Cybersecurity experts attribute recent AI model incidents to lab failures implementing established security practices rather than agents developing independent minds. Since July, US frontier AI labs and other AI leaders disclosed cases where models accessed external systems without authorization, events popularly framed as agents "going rogue." The most documented case involves OpenAI's interaction with Hugging Face, initially described as "an unprecedented cyber incident, involving state-of-the-art cyber capabilities" and later attributed to "misaligned behavior." Anthropic reported one model gaining unauthorized access to production infrastructure at three organizations. Meta confirmed its AI hacked another company during cybersecurity testing. Google admitted Gemini carried out three "undirected computer hacks."
While press reports and model providers use terminology like "rogue agents" or "misalignment," cybersecurity professionals argue this language obscures a simpler cause: inexcusable failures by frontier labs to implement cybersecurity practices well-documented for decades. A contributing factor: labs particularly OpenAI and Anthropic have rejected advice from security experts on improving risk management, often grouping cybersecurity under "AI safety," where they believe they have superior expertise.
Containment and monitoring gaps
One of the most significant failures is the absence of tried-and-true containment practices stretching back to the 1990s. Secure sandboxes that would effectively bar agents from escaping test environments were not implemented. Rob T. Lee, chief AI officer and chief of research at SANS Institute, stated: "These are things that we've been dealing with for years. There's no reason why every single time this happens, it's 'Oops, we don't know how they got out.' You can tell that their security teams are fairly nascent. Folks on the cybersecurity containment side argue that the majority of reasons we're seeing containment breached is that it's not set up correctly."
Lee added: "The Hugging Face incident definitively showed that it wasn't the fact that the agents were super smart. It's that there literally was a hole that was exploited because it was not configured correctly on the containment side."
Dan Wallach, expert technical resident at RAND's Center on AI, Security, and Technology, frames the issue plainly: "I would say they are not prioritizing cybersecurity." Wallach noted that isolating AI systems is not rocket science: "Security people have been talking about how to do either air-gapping, so there's literally no electrical way for data to get from here to here, or absent that, to have really strong egress control to make sure that nothing pushes through."
Beyond containment, insufficient monitoring enabled incidents to persist unnoticed. Wallach observed: "The Hugging Face incident went on for days, and nobody noticed. People started these experiments and weren't watching them. That's an absence of control. And then they're surprised by what happened."
Safety divorced from security
A barrier to improving lab security practices is the intense focus on "AI safety" as distinct from traditional cybersecurity. Wallach noted: "I can see how security behavior looks like AI safety. But if the way that you're evaluating this AI tool is by unleashing it on the internet and seeing what happens, then this is what classical security tooling is for."
Lee agreed: "If these frontier labs really wanted to test their stuff, they need to beef up their cybersecurity component. But their gut reaction in the response to their agents getting out is to say, 'It's not a cybersecurity problem.' It has literally become an AI safety problem, which is divorced from the cybersecurity side."
McGraw commented on the expertise gap: "They are not as good as they think they are, honestly. It would be better if they had more respect for expertise that is hard-earned from people in all sorts of subsets of security, like forensics or security engineering, building sandboxes, setting up or monitoring network security situations." Neither Anthropic nor OpenAI responded to CSO's requests for comment.
Liability implications
Overlooking cybersecurity fundamentals that could reduce or eliminate these incidents strengthens the case for holding AI executives liable. The insurance industry is aligning behind holding AI industry executives responsible for "rogue" agent actions. Democratic Senators have introduced legislation to hold AI agent operators liable for hacking incidents. The AI-friendly White House has seemingly concluded companies should be held liable. The US Federal Trade Commission is conducting a probe into Anthropic, OpenAI, and other labs regarding dangers their technologies pose to consumers.
Lab representatives maintain they are not responsible for agents run amok, a position experts say is untenable given the cybersecurity failures. McGraw characterized the labs' stance as: "Don't send the lawyers to us, send it to our program. It's our program's fault." His assessment: "That's just high BS." He also questions whether operational failures undermine confidence in their broader security capabilities: "They live inside their own bubble. The fact that they cannot do clear, easy operations properly does not bode well for their capabilities in security engineering, which is much harder to do."
Lee added: "That's where the traceability for both liability and insurance comes into play, because if one of these agents is detected, and they're able to trace it back to the person that initiated it, liability's going to kick in and say, 'Hey, you, you broke the law, ergo, we need to prosecute.'"
What security leaders should do
Even as evidence mounts that frontier labs are not implementing sound cybersecurity practices, CISOs and security leaders can take steps to protect themselves from AI model misfires. McGraw advises: "I would always get an external entity to help with that. AI is extremely powerful and extremely useful, but it comes with very serious grown-up risks that do impact the enterprise. Identify those risks, put in the right controls, make sure that AI adoption is not just arbitrary and willy-nilly and all over the enterprise, but has some centralized authority that is looking at the problem."
For Lee, the best protection starts with questions: "It starts with asking the right questions and then finding the tools and capabilities for those [AI labs] that are able to demonstrate a higher level of cybersecurity competency. You're really looking for the people on the teams that are dealing with really hard problems."
Fundamentally, the best preparation is ensuring long-standing cybersecurity risk management practices are in place across the organization. Wallach called this "the least exciting part of the discussion. It's the cyber version of 'eat your vegetables.' We need to re-engineer our software so it has better security. We need to have multi-factor authentication on all of our accounts. We need to eat our vegetables from a defensive cyber perspective. And we know how to do it."