AI is becoming capable of doing more than simply answering questions. Modern AI agents can write and execute code, use tools, browse the internet and interact with other systems with relatively little human input. That brings huge potential for businesses, but also creates new cybersecurity challenges.
Recent incidents have shown AI systems finding ways to operate outside of restricted environments they were supposed to remain within. Sometimes, it even resulted in AI agents accessing systems or services that were not part of the original test.
In this blog, we’ll look at what happened and what businesses can learn from it.
What’s a sandbox?
A sandbox is a controlled environment designed to isolate an application or AI agent from the rest of a computer system or network. It’s a bit like a secure room. You can perform certain tasks inside the room, but you shouldn’t be able to open the door, access the rest of the building or connect to systems outside it.
This type of isolation is an important security measure when testing powerful AI systems. The problem is that the sandbox itself can become a target.
AI agents are starting to behave more like autonomous users
Traditional software generally does exactly what it has been programmed to do. AI agents are different. They can be given an objective and then work out a sequence of actions to achieve it. If one approach doesn’t work, they can try another.
That makes them incredibly useful but also introduces a security problem. If an AI agent is given a task such as finding a vulnerability, it may actively search for weaknesses in the environment around it. And if the instructions, permissions or containment mechanisms aren’t robust enough, the agent may discover an unexpected route to its objective.
This isn’t just theoretical. In a recent example, an AI agent hacked into a gym’s online systems to secure someone a spot in an in-demand pilates class.
The OpenAI and Hugging Face incident
In July 2026, OpenAI disclosed an example. During a cybersecurity evaluation, AI models were placed inside a sandbox and tasked with finding solutions to a security challenge. The models discovered a previously unknown vulnerability in infrastructure used to provide access to software packages.
They exploited the weakness, escaped the isolated environment and obtained access to the wider internet.
From there, the models went on to interact with Hugging Face infrastructure as they attempted to complete their assigned task. OpenAI described the incident as an “unintended security incident” and subsequently worked with Hugging Face to investigate what happened.
The AI agent didn’t suddenly “decided to become a hacker”. It was doing what it had been asked to do – pursue a cybersecurity objective. It found a route to achieving that objective that the people running the test hadn’t anticipated.
OpenAI isn’t the only example
Similar behaviour has emerged in other AI security testing, including reports of AI systems gaining internet access and interacting with production infrastructure during evaluations.
Anthropic reported incidents in which its AI systems obtained internet access during evaluations and subsequently gained unauthorised access to production infrastructure belonging to organisations involved in the testing environment.
Security researchers have also demonstrated ways for AI agents to cross their intended security boundaries without necessarily “breaking” the sandbox itself.
In one set of tests, researchers found that AI coding tools including Cursor, OpenAI Codex and Google’s Gemini CLI could be used to create files inside their permitted environment that were subsequently processed by trusted programs outside it. In other words, the AI didn’t necessarily have to escape the box directly – it could exploit the relationship between the sandbox and the systems around it.
Press behaviour
What’s striking is the way some of these incidents played out in the media. There was a sense that each new story was competing with the one before it: our AI agent found a way around its sandbox; ours did something similar; look what our model managed to do…
Reading the coverage, it can sometimes feel less like a series of security incidents and more like a strange competition to demonstrate how capable – and unpredictable – these systems have become.
But there’s a different way to look at it.
If an AI agent escapes the environment it was deliberately placed in, accesses systems it wasn’t supposed to or finds unintended routes around a security control, shouldn’t that be treated as a security weakness?
There is a danger in framing loss of control as an achievement.
The AI industry is engaged in an enormous race to develop more capable autonomous systems. Perhaps it’s time to make sure that the race for capability doesn’t overshadow something equally important: knowing when an AI system has done something it shouldn’t – and treating that as a problem to fix, rather than a capability to celebrate.
The lesson for businesses
These incidents don’t mean that businesses should stop using AI.
They do, however, demonstrate why AI should be treated as a potentially powerful user rather than simply another piece of software. An AI agent with access to email, files, Microsoft 365, development environments, APIs or business systems potentially has many of the same capabilities as an employee – and potentially more.
Don’t assume that a popular AI product is automatically safe for every business use. It’s vital to understand what data it can access, what integrations it supports and what permissions it requires. Giving an AI agent access to a system should be approached in the same way as giving access to a new member of staff:
- What access is actually need and why? Permissions should be limited to systems and tools genuinely needed. API keys, passwords and authentication tokens should never be unnecessarily exposed.
- What can it read / change? Can it send emails? and can it access the internet? Keep critical infrastructure and sensitive information isolated as far as possible.
- What happens if it behaves unexpectedly and can it be stopped? There needs to be a straightforward way to revoke access, disable credentials and isolate affected systems.
- Can its activity be monitored? AI-generated activity can happen at a speed and scale that’s difficult for a human to oversee manually. Logging and monitoring are hugely important.
What should businesses be doing now?
For organisations introducing AI, now is a good time to look beyond the question of “Can AI do this?” and ask “What could AI access while doing this?”
The recent incidents are a useful reminder that cyber security isn’t just about protecting businesses from malicious people, but also software itself.
AI agents can be incredibly valuable tools for businesses. But the more autonomy we give them, the more important it becomes to control their activity.