The Great Escape - Improving AI Safety
Recent reports of advanced AI agents “escaping” research environments, reaching the public internet and accessing external systems have attracted considerable attention. Much of the commentary, however, risks overstating the novelty of the underlying behaviour by interpreting agentic systems through an overly human lens.
Modern agentic AI systems are designed to pursue objectives, decompose tasks, create and coordinate sub-agents, use tools, retry failed approaches and search for alternative routes. In development environments such as Codex, Claude Code and Replit, this is expected behaviour. Because agents increasingly communicate in natural language, ordinary computational functions can sound remarkably human, creating an “anthropomorphic log fallacy” in which orchestration is mistaken for intent, hostility or self-preservation.
The more important issue is whether the boundaries around these systems are sufficiently clear and enforceable. A prompt is not a security boundary. Telling an agent that it is inside a simulation, or that it has no internet access, is not equivalent to technically preventing external access.
Recent incidents involving OpenAI (Hugging Face & Australia’s Medicare SRS), Anthropic and other frontier AI providers illustrate this problem. For a human, moving from one organisation’s network into another is an obvious change in ownership, permission and legal authority. For an AI agent, however, the digital environment may appear technically continuous. A local API call, a cloud request and access to an external website may all look like similar tool operations. In this sense, technical continuity can conceal legal discontinuity.
This leads to a central principle: capability does not create authority. An agent should only act within the authority delegated by its operator. Effective agentic security therefore requires three aligned boundaries: instructional, authority and technical.
The incidents also reveal a wider cybersecurity problem. Once agents reach external systems, they often encounter familiar weaknesses such as poor authentication, exposed services and misconfiguration. The agent may be new, but many of the vulnerabilities are not.
The wider lesson is therefore not simply about AI “escape”. Agentic AI is beginning to expose the difference between regulating cyber incidents and regulating cyber insecurity, and to reveal how much long-standing digital weakness remains hidden until something capable enough comes along to find it.
This paper doesn’t seek to downplay the obvious power of agentic AI but it does seek a less sensational and more practical approach to the clarification and management of the risks relating to its deployment.
Download the full paper
Explore the paper 'Improving AI Safety - The Great Escape' in full.
AI safety, delegated authority and the case for ordinary accountability.