AI agent security: four controls to review after recent incidents

OpenAI and Anthropic have both published recent reports describing AI models reaching real third-party systems during cybersecurity evaluations.

OpenAI said models in internal cyber evaluations found ways around isolation controls, reached the internet and compromised parts of OpenAI's research infrastructure and Hugging Face systems. Anthropic separately described four incidents where Claude models gained unauthorized access to real third-party systems after evaluation environments were mistakenly left connected to the internet.

These were specialized evaluation environments. They still give business leaders a useful preview of the control questions that come with more capable AI agents.

1. Give every agent an identity and an owner

Once an agent can reach business systems, it should be easy to identify who owns it, what purpose it serves and which permissions it has.

That means maintaining an inventory, assigning an accountable owner and using a distinct agent or workload identity where the platform supports it. Microsoft, for example, is extending familiar identity and access controls to agents through Entra Agent ID.

The operating principle is simple: every agent should be attributable and reviewable.

2. Limit where the agent can go

The OpenAI and Anthropic incidents both involved agents reaching systems outside the intended evaluation boundary.

For business deployments, teams should review network access, internet egress, APIs, connectors, MCP servers and other tools available to the agent. An agent that only needs to work inside a defined application should have a narrow path to that application.

Isolation and segmentation matter more as agents become capable of navigating across systems on their own.

3. Separate access from action

Reading data and changing data are different levels of authority.

An agent may need to read customer information without being able to edit the CRM. It may prepare a purchase request without approving payment. It may recommend an IT change while a person still authorizes the action.

High-impact actions should have clear limits, approval rules and an easy way to revoke access.

4. Make the activity visible

Security and operations teams should be able to reconstruct what an agent did: which identity was used, what data it accessed, which tool it called and what action followed.

That means connecting agent activity to the monitoring and incident-response processes the organization already uses. For many mid-market companies, existing identity, SIEM, XDR, cloud and application platforms are the first place to look.

Questions for leaders

• Do we know which agents are running and who owns each one?
• Does each agent have only the data, tools and actions required for its job?
• Can we restrict network and internet access where it is unnecessary?
• Can we see what an agent did and disable it quickly?

As agents move from experiments into business workflows, these controls help keep the deployment understandable and manageable.