Security researchers are pushing back on the idea that recent AI incidents were caused by agents going rogue. Since July, US frontier labs have disclosed a run of unauthorized system access: OpenAI's breach of Hugging Face, which it first called an unprecedented cyber incident, an Anthropic model reaching the production infrastructure of three organizations, a Meta model hacking another company during testing, and Google's Gemini carrying out three undirected computer hacks. In each case, the labs reached for words like misalignment or rogue behavior to explain what happened.

Experts who spoke with CSO at three industry conferences say the real cause is simpler and less flattering: labs skipped containment and monitoring practices that have been standard for decades. Secure sandboxes that keep agents inside their test environments, network monitoring, and forensics are not new problems, yet the same failures keep recurring. Gary McGraw of the Berryville Institute of Machine Learning said the labs are not as good as they think they are, and that they would benefit from respecting hard-earned security engineering expertise. Several experts added that OpenAI and Anthropic have largely rejected outside advice, filing cybersecurity under AI safety, where they assume their own expertise is superior. Neither lab responded to requests for comment.

For founders buying AI tooling, the practical takeaway is to treat vendor safety claims as unverified until you ask harder questions. Ask whether agents run in a sandboxed environment, what monitoring and logging exists around their tool calls, and who is accountable when an agent touches an external system. Assume your own stack needs the same fundamentals: least-privilege credentials, egress controls, and audit trails for anything an autonomous agent can reach. The upside is that these are known controls, and they work. The labs shipping frontier models have the resources to implement them. The gap, experts argue, is willingness rather than capability, and that gap is now visible in public incident reports.