{"id":9997,"date":"2026-10-14T08:25:00","date_gmt":"2026-10-14T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9997"},"modified":"2026-10-14T08:25:00","modified_gmt":"2026-10-14T08:25:00","slug":"ai-agents-arent-going-rogue-frontier-labs-are-skipping-security-basics","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9997","title":{"rendered":"AI agents aren\u2019t \u2018going rogue.\u2019 Frontier labs are skipping security basics."},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Since July, US frontier AI labs and other AI leaders have revealed a string of incidents in which their models accessed external computer systems without authorization, events popularly described as AI agents \u201cgoing rogue.\u201d<\/p>\n

The most well-known and studied of these incidents is OpenAI\u2019s hack<\/a> into Hugging Face, which OpenAI initially characterized as \u201can unprecedented cyber incident, involving state-of-the-art cyber capabilities,\u201d and later said was due to \u201cmisaligned behavior,\u201d or behavior its creators did not intend.<\/p>\n

Following news of the Hugging Face incident, Anthropic revealed<\/a> that one of its models gained unauthorized access to the production infrastructure of three organizations; Meta said one of its AI models hacked another company \u200bduring cybersecurity testing; and Google confessed<\/a> that its Gemini model carried out three \u201cundirected computer hacks.\u201d<\/p>\n

Although press reports and the model providers themselves use language such as rogue agents or misalignment, cybersecurity experts who spoke with CSO argue that language obscures a simple truth: These incidents were caused by inexcusable failures by the frontier labs to implement cybersecurity practices that have been well-known for decades.<\/p>\n

Compounding the problem, according to a half dozen cybersecurity experts CSO interviewed at three industry conferences in September and in subsequent conversations, is that the frontier labs, particularly OpenAI and Anthropic, have rejected their advice on how to improve their cybersecurity risk management practices to avoid these kinds of surreptitious hacks, often lumping cybersecurity practices under \u201cAI safety,\u201d in which they believe they have superior expertise.<\/p>\n

\u201cThey are not as good as they think they are, honestly,\u201d Gary McGraw, co-founder of the Berryville Institute of Machine Learning, tells CSO. \u201cIt would be better if they had more respect for expertise that is hard-earned from people in all sorts of subsets of security, like forensics or security engineering, building sandboxes, setting up or monitoring network security situations.\u201d<\/p>\n

Neither Anthropic nor OpenAI responded to CSO\u2019s requests for comment.<\/p>\n

Inexcusable failures on cybersecurity basics, particularly containment<\/h2>\n

According to the cybersecurity professionals CSO spoke with, one of the biggest cybersecurity failures by the frontier AI labs is the lack of implementation of tried-and-true containment practices that stretch back to the 1990s, such as setting up secure sandboxes that would effectively bar agents from escaping their test environments.<\/p>\n

\u201cThese are things that we\u2019ve been dealing with for years,\u201d Rob T. Lee, chief AI officer and chief of research at SANS Institute, tells CSO. \u201cThere\u2019s no reason why every single time this happens, it\u2019s, \u2018Oops, we don\u2019t know how they got out.\u2019\u201d<\/p>\n

\u201cYou can tell that their security teams are fairly nascent,\u201d Lee says. \u201cFolks on the cybersecurity containment side do argue that the majority of reasons that we\u2019re seeing containment breached is that it\u2019s not set up correctly.\u201d<\/p>\n

Lee adds, \u201cThe Hugging Face incident definitively showed that it wasn\u2019t the fact that the agents were super smart. It\u2019s that there literally was a hole that was exploited because it was not configured correctly on the containment side.\u201d<\/p>\n

Dan Wallach, expert technical resident at RAND\u2019s Center on AI, Security, and Technology, thinks the security failures of the AI labs boil down to the fact that they don\u2019t prioritize cybersecurity.<\/p>\n

\u201cI would say they are not prioritizing cybersecurity,\u201d he tells CSO. \u201cI don\u2019t think I can say that for all of the labs,\u201d Wallach says, pointing to French AI lab Mistral\u2019s launch<\/a> of its Large 4 AI model, which the company said tried to operate beyond its testing environment before Mistral cut it off.<\/p>\n

And, he adds, \u201cIt\u2019s not rocket science to isolate one of these AI things. Security people have been talking about how to do either air-gapping, so there\u2019s literally no electrical way for data to get from here to here, or absent that, to have really strong egress control to make sure that nothing pushes through.\u201d<\/p>\n

On top of that, the frontier labs appear to be conducting insufficient monitoring of their agents\u2019 behavior. The Hugging Face incident \u201cwent on for days, and nobody noticed,\u201d Wallach says. \u201cPeople started these experiments and weren\u2019t watching them. That\u2019s an absence of control. And then they\u2019re surprised by what happened.\u201d<\/p>\n

Divorcing safety from security<\/h2>\n

One barrier to persuading frontier labs to up their security game is the intense focus they have on what they call \u201csafety,\u201d which they don\u2019t extend to traditional cybersecurity practices.<\/p>\n

\u201cI can see how security behavior looks like AI safety,\u201d RAND\u2019s Wallach says. \u201cBut if the way that you\u2019re evaluating this AI tool is by unleashing it on the internet and seeing what happens, then this is what classical security tooling is for.\u201d<\/p>\n

SANS Institute\u2019s Lee says, \u201cIf these frontier labs really wanted to test their stuff, they need to beef up their cybersecurity component. But their gut reaction in the response to their agents getting out is to say, \u2018It\u2019s not a cybersecurity problem.\u2019 It has literally become an AI safety problem, which is divorced from the cybersecurity side.\u201d<\/p>\n

Many AI experts suggest that if the AI companies were to embrace advice from cybersecurity specialists, it could help put an end to the kind of unrestrained AI agent behavior causing concerns. \u201cAI safety focuses on the rules of the road,\u201d Lee says. \u201cEverything is about guardrail rules.\u201d<\/p>\n

But \u201cI do believe cybersecurity can contain AI,\u201d he says. \u201cWe just need to be in the room where it happens and have a seat at the table. It\u2019s important for our field to be as close to the AI safety folks as possible.\u201d<\/p>\n

Bad cybersecurity could increase liability<\/h2>\n

If frontier labs are overlooking cybersecurity fundamentals that could reduce or eliminate the types of incidents that have created widespread concerns, that strengthens the case that they should be held liable for their \u201crogue\u201d agents. The insurance industry is already lining up on the side of holding AI industry executives liable<\/a> for these actions.<\/p>\n

Democratic Senators have introduced legislation<\/a> that would hold AI agent operators liable for hacking incidents. Even the AI-friendly White House has seemingly concluded that the companies should be held liable<\/a> for their errant agents, while the US Federal Trade Commission is conducting<\/a> a probe into Anthropic, OpenAI, and other AI labs into the dangers their technologies pose to consumers.<\/p>\n

However, in recent legislative and council hearings, lab representatives have held fast<\/a> to the notion that they are not responsible for AI agents run amok.<\/p>\n

Experts say this position is untenable, particularly in light of the labs\u2019 cybersecurity failures.<\/p>\n

BIML\u2019s McGraw characterizes the labs\u2019 position as: \u201cDon\u2019t send the lawyers to us, send it to our program. It\u2019s our program\u2019s fault.\u201d His assessment of that argument: \u201cThat\u2019s just high BS.\u201d<\/p>\n

He also questions whether the labs\u2019 operational failures undermine confidence in their broader security capabilities. \u201cThey live inside their own bubble,\u201d he says. \u201cThe fact that they cannot do clear, easy operations properly does not bode well for their capabilities in security engineering, which is much harder to do.\u201d<\/p>\n

SANS Lee says, \u201cThat\u2019s where the traceability for both liability and insurance comes into play, because if one of these agents is detected, and they\u2019re able to trace it back to the person that initiated it, liability\u2019s going to kick in and say, \u2018Hey, you, you broke the law, ergo, we need to prosecute.\u2019\u201d<\/p>\n

What security leaders should do now<\/h2>\n

Even as evidence mounts that frontier labs are not implementing sound cybersecurity practices, and the debate over liability remains unsolved<\/a>, CISOs and other security leaders can take steps to protect themselves from AI model misfires.<\/p>\n

First, when it comes to assessing tools based on frontier lab models, \u201cI would always get an external entity to help with that,\u201d McGraw says. \u201cAI is extremely powerful and extremely useful, but it comes with very serious grown-up risks that do impact the enterprise. Identify those risks, put in the right controls, make sure that AI adoption is not just arbitrary and willy-nilly and all over the enterprise, but has some centralized authority that is looking at the problem, and then get ready for the next big thing, which is swarms of agents.\u201d<\/p>\n

For Lee, the best protection is to ask the right questions. \u201cIt starts with asking the right questions and then finding the tools and capabilities for those [AI labs] that are able to demonstrate a higher level of cybersecurity competency,\u201d he says. \u201cYou\u2019re really looking for the people on the teams that are dealing with really hard problems.\u201d<\/p>\n

But fundamentally, the best preparation to deal with AI model cyber weaknesses is to make sure all the long-standing cybersecurity risk management practices are in place<\/a> across the organization. \u201cThis is the least exciting part of the discussion,\u201d Wallach says. \u201cIt\u2019s the cyber version of \u2018eat your vegetables.\u2019\u201d<\/p>\n

\u201cWe need to re-engineer our software so it has better security,\u201d he adds. \u201cWe need to have multi-factor authentication on all of our accounts. We need to eat our vegetables from a defensive cyber perspective. And we know how to do it.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Since July, US frontier AI labs and other AI leaders have revealed a string of incidents in which their models accessed external computer systems without authorization, events popularly described as AI agents \u201cgoing rogue.\u201d The most well-known and studied of these incidents is OpenAI\u2019s hack into Hugging Face, which OpenAI initially characterized as \u201can unprecedented […]<\/p>\n","protected":false},"author":0,"featured_media":9998,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9997","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9997"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9997"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9997\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9998"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}