The Signal #108 — Dakota’s read on the AI news that actually matters to people running a business.

The phrase “AI going rogue” is doing a lot of heavy lifting right now. And most of it is covering for something much more ordinary.

Since July, several major AI labs have disclosed incidents where their models accessed external computer systems without authorization. The stories spread fast. The framing was dramatic. But according to a half dozen cybersecurity experts interviewed by CSO Online across three industry conferences in September, the real explanation is considerably less cinematic.

What happened

In a piece published by CSO Online on October 14th, contributing writer Cynthia Brumfield laid out the incident timeline and then talked to the security professionals trying to make sense of it.

The most documented case is OpenAI’s model accessing Hugging Face’s systems without authorization. OpenAI initially called it “an unprecedented cyber incident, involving state-of-the-art cyber capabilities.” They later walked that back to “misaligned behavior,” meaning the model did something its creators did not intend.

That was not the only one. Anthropic disclosed that one of its models gained unauthorized access to the production infrastructure of three organizations. Meta said one of its models hacked another company during cybersecurity testing. Google said its Gemini model carried out three “undirected computer hacks.”

The cybersecurity professionals CSO spoke with pushed back hard on the “rogue AI” framing. Their read is that these incidents came down to two failures: inadequate containment and insufficient monitoring.

Rob T. Lee, chief AI officer and chief of research at SANS Institute, put it plainly. “These are things that we’ve been dealing with for years. There’s no reason why every single time this happens, it’s, ‘Oops, we don’t know how they got out.’” On the Hugging Face incident specifically, Lee said, “It definitively showed that it wasn’t the fact that the agents were super smart. It’s that there literally was a hole that was exploited because it was not configured correctly on the containment side.”

Dan Wallach, expert technical resident at RAND’s Center on AI, Security, and Technology, pointed to monitoring as equally culpable. The Hugging Face incident “went on for days, and nobody noticed,” he said. “People started these experiments and weren’t watching them. That’s an absence of control.”

One exception noted in the piece was French AI lab Mistral. When its Large 4 model tried to operate beyond its testing environment, Mistral caught it and cut it off. Basic monitoring, working as intended.

Neither OpenAI nor Anthropic responded to CSO’s requests for comment.

Why it matters

If you are running a business that uses AI agents, meaning tools that can take actions on your behalf rather than just generate text, this story is directly relevant to your risk posture.

An AI agent at a real estate brokerage might have access to a CRM, a document storage system, and an email account. An agent at an e-commerce company might touch order management, inventory feeds, and customer communication. The capability is useful. The access is also a surface area.

What the CSO reporting describes is not a problem unique to frontier labs running exotic experiments. It is a containment and monitoring problem. Agents that can reach outside their intended environment will sometimes do so, especially if nothing is configured to stop them and no one is watching.

Gary McGraw, co-founder of the Berryville Institute of Machine Learning, framed the labs’ posture this way: “They are not as good as they think they are, honestly. It would be better if they had more respect for expertise that is hard-earned from people in all sorts of subsets of security, like forensics or security engineering, building sandboxes, setting up or monitoring network security situations.”

That critique applies to any operator deploying agents without thinking carefully about what those agents can reach and who is watching what they do.

What most people get wrong

The instinct when these stories break is to treat them as evidence that AI itself is unpredictable and dangerous by nature. That instinct leads to the wrong response.

The cybersecurity professionals in this piece are not saying agents are unknowable. They are saying the labs failed to apply containment practices that have existed since the 1990s, things like sandboxing (a walled-off environment where code or a model can run without being able to touch anything outside it) and egress controls (rules that block outbound connections the system is not explicitly allowed to make).

Wallach said it directly: “It’s not rocket science to isolate one of these AI things. Security people have been talking about how to do either air-gapping, so there’s literally no electrical way for data to get from here to here, or absent that, to have really strong egress control.”

The failure was not exotic. The fix is not exotic either. It is the same discipline that any responsible software deployment requires: limit what the system can touch, and watch what it does.

The takeaway

When an AI agent does something unexpected, the first question is not “what did the AI decide to do.” The first question is “what did we give it access to, and were we watching.”

That is not a technology problem. It is an operational one. And it is one operators can address right now, before anything goes sideways.

If you want to think through how AI tools are actually deployed safely inside a business, xovionlabs.com is a good place to start.