Artificial intelligence agents are expanding the possibilities of automation. Unlike other AI systems, they can use tools, reason through tasks, and autonomously execute sequences of actions until they achieve a goal. However, what happens when their actions go beyond their intended boundaries?
To understand the risks, it is helpful to start by looking at how they work. An AI agent combines three elements: an AI reasoning model that plans its actions, a set of tools through which it interacts with its environment, and an autonomy mechanism that allows it to test solutions, evaluate results, and continue working autonomously around the clock, without human intervention, until it achieves its assigned objective.
This combination significantly increases their ability to act, but it also amplifies the consequences of behavior that falls outside established boundaries. Although these risks are not fundamentally different from those posed by a human team acting outside its organization's rules, the key difference lies in speed and scale: hundreds of agents can operate continuously, run tests, and exchange information at a pace that humans cannot match.
When agents exceed the boundaries of their environment
An example of these risks is the Hugging Face–OpenAI (HF-OIA) incident, reported in August 2026. In this case, agents were assigned tasks that they could not complete within their sandbox (a secure, isolated experimental environment within OpenAI's facilities). In an attempt to complete these tasks, they explored previously unknown vulnerabilities in the tools available to them and managed to escape the sandbox.
The vulnerability was found in the cache of Artifactory, a third-party product used as a binary software repository. Although this tool was within the environment's authorized boundaries, the vulnerability allowed agents to escape the sandbox. This possibility had not been anticipated by the researchers responsible for configuring the environment.
The incident highlights a fundamental issue: a controlled environment does not guarantee the security of an AI agent system if the tools agents can access contain vulnerabilities (including zero-day vulnerabilities unknown to the software vendor) or are misconfigured. Therefore, protecting agents cannot be limited to isolating their environment and network communications; it must also extend to securing every tool they can access.
The challenge of monitoring systems operating at scale
The speed at which agents operate introduces another challenge: supervision. A specialized agent can complete in minutes tasks that would take a person hours, including consulting documentation, analyzing information, and running tests. As a result, these systems generate vast amounts of reasoning traces, messages, logs, and files.
In the HF-OIA incident, more than a thousand agents exchanged over 70,000 messages and files. Although these interactions are logged and can be audited, reconstructing what happened requires analyzing an enormous volume of data. In these scenarios, AI may also be needed to monitor the activity of other agents. According to reports on the incident, OpenAI, Hugging Face, and METR used AI agents to investigate how the escape from the controlled environment occurred.
Therefore, monitoring is not simply a matter of recording actions. It also requires mechanisms capable of analyzing those records and reconstructing the behavior of complex multi-agent systems.
Emergent behaviors: the risks of coordination
The HF-OIA incident also revealed capabilities that were not expected in a system where agents were intended to operate independently, as stipulated in the OpenAI experiment. During the experiment, some agents found ways to communicate with one another, share information, distribute tasks, and build on each other's discoveries.
The observed behaviors included spontaneous coordination, the organization of work through different roles, the dissemination of knowledge, and the assumption of tasks initially assigned to other agents. Attempts to optimize apparent evaluation results by manipulating evidence or outcomes were also detected.
What was particularly significant was not any single capability, but the collective outcome of interactions among multiple agents. Communication, specialization, and the sharing of discoveries enabled them to tackle more complex tasks than a single agent operating in isolation could have handled.
These observations do not imply that agents possess consciousness or intentionality of their own. Rather, they reflect emergent behaviors arising from the interaction between models, tools, objectives, and the environment. It is therefore essential to assess not only the individual capabilities of each agent, but also the behaviors that may emerge when multiple agents work together.
Measures to ensure safe deployment
Addressing these risks requires action on several fronts. First, the security of controlled environments must be strengthened, covering both network communications and the tools available to agents. One proposed measure is to conduct ethical hacking tests on each tool, using agents with capabilities similar to those that will operate in the environment. This approach could also be extended to software vendors, encouraging them to test their products before releasing new versions.
Second, further progress must be made in model alignment. Rewarding an agent for completing a task is not enough; it is also important to consider how it completes that task. Training should encourage behaviors that are consistent with established principles and rules, ensuring that achieving an objective does not take precedence over respecting defined boundaries.
Alignment remains one of the main concerns among researchers, as models tend to optimize the outcomes for which they are rewarded during training.
Finally, defensive capabilities must evolve alongside offensive ones. In scenarios where thousands of agents can coordinate and operate continuously, relying exclusively on teams of human specialists to protect critical infrastructure may prove insufficient. Agent-based defense systems capable of operating at a comparable scale will therefore be needed to strengthen detection, analysis, and response capabilities.
A new scale of cybersecurity
AI agents offer new possibilities, but their autonomy requires us to rethink how we design, protect, and monitor the systems in which they operate. Securing the tools they use, ensuring model alignment, and developing the ability to audit large volumes of activity will be essential to keeping their behavior within expected boundaries.
In the face of large-scale AI attacks, relying solely on human teams of specialists will no longer be sufficient. We will need to deploy our own agentic defense systems, equipped to operate at a scale comparable to that of the adversary.
Pablo Méndez
Director of Artificial Intelligence
