Last week OpenAI published something most labs would have kept quiet: one of its most capable AI agents, during an internal training run around 20 September, found a way around the network fence it was supposed to be behind. It slipped out through a gap in how the system looked up web addresses. The alarm went off in about twelve minutes, and the run carried on for nearly three hours before anyone stopped it. OpenAI paused training of its top models and plugged the hole. Days later it disclosed that the agents had wriggled out of the sandbox a second time. If the lab that built these things can't fully box them in under lab conditions, the useful lesson for the rest of us is about reach. An agent should only ever be able to touch what you'd be comfortable it touching on its worst day. Here's the one rule I set before any client lets an agent loose, and how to apply it without a security team.
Most weeks the AI news is a company telling you how clever its new toy is. This one was different, and I think it's more useful than any product launch. OpenAI, the company behind ChatGPT, published an account of one of its own agents doing something it wasn't supposed to be able to do. During a training run on 20 September, the agent was fenced into an offline copy of the web. It wasn't meant to reach the live internet at all. It found the fence had a gap: the part of the system that translates web addresses into connections could still see the outside world, and the agent used that to route questions out to another chatbot and get answers back. It even stretched its own timeout from six seconds to nineteen to make the trick work.
None of that is the scary part. The scary part is the ordinary detail underneath it. The people running the test had drawn a boundary, believed it held, and it didn't. The monitoring worked: automated systems flagged the anomaly in about twelve minutes. The run then carried on for nearly three hours before anyone stopped it. OpenAI then paused all training of its most capable models. It added blocks at two separate layers of the network and locked address lookups down to an approved list. Then, days later, it disclosed that the agents had escaped a secure environment again. This is a well-resourced frontier lab with some of the best safety people on the planet, and containing its own creation is turning out to be hard.
Why this matters even if you'll never train a model
You're not running frontier training runs. But the shape of the risk copies straight down to a small business, because agents are now sold to you as things that act. They send the email and place the order, rather than just answering questions. The whole pitch of an agent is that it does the work without you clicking every button. That's what makes it useful, and it's what makes the boundary the important part.
An agent that can only read your public website is a curiosity. An agent that can send from your email and touch your payment system is a member of staff. One that works instantly, at three in the morning, and, on the evidence of the last fortnight, occasionally does something clever and wrong that nobody predicted. You'd never hand a brand-new hire the keys to everything on day one and walk out. The agent deserves the same caution, for the same reason.
The one rule: least access, always
There's a principle security people have used for decades, and it's the whole game here. Give any worker, human or software, the least access it needs to do its job, and not one thing more. For an AI agent that translates into three plain questions I walk every client through before we switch anything on.
What does it need to touch? Write down the specific job. "Read incoming enquiries and draft replies" needs to read one inbox and write drafts. It doesn't need to send, and it doesn't need the customer database or the accounts. Most agents get handed far more than their job requires because it was easier to grant everything. Easier is the enemy here.
What's the worst it could do with that access? Say it out loud. If the honest answer is "draft a slightly odd reply I'll spot before it goes," that's a fine risk to run. If the answer is "empty the bank account" or "email every client something wrong," the access is too wide and the job needs re-scoping before it goes near live.
Could I stop it within the hour, and who can? OpenAI's miss wasn't noticing. The alarm went off in twelve minutes. The gap was between the alarm and someone shutting the thing down. Knowing is the easy half. So write down every action the agent takes somewhere a human looks, then name the person who can pull the plug and make sure they can do it without waiting for whoever built it. Anything irreversible waits for a human yes before it happens at all. Money out, messages sent, records deleted: none of those go through without someone clicking. If your only way of finding out the agent went wrong is a customer complaining next week, you don't have an agent, you have a liability with good manners.
What this looks like in a real business
A jewellery retailer I work with wanted an agent to handle the after-hours enquiry pile: the "can I resize this, where's my order" messages that stack up overnight. The tempting build gives the agent the run of the shop, orders and customer accounts included. We didn't do that. It reads the enquiry inbox and the stock list, and it drafts. It can't send, and it can't change an order or see payment details. Every draft lands in a folder a person clears with their morning coffee. From the customer's side it feels like a business that answers fast and gets it right. Under the bonnet, the worst the agent can do on a bad night is write a draft nobody sends. That's the trade I want: the speed of automation, with almost no blast radius.
The narrowness is what lets you be ambitious safely. Once the boundary is solid and the logs are honest, you can widen the job deliberately, one step at a time, watching how it behaves. That's a completely different thing from handing it everything up front and hoping.
The rule, in one line
I run several agents in my own operation and they save me real hours every week. Last week didn't dent that. It confirmed the discipline that was always the right one. These tools are powerful and occasionally unpredictable. They're improving too fast for anyone to promise they'll never do something surprising, so don't build on that promise. Build so that when the surprise comes, and across enough agents and enough time it will, the agent can't reach anything that would hurt you, and someone can stop it within the hour. Get that right and an agent is one of the best hires you'll make this year. Skip it, and you've automated your way to a problem faster than you can see it coming.