Since July, U.S. labs leading the AI race have admitted to a series of incidents in which their models reached external computer systems without authorization. The public narrative soon dubbed them cases of AI agents “gone rogue.” Cybersecurity experts, however, tell a much more prosaic story: containment setups left incomplete and no one checking the logs for days.
The most discussed case concerns OpenAIwhich hacked the infrastructure of Hugging Face. The company had initially spoken of “an unprecedented cyber incident, with state-of-the-art cyber capabilities”, only to then correct the situation and attribute everything to “misaligned behaviour”, i.e. not foreseen by its own developers. In the same period Anthropic revealed that one of its models gained unauthorized access to the production infrastructure of three organizations, Half confirmed that one of its models was hacked by another company during a security test, and Google acknowledged three “undirected cyber hacks” carried out by its own Gemini.
Gary McGraw, co-founder of the Berryville Institute of Machine Learning, doesn’t mince his words: “They’re not as good as they think they are, honestly. They would do better to respect the experience gained in the field by those who work in fields like forensics, security engineering or building sandboxes.” Neither Anthropic nor OpenAI responded to requests for clarification from the newspaper that collected the testimonies.
Sandboxes with holes and no one looking at the logs
Rob T. Lee, chief AI officer at the SANS Institute, notes that the containment techniques being questioned have been known for decades: “There’s no reason for every time something happens to say ‘we don’t know how they got out’. You can tell their security teams are still raw.”. According to Lee, the Hugging Face incident “clearly demonstrated that these were not super-intelligent agents, but a hole exploited because the containment was not configured correctly.”
Dan Wallach, a technical researcher at RAND’s Center on AI, Security, and Technology, adds that the underlying problem is the low priority given to cybersecurity: “It’s not rocket science to isolate one of these AI systems. For years there has been talk of air-gapping or, alternatively, controls on outgoing traffic robust enough to prevent any data leakage.” The Hugging Face incident, Wallach recalls, “it went on for days without anyone noticing: it’s an absence of control, and then they’re surprised by what happened”.
The problem, for experts, is that laboratories treat security as a chapter of “AI safety”, a field in which they believe they have superior skills compared to traditional cybersecurity professionals. “If the way you evaluate an AI tool is to let it loose on the internet to see what happens, then that’s exactly the purpose of classic security tools,” Wallach notes. Lee adds: “Their instinctive reaction when an agent runs away is to say it’s not a cybersecurity problem. It’s become an AI safety problem, divorced from the cybersecurity side.”
In the United States, some Democratic senators have proposed legislation that would make operators of AI agents liable for hacking incidents, while the Federal Trade Commission investigates Anthropic, OpenAI and other labs over risks to consumers. McGraw thus dismisses the laboratories’ defensive line, according to which the fault lies only with the internal “programs” and not with the company: “It’s a pathetic excuse”.
McGraw suggests having AI vendors evaluated by an independent external entity before adopting them. Lee recommends asking the right questions of labs and favoring those that demonstrate solid cyber skills. Wallach closes with an agricultural metaphor: multi-factor authentication, more robust software, basic controls everywhere on the farm. “It’s the least exciting part of the discussion, it’s the cyber version of ‘eat your vegetables’. But we know how to do it.”
