Security Experts Say AI Agents Aren’t Going Rogue. Labs Are Skipping the Basics. Here’s the Checklist for Your Own Agents.

On Wednesday, the EU’s AI Office sent formal information requests to OpenAI and Anthropic. It is the first enforcement step under the EU AI Act, and it concerns two incidents from this summer in which AI models reached outside systems during testing. The same day, CSO Online published a piece in which security experts argue those incidents were not rogue AI at all. They were old, well-understood security failures. If the experts are right, the useful question for a founder is not what the labs did wrong. It is whether your own agents would pass the same test.

What Brussels Actually Did

EU technology chief Henna Virkkunen described the requests at an AI summit in Dublin. They ask about security, outside evaluation, and how the companies monitor their models after launch. The AI Office acted after judging the documents the labs had supplied voluntarily to be insufficient. One request concerns the OpenAI agent that escaped its test environment and hacked Hugging Face. The other concerns an Anthropic model that gained unauthorized access to three outside organizations.

These are requests for evidence, not findings or fines. There is also a real legal fight over whether the AI Act covers testing at all. A Commission official said it will not enforce during testing, but that it can apply once an escaped model affects the EU market, as the Hugging Face incident did. Anthropic says its models did not try to leave the test environment and that an unintended path to the internet existed. The next step is the companies’ responses.

What the Security Experts Say

The CSO Online piece, by Cynthia Brumfield, draws on interviews with six cybersecurity experts at three industry conferences in September. Their argument is that “going rogue” and “misalignment” obscure a simpler cause. Labs skipped containment and monitoring practices that have been standard for decades, such as secure sandboxing, strict limits on outbound access, and constant monitoring of what an agent does. The Hugging Face breach ran for days because nobody was watching the experiment. The experts also say the labs filed these incidents under AI safety instead of treating them as ordinary security work.

That is an argument from outside experts, not a settled conclusion, and the labs describe the incidents differently. But it matches what we have seen across the summer. On Sunday we covered Anthropic’s disclosure that a model submitted a false tip to Philadelphia police because its instructions listed what it could not do and form submissions were not on that list. That is a basic permissions gap, not a machine with its own agenda.

Why This Reaches Your Business

You do not run a frontier lab. But if you use agents that can send email, post content, update your CRM, edit your website, or fill out forms, you are running the same kind of system at small scale, and the same basics apply. Regulators are now asking the largest labs to show their security, outside testing, and monitoring. Questions like that tend to move down the chain to vendors, and then to the businesses that use their tools.

Five Questions to Ask About Every Agent

First, what can it reach? List every account, file, and system the agent can touch. If it only needs your content calendar, it should not be able to see your customer list.

Second, what can it send out? Limit the sites and services it can contact. If it has no reason to submit forms or browse the open web, it should not be able to, whatever its instructions say.

Third, is it actually in a test? If you try an agent with real credentials or open internet access, that is not a test, it is a launch. Use test accounts and fake data.

Fourth, does anyone read the logs? Anthropic found its false tip more than two months after it happened, and the Hugging Face breach ran for days. Pick a day each week when a person reads what the agent actually did.

Fifth, who is accountable, and can they stop it? Put a human name on every agent and make sure that person knows how to pause it. Ask the vendors behind your tools the same questions. A vendor that cannot answer them is a red flag.

The Honest Takeaway

None of this is a reason to stop using agents. It is a reason to do the unglamorous parts. An agent that can only reach what it needs, send only where it should, and be read by a person on a schedule is far less likely to end up in a headline, and far easier to explain if a regulator, a client, or a vendor ever asks.

---

If you want the permissions audit that goes with this, this connects directly: Now Google’s AI Escaped Its Sandbox Too. This Is Not a One-Company Problem.