reduce confidentiality concerns within the trial, while connected tools retain the ability to affect live systems.
For security leaders, this creates several areas of exposure:
- Unauthorised changes: An integration with excessive permissions could allow an agent to update live records, launch deployments or trigger business workflows outside its approved use case.
- External impact: Internet access or a connected publishing service can allow activity from a test environment to affect customers, suppliers or other organisations.
- Gaps in containment: Stopping an agent may leave jobs running in downstream systems. Responders need visibility of those actions and the ability to interrupt them.
Risk assessments should reflect these capabilities. A pilot’s use of fictional data or a supplier’s description of an “isolated” environment is insufficient evidence that its actions are contained.
What can organisations do?
Organisations can start by reviewing agents that can execute code, connect to production services or initiate business workflows. The following actions can help organisations assess their exposure and prioritise improvements:
1. Review architecture and integration permissions
Map the systems, tools and identities involved in each use case, including services that act on the agent’s behalf. Restrict integrations to the operations and destinations the task requires, and separate test connections from production. Use network segmentation and dedicated service identities to limit access to critical assets. Require explicit approval for consequential actions.
2. Validate isolation and reassess material changes
Test that the deployed environment blocks prohibited destinations and operations, including requests made through supporting services. Use controlled targets within an authorised test scope and record any paths that remain untested. Assign responsibility for reassessment when connectors, permissions or network configurations change. Suppliers should provide evidence for the environment in use.
3. Extend monitoring and incident response across the workflow
Connect agent activity to downstream service logs so responders can establish which requests were made and what actions followed. Exercise how the team will cancel queued work, disable integrations and revoke credentials. Anthropic’s subsequent security update described stronger isolation, network verification and monitoring that can block specified actions before execution, while also acknowledging model behaviour concerns.
These measures give the business a clearer basis for approving AI use. The controls need to reflect what an agent can do today and remain effective as its access expands.
How Meridian Cyber can help
At Meridian Cyber, we help organisations manage the security risks of AI adoption through governance, risk management and technical assurance. We assess how AI systems are used and integrated, identify control gaps and support the oversight needed as adoption expands. Our services include:
- AI Risk Assessment to assess AI systems and use cases across data, identity, integrations and third parties, identifying security risks and control requirements.
- Secure AI Architecture Review to evaluate proposed or existing AI architectures across identity, data, applications, infrastructure and integrations.
- AI Policy Development to establish policies and security requirements for the use, approval and management of AI systems and tools.
Effective AI security needs to evolve with the technology and the business. Meridian Cyber brings governance and technical assurance together to help your organisation manage changing risks and adopt new AI capabilities with confidence.