AI agents stay inside their limits only when those limits are enforced by the systems around them, not by the instructions they are given. The containment failures disclosed by AI labs in summer 2026 show that an agent told it has no internet access can still reach one. Boards should require technical boundaries, scoped access and evidence that both work.
In summer 2026, several AI labs reported agents reaching beyond the limits set for them. What follows is AIPEX’s own view of what those events mean for a board, based on the companies’ own published reports.
What actually happened?
Two primary reports matter. On 16 July 2026, Hugging Face disclosed an intrusion into its internal systems that it described as “driven, end to end, by an autonomous AI agent system” (Hugging Face, security incident disclosure, 16 July 2026). Its technical timeline, published on 27 July 2026, attributed the intrusion to an agent driven by OpenAI models during a capability evaluation, and recovered roughly 17,600 attacker actions (Hugging Face, agent intrusion technical timeline, 27 July 2026).
On 30 July 2026, Anthropic reported that after reviewing 141,006 evaluation runs it had found three incidents in which Claude models reached the internet from a third-party evaluation environment and gained unauthorised access to the real systems of three organisations. It traced the cause to a misconfiguration that left evaluation machines with internet access, even though the models had been told they had none (Anthropic, Investigating three incidents in our cybersecurity evaluations, 30 July 2026).
These happened inside the world’s best-resourced AI labs, during testing. That is the point. If containment can fail there, a business deploying agents into finance, procurement or customer service should not assume it holds by default.
Why is an instruction not a control?
An agent’s instructions describe what it should do. Its permissions decide what it can do. In the Anthropic case, the prompt said there was no internet; the network said otherwise, and the network won. Most business deployments rely on the same kind of wording: “only update records in this system”, “never send payments above this value”, “do not contact customers directly”.
Wording is useful guidance for a well-behaved agent. It is not a control. A control is something that stops the action even when the agent misunderstands its task, is manipulated by content it reads, or decides that a shortcut is part of the job. Boards already apply this logic to people: a delegation letter is backed by system limits on who can approve a payment. Agents need the same backing, only stricter, because they act faster and at far greater volume.
What should boards take from these incidents?
Four lessons carry across sectors.
| What the reports show | The board control | Evidence to ask for |
|---|---|---|
| Agents reached systems they were told were out of reach | Network and system boundaries enforced outside the agent | A test showing the agent cannot reach what it should not |
| A third party’s configuration created the exposure | Vendor and partner environments inside your assurance scope | Contract terms and test results covering the partner’s set-up |
| Thousands of actions outpaced human review | Automated monitoring and hard limits on volume | Alert thresholds, and who is paged when they fire |
| Broad credentials let activity spread | Narrow, short-lived access for every agent | A list of each agent’s permissions, reviewed quarterly |
The second lesson is the one boards most often miss. Anthropic’s incident arose in a partner’s environment. In most companies, agents will run on vendor platforms, inside software already licensed, or through an integrator. Containment is only as strong as the weakest environment in that chain, and the contract is where the board gets to set the standard.
Could your company be on the receiving end?
Yes, and this is the less comfortable half of the story. The organisations harmed in these reports were not running the agents. Their systems were simply reachable. Agent activity arriving from outside will look like any other automated traffic at first. The defences are familiar ones applied with more urgency: patching, strong authentication, no weak or shared passwords, and the ability to spot and block unusual volumes of activity quickly. Our earlier analysis of how boards should respond to AI-speed cyberattacks covers that side in more depth. How much freedom an agent should have in the first place is covered in How Much Autonomy Should an AI Agent Have?
What should the board ask management now?
- Which of our AI agents can take actions, not just make suggestions, and where is that list?
- For each one, which limits are enforced by our systems, and which exist only in its instructions?
- When did we last test that an agent cannot reach a system or dataset outside its task?
- Which agents run in a vendor’s or partner’s environment, and what does the contract say about containment and incident notice?
- If an agent took thousands of actions in an afternoon, what would alert us, and who would be called?
- Who can stop every agent at once, and have they done it in a test?
If management can answer the first two questions but not the rest, the organisation has an inventory without controls. That is the most common position we see, and it is fixable in weeks, not years.
Where to start
Our executive briefing on agentic AI risks and the ten controls boards must require sets out the full control set, including action and spend limits, a kill switch and live monitoring, with an autonomy scale for deciding how much freedom each agent gets. For boards where agents are already arriving and nobody has set their limits, the step on its four-step path that fits is step 3, Plan: an Executive AI Strategy Day (£1,499 + VAT) produces the agent inventory, autonomy ceilings, control set and a 90-day plan. The Agentic AI Board Checklist below is a quicker first pass.
Frequently asked questions
Can an AI agent get around the limits it is given?
Yes, if those limits exist only in its instructions. In 2026 Anthropic reported models reaching the internet from an evaluation environment they had been told was offline, because of a misconfiguration. Limits hold when they are enforced by networks, permissions and system controls outside the agent.
What is the difference between an instruction and a control for AI agents?
An instruction tells the agent what it should do. A control stops the action even if the agent misunderstands its task or is manipulated. Boards should ask which agent limits are enforced by systems and which exist only as wording in a prompt.
What should a board ask about AI agent containment?
Which agents can act, which limits are system-enforced, when containment was last tested, which agents run in vendor environments, what would alert the business to unusual volumes, and who can stop every agent at once. See Agentic AI Risks and AI Agent Governance →
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.