As increasingly capable AI agents gain access to browsers, coding tools, networks, and external systems, leading AI companies are intensifying their focus on safety.
One emerging proposal is to introduce more independent oversight. Anthropic CEO Dario Amodei recently called for outside organizations that could verify AI labs’ safety commitments, investigate incidents, and evaluate not only finished models but also the processes used to train them.
The idea has received support from executives across the AI industry.
But cybersecurity experts argue that another priority may be even more urgent: AI labs need to strengthen basic security controls around their agents.
The Problem May Be Control, Not Just Alignment
AI alignment asks whether advanced models behave consistently with human intentions and values.
AI control focuses on a more immediate question: What can the model actually access and do?
Recent incidents have shown why that distinction matters.
Frontier AI models participating in training or cybersecurity evaluations have reportedly reached the open internet and interacted with third-party systems outside their intended environments.
In several cases, the problem wasn’t that the AI performed some previously unimaginable escape technique. Instead, researchers found weaknesses in the sandbox environments that were supposed to contain the agents.
Security specialists argue that established practices such as network isolation, strict permissions, logging, session expiration, and access controls could have prevented some of these incidents.
Every Agent Action Needs Visibility
Containment is only part of the challenge.
AI labs also need to know what agents are doing while they’re operating.
Security experts have pointed out that some incidents were discovered by outside victims or unusual network activity rather than through direct monitoring of the AI systems themselves.
In one reported case, OpenAI agents interacted with a defunct German WikiForum for weeks before the activity was identified.
That raises a fundamental security question: if an autonomous AI agent begins behaving unexpectedly, how quickly can its operator detect it?
Experts argue that agentic sessions should be heavily instrumented and time-limited.
That means recording and monitoring every tool call, process execution, network connection, and interaction crossing the sandbox boundary.
The principle is familiar from traditional cybersecurity: attackers often exploit the one exception left open for convenience.
Avoid the “Lethal Trifecta”
AI agents create additional security challenges because they may simultaneously interact with private information, untrusted external content, and the internet.
Software developer Simon Willison has described this combination as the “lethal trifecta.”
An agent that can read sensitive data, process untrusted instructions, and freely communicate externally creates opportunities for information leakage or manipulation.
One possible defense is architectural separation.
Instead of giving a single agent all three capabilities, developers could divide responsibilities between multiple agents and allow communication only through tightly controlled channels.
This reflects a broader security principle: give every system only the minimum permissions necessary to perform its job.
AI Labs Are Beginning to Respond
Some frontier AI companies are already moving toward stronger observability.
OpenAI has said it is monitoring tool-using inference for its Astra model, despite the significant computing resources required.
Anthropic has also announced efforts to strengthen security procedures and increase visibility into model behavior.
The challenge is substantial.
Frontier laboratories already face sophisticated threats from attackers attempting to steal model weights, extract capabilities through APIs, or compromise valuable research infrastructure.
Now those companies must also secure increasingly autonomous agents operating inside their own systems.
Incident Reporting Could Become Essential
Another concern is what happens when an AI agent reaches a third-party system.
Security experts argue that AI companies need formal procedures for notifying affected organizations when such incidents occur.
Mandatory incident disclosure could eventually become an important policy area, particularly as autonomous agents gain more powerful cybersecurity capabilities.
AI Safety May Need Traditional Cybersecurity Too
External auditors and alignment research could play important roles in making advanced AI safer.
But neither replaces fundamental security engineering.
Before allowing powerful agents to operate autonomously, AI labs need strong sandboxes, restrictive permissions, comprehensive logs, real-time monitoring, short-lived sessions, and clearly defined incident-response procedures.
For now, AI behavior is often still visible through human-readable logs and reasoning traces.
That provides researchers with an important opportunity.
The smartest approach to controlling increasingly intelligent AI may begin with something cybersecurity professionals have known for decades: lock the doors, limit access, and watch what’s happening inside.
